aeb232d84afc6c6d95ea92940cee4c7707126b8204b95d6707f75a1eeec8a217

Analysis

max time kernel
143s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe
Size

38.2MB
MD5

0d6f1a17bc5c87c304d2ba6ff25801e9
SHA1

69754bff37cf31ed4912a3a58c535ee3ac69d696
SHA256

aeb232d84afc6c6d95ea92940cee4c7707126b8204b95d6707f75a1eeec8a217
SHA512

78b7c4f149152e5bd15907b49a3fe392ddfb5b7af0a847357ca13db264eb204a5148e2ffb2d501dc38161a2bdb80f6c586fd0d027a1638dfb71d0a13aa69235e
SSDEEP

786432:l7YfqVD/drU8AkFI4ecXUEZBKRj06pysShPULwI6Kgvn:efmD/dA9kFnzUEXKRjFkJhUc

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 21 IoCs

Processes:

ekrn.exe

description	ioc	process
File created	C:\Windows\system32\DRIVERS\SETBA7C.tmp	ekrn.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETC483.tmp	ekrn.exe
File opened for modification	C:\Windows\system32\DRIVERS\eamonm.sys	ekrn.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETD1A4.tmp	ekrn.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETD31C.tmp	ekrn.exe
File opened for modification	C:\Windows\system32\DRIVERS\eelam.sys	ekrn.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETC463.tmp	ekrn.exe
File created	C:\Windows\system32\DRIVERS\SETC483.tmp	ekrn.exe
File opened for modification	C:\Windows\system32\DRIVERS\edevmon.sys	ekrn.exe
File created	C:\Windows\system32\DRIVERS\SETD31C.tmp	ekrn.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETBA7C.tmp	ekrn.exe
File created	C:\Windows\system32\DRIVERS\SETBD1E.tmp	ekrn.exe
File created	C:\Windows\system32\DRIVERS\SETC463.tmp	ekrn.exe
File opened for modification	C:\Windows\system32\DRIVERS\ekbdflt.sys	ekrn.exe
File created	C:\Windows\system32\DRIVERS\SETD174.tmp	ekrn.exe
File created	C:\Windows\system32\DRIVERS\SETD1A4.tmp	ekrn.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETBD1E.tmp	ekrn.exe
File opened for modification	C:\Windows\system32\DRIVERS\ehdrv.sys	ekrn.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETD174.tmp	ekrn.exe
File opened for modification	C:\Windows\system32\DRIVERS\epfwwfp.sys	ekrn.exe
File opened for modification	C:\Windows\system32\DRIVERS\epfw.sys	ekrn.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe\MitigationOptions = "16777216"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe	MsiExec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe

Executes dropped EXE 6 IoCs

Processes:

InstHelper.exeekrn.exeInstHelper.exeInstHelper.exeeguiproxy.exeegui.exe

pid process

708 InstHelper.exe
4952 ekrn.exe
1248 InstHelper.exe
5392 InstHelper.exe
5512 eguiproxy.exe
5584 egui.exe

pid	process
708	InstHelper.exe
4952	ekrn.exe
1248	InstHelper.exe
5392	InstHelper.exe
5512	eguiproxy.exe
5584	egui.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exeInstHelper.exeekrn.exe

pid	process
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
708	InstHelper.exe
708	InstHelper.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe
4952	ekrn.exe

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

MsiExec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\Shellex\ContextMenuHandlers	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ESET Security Shell	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ESET Security Shell\ = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"	MsiExec.exe

Registers COM server for autorun 1 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

MsiExec.exeekrn.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32\ = "C:\\Program Files\\ESET\\ESET Security\\shellExt.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\InprocServer32\ThreadingModel = "Both"	ekrn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F43F5136-AA90-4005-9368-F91F5C120D69}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F43F5136-AA90-4005-9368-F91F5C120D69}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\InprocServer32	ekrn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\InprocServer32\ = "C:\\Program Files\\ESET\\ESET Security\\eamsi.dll"	ekrn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F43F5136-AA90-4005-9368-F91F5C120D69}\InprocServer32\ = "C:\\Program Files\\ESET\\ESET Security\\eplgOutlook.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32\ThreadingModel = "Apartment"	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\egui = "\"C:\\Program Files\\ESET\\ESET Security\\ecmds.exe\" /run /hide /proxy"	msiexec.exe

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

56 1956 msiexec.exe

flow	pid	process
56	1956	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1518.001

Processes:

msiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\ESET\NOD	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\ESET\NOD	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in System32 directory 64 IoCs

Processes:

DrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeeguiproxy.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\SETC116.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\eamonm.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ekbdflt.inf_amd64_dc1be21f8701f143\ekbdflt.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\SETBAF9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\SETC115.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\eelam.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\eelam.inf_amd64_558ab54140135969\eelam.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\SETD1DD.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\SETB3E6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ehdrv.inf_amd64_f9f787db44129b00\ehdrv.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c74d3266-a6c9-4245-bce7-a0082a5af877}\SETCEC0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\edevmon.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\SETBAF9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\SETD1DD.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\SETBAFA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\SETC104.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\SETBAFA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c74d3266-a6c9-4245-bce7-a0082a5af877}\SETCEE1.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\SETCF6C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\SETB3D5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\eelam.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\ekbdflt.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\epfw.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\epfw.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\SETC097.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\SETC0A7.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\SETC0A8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\eamonm.sys	DrvInst.exe
File created	C:\Windows\system32\NOTICE_mod	eguiproxy.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\ehdrv.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\SETBB0B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ekbdflt.inf_amd64_dc1be21f8701f143\ekbdflt.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\eamonm.inf_amd64_475748a313af7ed9\eamonm.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\eamonm.inf_amd64_475748a313af7ed9\eamonm.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\edevmon.inf_amd64_c2bb7368195daff0\edevmon.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\epfwwfp.inf_amd64_6841d12cae41b94f\epfwwfp.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\eelam.inf_amd64_558ab54140135969\eelam.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\SETC0A7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\eamonm.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c74d3266-a6c9-4245-bce7-a0082a5af877}\epfwwfp.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\SETCF6D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\SETD1EE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\epfw.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\epfw.inf_amd64_39f5b61dc2f1fc3e\epfw.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\SETBB0B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\SETC097.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ekbdflt.inf_amd64_dc1be21f8701f143\ekbdflt.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\SETC116.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\SETCF6E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\SETCF6D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ehdrv.inf_amd64_f9f787db44129b00\ehdrv.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\SETC0A8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c74d3266-a6c9-4245-bce7-a0082a5af877}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\SETD1EE.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\eelam.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe

Drops file in Program Files directory 64 IoCs

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
File created	C:\Program Files\ESET\ESET Security\Help\layout_mobile.css	MsiExec.exe
File created	C:\Program Files\ESET\ESET Security\api-ms-win-crt-conio-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\callmsi.exe	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\eguiParentalLang.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\ekrnAmonLang.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\ShellExtLang.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\edb.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\eguiDevmon.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\ekrnLicensing.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\eula.rtf	MsiExec.exe
File created	C:\Program Files\ESET\ESET Security\Help\ielte8.css	MsiExec.exe
File created	C:\Program Files\ESET\ESET Security\x86\eplgOutlook.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\eplgMailPluginsLang.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\eplgOutlook.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\msvcp140_1.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\SysInspector.exe	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\eguiHipsLang.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\ekrnHipsLang.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\api-ms-win-core-sysinfo-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\ekrnScriptMon.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\windowsperformancerecordercontrol.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\eguiProxyLang.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\ekrnMailPluginsLang.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\ekrnCerberusLang.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\Help\no_internet_connection.html	MsiExec.exe
File created	C:\Program Files\ESET\ESET Security\api-ms-win-core-errorhandling-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\api-ms-win-core-profile-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\ekrnHips.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\eguiAntitheftLang.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\Help\idh_wizard_activation_type.html	MsiExec.exe
File created	C:\Program Files\ESET\ESET Security\api-ms-win-crt-process-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\Drivers\eelam\eelam.inf	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\Help\warning.svg	MsiExec.exe
File created	C:\Program Files\ESET\ESET Security\Help\important.svg	MsiExec.exe
File created	C:\Program Files\ESET\ESET Security\api-ms-win-core-file-l2-1-0.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\Drivers\edevmon\edevmon.sys	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\Drivers\epfw\epfw.cat	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\ProtobufLite.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\updater.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\Drivers\eelam\eelam.sys	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\eguiScan.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\SecurityProductInformation.ini	msiexec.exe
File opened for modification	C:\Program Files\ESET\ESET Security\Modules\em039_64\1902\em039_64.dll	MsiExec.exe
File created	C:\Program Files\ESET\ESET Security\eula.cab	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\SysInspectorLang.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\api-ms-win-core-file-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\Drivers\eelam\eelam.cat	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\ucrtbase.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\ekrnLang.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\Help\help.cab	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\concrt140.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\ecls.exe	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\eguiIPM.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\Drivers\epfwwfp\EpfwWfp.sys	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\api-ms-win-crt-runtime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\eguiActivation.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\sciter-x.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\eTpComm.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\Help\example.svg	MsiExec.exe
File created	C:\Program Files\ESET\ESET Security\api-ms-win-crt-filesystem-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\Drivers\ehdrv\ehdrv.inf	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\ekrnDemeter.dll	msiexec.exe
File created	C:\Program Files\ESET\ESET Security\Drivers\epfwwfp\EpfwWfp.inf	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exeDrvInst.exeDrvInst.exeDrvInst.exeekrn.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI7177.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI77A4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{A1B1AC12-A547-4F1D-9000-8E30D7929D04}\Icon_License	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI6AFA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7224.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI74E4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7842.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9EC1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC6F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIADCA.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI7D15.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI81AD.tmp	msiexec.exe
File created	C:\Windows\Installer\{A1B1AC12-A547-4F1D-9000-8E30D7929D04}\Icon_Uninstall	msiexec.exe
File opened for modification	C:\Windows\ELAMBKUP\SETBA7D.tmp	ekrn.exe
File created	C:\Windows\ELAMBKUP\SETBA7D.tmp	ekrn.exe
File created	C:\Windows\inf\oem6.inf	DrvInst.exe
File created	C:\Windows\INF\oem8.PNF	ekrn.exe
File created	C:\Windows\inf\oem9.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI6D6D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9622.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIADDB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB94E.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem9.inf	DrvInst.exe
File created	C:\Windows\INF\oem9.PNF	ekrn.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8100.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9054.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAEAD.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem7.inf	DrvInst.exe
File created	C:\Windows\inf\oem8.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI6E1A.tmp	msiexec.exe
File created	C:\Windows\inf\oem7.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSID2C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6EF6.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIB9EC.tmp	msiexec.exe
File opened for modification	C:\Windows\ELAMBKUP\eelam.sys	ekrn.exe
File opened for modification	C:\Windows\inf\oem5.inf	DrvInst.exe
File created	C:\Windows\INF\oem5.PNF	ekrn.exe
File opened for modification	C:\Windows\inf\oem8.inf	DrvInst.exe
File created	C:\Windows\Installer\e595d78.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{A1B1AC12-A547-4F1D-9000-8E30D7929D04}\Icon_Help	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9829.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE8D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB97D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI676C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7FF5.tmp	msiexec.exe
File created	C:\Windows\Installer\{A1B1AC12-A547-4F1D-9000-8E30D7929D04}\Icon_Product	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE0C.tmp	msiexec.exe
File created	C:\Windows\Installer\e595d7c.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI6623.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\INF\oem4.PNF	ekrn.exe
File opened for modification	C:\Windows\Installer\MSI6C62.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97CA.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem6.PNF	ekrn.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

DrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exevssvc.exeDrvInst.exeDrvInst.exeDrvInst.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1752 taskkill.exe

pid	process
1752	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeMsiExec.exeDrvInst.exeDrvInst.exeInstHelper.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\ESET\Setup\CAError = "InstSupp!caRestrictDirectoryAccess=1627;CA;CAD=C:\\ProgramData\\ESET\\ESET Security\\Updfiles\\\|"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\ESET\ESET Security\CurrentVersion\internal\ProductVersion = 31352e322e3131	InstHelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\ESET\Setup	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\ESET	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\ESET\ESET Security	InstHelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeMsiExec.exeregsvr32.exeekrn.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\SourceList\Media\5 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\DeviceMisuse = "_Features"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\SourceList\PackageName = "ehs_nt64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\SourceList\Media\3 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ESET.SysInspector\shell\open\command\ = "\"C:\\Program Files\\ESET\\ESET Security\\SysInspector.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F43F5136-AA90-4005-9368-F91F5C120D69}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Parental = "_Features"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F43F5136-AA90-4005-9368-F91F5C120D69}\InprocServer32\ = "C:\\Program Files\\ESET\\ESET Security\\eplgOutlook.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\Shellex\ContextMenuHandlers	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Antitheft = "_Features"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\InprocServer32\ = "C:\\Program Files\\ESET\\ESET Security\\eamsi.dll"	ekrn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\ProgID\ = "Eamsi.EamsiObject.1"	ekrn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32\ = "C:\\Program Files\\ESET\\ESET Security\\shellExt.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\_Features	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\ProductName = "ESET Security"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\79AA332A50D011E4585D700F695D0537	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\VersionIndependentProgID	ekrn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Demeter = "_Features"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\79AA332A50D011E4585D700F695D0537\21CA1B1A745AD1F40900E8037D29D940	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F43F5136-AA90-4005-9368-F91F5C120D69}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\Shellex\ContextMenuHandlers	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drives\Shellex\ContextMenuHandlers\ESET Security Shell	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32\ = "C:\\Program Files\\ESET\\ESET Security\\x86\\shellExt.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Antispam = "_Features"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Eamsi.EamsiObject\ = "EamsiObject Class"	ekrn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\ProgID	ekrn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\AppID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F43F5136-AA90-4005-9368-F91F5C120D69}\ProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ESET Security Shell\ = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\SourceList\Media\4 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA591527-7826-4165-93D8-5702F36C8AB9}\1.0\FLAGS\ = "0"	ekrn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\DeviceControl = "_Features"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Encryption = "_Features"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Ipm = "_Features"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\InprocServer32	ekrn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Eamsi.EamsiObject\CLSID\ = "{ECC7E393-B680-4109-86BD-7779105DF1BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ESET Security Shell	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Firewall = "_Features"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\ = "EamsiObject Class"	ekrn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA591527-7826-4165-93D8-5702F36C8AB9}	ekrn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ESET.SysInspector\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\_Distributor	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\SourceList\Media\2 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Eamsi.EamsiObject.1\ = "EamsiObject Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\EDTD = "_Features"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\TypeLib	ekrn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\TypeLib\ = "{EA591527-7826-4165-93D8-5702F36C8AB9}"	ekrn.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ESET.SysInspector\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\Shellex\ContextMenuHandlers	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\_License	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Updater = "_Features"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA591527-7826-4165-93D8-5702F36C8AB9}\1.0\HELPDIR\ = "C:\\Program Files\\ESET\\ESET Security"	ekrn.exe

Suspicious behavior: LoadsDriver 10 IoCs

Processes:

pid process

668
668
668
668
668
668
668
668
668
668

pid	process
668
668
668
668
668
668
668
668
668
668

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	2616	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2616	msiexec.exe
Token: SeSecurityPrivilege	1956	msiexec.exe
Token: SeCreateTokenPrivilege	2616	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2616	msiexec.exe
Token: SeLockMemoryPrivilege	2616	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2616	msiexec.exe
Token: SeMachineAccountPrivilege	2616	msiexec.exe
Token: SeTcbPrivilege	2616	msiexec.exe
Token: SeSecurityPrivilege	2616	msiexec.exe
Token: SeTakeOwnershipPrivilege	2616	msiexec.exe
Token: SeLoadDriverPrivilege	2616	msiexec.exe
Token: SeSystemProfilePrivilege	2616	msiexec.exe
Token: SeSystemtimePrivilege	2616	msiexec.exe
Token: SeProfSingleProcessPrivilege	2616	msiexec.exe
Token: SeIncBasePriorityPrivilege	2616	msiexec.exe
Token: SeCreatePagefilePrivilege	2616	msiexec.exe
Token: SeCreatePermanentPrivilege	2616	msiexec.exe
Token: SeBackupPrivilege	2616	msiexec.exe
Token: SeRestorePrivilege	2616	msiexec.exe
Token: SeShutdownPrivilege	2616	msiexec.exe
Token: SeDebugPrivilege	2616	msiexec.exe
Token: SeAuditPrivilege	2616	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2616	msiexec.exe
Token: SeChangeNotifyPrivilege	2616	msiexec.exe
Token: SeRemoteShutdownPrivilege	2616	msiexec.exe
Token: SeUndockPrivilege	2616	msiexec.exe
Token: SeSyncAgentPrivilege	2616	msiexec.exe
Token: SeEnableDelegationPrivilege	2616	msiexec.exe
Token: SeManageVolumePrivilege	2616	msiexec.exe
Token: SeImpersonatePrivilege	2616	msiexec.exe
Token: SeCreateGlobalPrivilege	2616	msiexec.exe
Token: SeBackupPrivilege	3848	vssvc.exe
Token: SeRestorePrivilege	3848	vssvc.exe
Token: SeAuditPrivilege	3848	vssvc.exe
Token: SeBackupPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe

Suspicious use of FindShellTrayWindow 19 IoCs

Processes:

msiexec.exeeguiproxy.exe

pid	process
2616	msiexec.exe
2616	msiexec.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe

Suspicious use of SendNotifyMessage 17 IoCs

Processes:

eguiproxy.exe

pid	process
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe
5512	eguiproxy.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exemsiexec.exeMsiExec.exesvchost.exeekrn.exeregsvr32.exeMsiExec.exe

description	pid	process	target process
PID 940 wrote to memory of 2616	940	2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe	msiexec.exe
PID 940 wrote to memory of 2616	940	2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe	msiexec.exe
PID 1956 wrote to memory of 3812	1956	msiexec.exe	srtasks.exe
PID 1956 wrote to memory of 3812	1956	msiexec.exe	srtasks.exe
PID 1956 wrote to memory of 2220	1956	msiexec.exe	MsiExec.exe
PID 1956 wrote to memory of 2220	1956	msiexec.exe	MsiExec.exe
PID 1956 wrote to memory of 4612	1956	msiexec.exe	MsiExec.exe
PID 1956 wrote to memory of 4612	1956	msiexec.exe	MsiExec.exe
PID 4612 wrote to memory of 1752	4612	MsiExec.exe	taskkill.exe
PID 4612 wrote to memory of 1752	4612	MsiExec.exe	taskkill.exe
PID 4612 wrote to memory of 708	4612	MsiExec.exe	InstHelper.exe
PID 4612 wrote to memory of 708	4612	MsiExec.exe	InstHelper.exe
PID 1612 wrote to memory of 5108	1612	svchost.exe	DrvInst.exe
PID 1612 wrote to memory of 5108	1612	svchost.exe	DrvInst.exe
PID 1612 wrote to memory of 428	1612	svchost.exe	DrvInst.exe
PID 1612 wrote to memory of 428	1612	svchost.exe	DrvInst.exe
PID 1612 wrote to memory of 3636	1612	svchost.exe	DrvInst.exe
PID 1612 wrote to memory of 3636	1612	svchost.exe	DrvInst.exe
PID 4952 wrote to memory of 3732	4952	ekrn.exe	regsvr32.exe
PID 4952 wrote to memory of 3732	4952	ekrn.exe	regsvr32.exe
PID 1612 wrote to memory of 2252	1612	svchost.exe	DrvInst.exe
PID 1612 wrote to memory of 2252	1612	svchost.exe	DrvInst.exe
PID 3732 wrote to memory of 428	3732	regsvr32.exe	regsvr32.exe
PID 3732 wrote to memory of 428	3732	regsvr32.exe	regsvr32.exe
PID 3732 wrote to memory of 428	3732	regsvr32.exe	regsvr32.exe
PID 1612 wrote to memory of 3548	1612	svchost.exe	DrvInst.exe
PID 1612 wrote to memory of 3548	1612	svchost.exe	DrvInst.exe
PID 1612 wrote to memory of 3172	1612	svchost.exe	DrvInst.exe
PID 1612 wrote to memory of 3172	1612	svchost.exe	DrvInst.exe
PID 1612 wrote to memory of 4216	1612	svchost.exe	DrvInst.exe
PID 1612 wrote to memory of 4216	1612	svchost.exe	DrvInst.exe
PID 2220 wrote to memory of 1248	2220	MsiExec.exe	InstHelper.exe
PID 2220 wrote to memory of 1248	2220	MsiExec.exe	InstHelper.exe
PID 2220 wrote to memory of 5392	2220	MsiExec.exe	InstHelper.exe
PID 2220 wrote to memory of 5392	2220	MsiExec.exe	InstHelper.exe
PID 4952 wrote to memory of 5512	4952	ekrn.exe	eguiproxy.exe
PID 4952 wrote to memory of 5512	4952	ekrn.exe	eguiproxy.exe
PID 4952 wrote to memory of 5584	4952	ekrn.exe	egui.exe
PID 4952 wrote to memory of 5584	4952	ekrn.exe	egui.exe
PID 940 wrote to memory of 5608	940	2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe	msedge.exe
PID 940 wrote to memory of 5608	940	2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe	msedge.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ehs_nt64.msi" /qb PRODUCTTYPE=eis CFG_POTENTIALLYUNWANTED_ENABLED=0 CFG_LIVEGRID_ENABLED=0 FIRSTSCAN_ENABLE=0 CFG_EPFW_MODE=0 ACTIVATION_DLG_SUPPRESS=0
2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.cybermania.ws/
2⤵
PID:5608

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Sets file execution options in registry
- Adds Run key to start application
- Blocklisted process makes network request
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:3812

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding E7DEDECD9F82DDB70AEF9806B9AEC489
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220

C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\InstHelper.exe
"C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\InstHelper.exe" -gv
3⤵
- Executes dropped EXE
PID:1248

C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\InstHelper.exe
"C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\InstHelper.exe" -sd "C:\Windows\Temp\eset\bts.stats" "ESET Security" "15.2.11.0" "1033"
3⤵
- Executes dropped EXE
PID:5392

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 4D3DD90216891894CEC2A379CE3D49D5 E Global\MSI0000
2⤵
- Sets file execution options in registry
- Loads dropped DLL
- Modifies system executable filetype association
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4612

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /F /T /IM ehttpsrv.exe
3⤵
- Kills process with taskkill
PID:1752

C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\InstHelper.exe
"C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\InstHelper.exe" -ci "C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\_InstData.xml"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:1892

C:\Program Files\ESET\ESET Security\ekrn.exe
"C:\Program Files\ESET\ESET Security\ekrn.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4952

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Program Files\ESET\ESET Security\x86\eamsi.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:3732

C:\Windows\SysWOW64\regsvr32.exe
/s "C:\Program Files\ESET\ESET Security\x86\eamsi.dll"
3⤵
- Modifies registry class
PID:428

C:\Program Files\ESET\ESET Security\eguiproxy.exe
"C:\Program Files\ESET\ESET Security\eguiproxy.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5512

C:\Program Files\ESET\ESET Security\egui.exe
"C:\Program Files\ESET\ESET Security\egui.exe"
2⤵
- Executes dropped EXE
PID:5584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "9" "C:\Program Files\ESET\ESET Security\Drivers\eelam\eelam.inf" "9" "4d8859be3" "000000000000014C" "Service-0x0-3e7$\Default" "0000000000000140" "208" "C:\Program Files\ESET\ESET Security\Drivers\eelam"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5108

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "9" "C:\Program Files\ESET\ESET Security\Drivers\ehdrv\ehdrv.inf" "9" "446a2f407" "0000000000000140" "Service-0x0-3e7$\Default" "0000000000000164" "208" "C:\Program Files\ESET\ESET Security\Drivers\ehdrv"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:428

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "9" "C:\Program Files\ESET\ESET Security\Drivers\ekbdflt\ekbdflt.inf" "9" "4f39970b7" "0000000000000178" "Service-0x0-3e7$\Default" "000000000000017C" "208" "C:\Program Files\ESET\ESET Security\Drivers\ekbdflt"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3636

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "9" "C:\Program Files\ESET\ESET Security\Drivers\eamonm\eamonm.inf" "9" "4d14d0413" "0000000000000188" "Service-0x0-3e7$\Default" "0000000000000140" "208" "C:\Program Files\ESET\ESET Security\Drivers\eamonm"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2252

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "9" "C:\Program Files\ESET\ESET Security\Drivers\epfwwfp\epfwwfp.inf" "9" "48fcaabe7" "0000000000000140" "Service-0x0-3e7$\Default" "000000000000017C" "208" "C:\Program Files\ESET\ESET Security\Drivers\epfwwfp"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3548

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "9" "C:\Program Files\ESET\ESET Security\Drivers\edevmon\edevmon.inf" "9" "48c1400ab" "0000000000000164" "Service-0x0-3e7$\Default" "0000000000000160" "208" "C:\Program Files\ESET\ESET Security\Drivers\edevmon"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3172

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "9" "C:\Program Files\ESET\ESET Security\Drivers\epfw\epfw.inf" "9" "456eea8cb" "0000000000000150" "Service-0x0-3e7$\Default" "0000000000000184" "208" "C:\Program Files\ESET\ESET Security\Drivers\epfw"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4440 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:1
1⤵
PID:5644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4068 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:1
1⤵
PID:5660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5348 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5780 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:1
1⤵
PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5736 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:5976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=6148 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:1
1⤵
PID:5992

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Software Discovery

T1518

Security Software Discovery

T1518.001

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e595d7b.rbs
Filesize
4.2MB

MD5
1192866dd371659f0bd01cff77636ed4

SHA1
75992238d2e92b5d7bf2d5d03d2cddbc378797fb

SHA256
333db4a40a195ca142031d28c2ffc891a261dc40ae2a9349f03e9b1cccc9608f

SHA512
a34b49485fa7de2962a56888ba355b84ed98ba295d2d040e06f926a534de7164e43158dd6c6e916b87443af3c48c55e034501c3aac48f8cedd3fc825301595eb

Download Submit
C:\Program Files\ESET\ESET Security\Help\help.cab
Filesize
250KB

MD5
5f27d4885c24b14969920a4b0ba65552

SHA1
6a06e5b91211af280873e6234e8812d86d89cdfb

SHA256
3c398a302ab91dbe1bca55cbe0d06c6c96ab1d42212c9b5f2aadb5cb44c45fd5

SHA512
b90abb3ce9895b4e287d8e04ab41f80d5f2ce6e160d09cb0555583478d217f0586602e2959bb2f1cbaaa9cfbce2e2934f527e3c8124840e094b2ce0c95b848e4

Download Submit
C:\Program Files\ESET\ESET Security\Modules\em000_64\1067\em000_64.dll
Filesize
201KB

MD5
8d181fa24bd70d91e2e1b1f5674a5c11

SHA1
4ea0dd216ca452cfe0b5525675d2f78e3bd4f9b2

SHA256
28c7c9092921a4c0b7a5fea40c47065fbb3772ed6cfd6ca5e7ce2634565fc20f

SHA512
09342cfff1faa0186b1202338613855a99f2b63fd453b4c30d1861ebe2181ca2879d54d55bdae250d3ee99b81fe4a0a5a2dd93536d88e072cefe8245823d1ece

Download Submit
C:\Program Files\ESET\ESET Security\Modules\em000k_64\1022\em000k_64.dll
Filesize
58KB

MD5
7d016950c035870d2939d0472bde6a59

SHA1
0bef958548114b29500e5cf0bd0845f9beedc5fd

SHA256
9c021e59e2d9d4b55535da2f59de339864e0e66a457f2fdd87ea1d34c74dbe8f

SHA512
679c34197c6d66ffc10f9971bf4e6c5e349cdcaa54258fc2faffd902127d3c6979af8a64119e1d79559db2f261bb781007fae76d35476e8d4b6580e254631650

Download Submit
C:\Program Files\ESET\ESET Security\Modules\em006_64\1237\em006_64.dll
Filesize
253KB

MD5
26c3f49161c7788c4634bf20a90fd199

SHA1
4b3d31c2d1120e7a6763fa791e49e21d727944d6

SHA256
08121b0374ffe76455c2ee9c6780478d75e9a1ccd789b5467549aed01fd369aa

SHA512
8a3a69988761581b788fd0269490049ec68f7f5e5ca35316bc40187eaa9e0d93b41878d64c586b53ce30c6eeae3f9a60a28fcb016f38ec55de812e6b42cf1727

Download Submit
C:\Program Files\ESET\ESET Security\Modules\em017_64\2031\em017_64.dll
Filesize
15.3MB

MD5
5ad584a51434a1d5f8e0d9e27625852c

SHA1
409d8a402dc8eebdd1e68bcef77afb152cadf90f

SHA256
342e29c8012390a12efc044d18abbf1fbefddd73b4d0d5307bc0f992062513cc

SHA512
7da55962fa8be50dcb625792393d81a78656a75e373c0d100b9a9e33e04b764fa4e52cfcaa706fd64234ac19edb570202b6c28d04ace83c03ded3ca6a0076e06

Download Submit
C:\Program Files\ESET\ESET Security\Modules\em024_64\1138\em024_64.dll
Filesize
2.2MB

MD5
1ed3fcbd5a1a22ce6e3aa3f520e135b3

SHA1
0a5f1bfc03a03954244d43322c5674a9237e1751

SHA256
c7add46fedf42ae2a0564af90504c5fff11ea3595cdd59c68d7194398241fbb8

SHA512
f8ac32a9ac650442cd6d5661778996af16e5ac6b71dcbbeb3960e0b3aae01465811d89ef005dae0cb1128606087ec9feac7e86ee478d3a4a7d52a9804fbc890b

Download Submit
C:\Program Files\ESET\ESET Security\Modules\em039_64\1902\em039_64.dll
Filesize
7.0MB

MD5
4c42a3f978f266b4ec91bdeeebc3e63d

SHA1
875dbf6f583d5cc8e9bd8c43bb08ea2527fc6c44

SHA256
5fba44fa6eda0e2fd05149acea11e0d422aa0f8198e6bfa50dfd23ea985f1221

SHA512
960d3ec42371217ed7a3c424a162acbeda2e0f0744930380b4a6e21e4b52baf7841187b70b10059514ddbcdb3a4b4e28e9b4fee67fde29cbf6265dd5d7e8bda5

Download Submit
C:\Program Files\ESET\ESET Security\Modules\em045_64\1073\em045_64.dll
Filesize
2.8MB

MD5
f9d068eef6b55e55fd778f8a8909ccdf

SHA1
fc02df7320b8762b5d0ff1ffd65f25bf995e2775

SHA256
a47ba4859de9336133e6dab941900fee96fca96abc08de6be157b4d578b073e8

SHA512
1050c986118fa5a4f53cde0f0f3675f461204708cc406aceee02a8b9a7405abf7eafc517e8a7e205e5caffa41cff8d2b511c82c57f4edb7ba2ff144a46d4da03

Download Submit
C:\Program Files\ESET\ESET Security\eula.cab
Filesize
926KB

MD5
c67405c72c3e55f37eb98bcddf2a5f08

SHA1
13000aa939e609c8e37d5aad98d555b2fefa12ee

SHA256
47307aeeacacbcf68880db83d288e33528bdafe67359aafb665d28add58a82b0

SHA512
546fa28987f2629863bd0fc6fd7e69e204959ac457abe18584fd43109251c5c8c732e355949f8633f7d70de0fc65a3ce76cc7a5c17f6d63c7d6fcd29a6c6b8f2

Download Submit
C:\Program Files\ESET\ESET Security\updater.dll
Filesize
1.5MB

MD5
b611e274aa2e063b0f3df5059cdeeb87

SHA1
640f4851fd39421e7e7b21628ab94c1646004cb2

SHA256
bbff73ff3ae76326da6563c07526201c5d11f1b0ab99140cbfee62bfc6b9345b

SHA512
c0783bd2a53f9a8cc5c102bf473e9b442d07a860998b7446a14999e6badceb8834582248ac689b3c5f2f92aa87ad6a04e3acf9648e4602d7f84ceefb3d9b2d5b

Download Submit
C:\ProgramData\ESET\ESET Security\PKI\ctl\c864cbd7d9663fe5838a7cf099d504a9c2f1e749.stl
Filesize
3KB

MD5
b091959e805c22980eaaef6714643a37

SHA1
37c6932ec07a5747ad197b0741ada2b2ad6ed97a

SHA256
b2423245e639a3db7638d99cbcf0d23a1ef93d46adfeafda4811abeac83c6567

SHA512
a9f8cdd031a34a0ecf6a78a7cb614546e28c1f228055f52e6a341763428a72fb49ec4bec9512b00a96b5d4fdb0c4efe113bd93605a36b947f3d82ada87fba052

Download Submit
C:\ProgramData\ESET\ESET Security\UpdFiles\em000_64_l0_.dll.nup
Filesize
203KB

MD5
6d2a0f7089c5676956fcabaa3565d5ef

SHA1
335ac68e8b7c1a14c183cbb4ffa608ee754bee3b

SHA256
96227812166e80571218d65ebb02bf104d42cc33dc8b8c96c213f2472ea32139

SHA512
dd5aa5850d3eaf9f6bd8742f5c93eff2f77d57f10725a3cacbb342048a2e352b53af325a1ee8cd3f7cec03c39ba8361a4ba86024d94d371f148fb61928a3ed2e

Download Submit
C:\ProgramData\ESET\ESET Security\UpdFiles\em000k_64_l0_.dll.nup
Filesize
60KB

MD5
0bb0344dda4455f0ee88359ad0dd542c

SHA1
2fae2bffa18cc74d9b5d7a0738028b099ac6522a

SHA256
9caae628586f800c9cccb8ac034036a122e8306560c866dbcd1e541a9db9f841

SHA512
e572b364e153899c3a3ddbe2d3e0f341aa59313d4bb64e23cf80e03c733d8eb1b2b97329656936d3f9dda586f52cd8c2c4145836408f461edeb1fb8a36d75f6d

Download Submit
C:\ProgramData\ESET\ESET Security\UpdFiles\em006_64_l0_.dll.nup
Filesize
126KB

MD5
a665fc1518d21c62014311d5e64cc6ee

SHA1
2a973c3c9021dad9da8bd230ecb50a3ad371b8a9

SHA256
c3d36407a1b6290de5c9b1c7b5b242b39ceba54c87550df0216022cb439de4f1

SHA512
36973e9c86dcb87372a6a794d3d9214274361f6116b65247ec5f6d948a8ef131561548a038e094ca488f1ef485a0771867ffc359999db3b1731d700466c03d38

Download Submit
C:\ProgramData\ESET\ESET Security\UpdFiles\em017_64_l0_.dll.nup
Filesize
6.5MB

MD5
137eed0114c07de242353e588e628be5

SHA1
4d232e445591a67b54089faa18bc7f6e3ebfea73

SHA256
62b4e00e26a462dcb65138c0f7d46ed3b199c1006a29c1e82946cd5f350dc55e

SHA512
088c537e2e598b5152c43c7f8dfa325eedc93c87f8af87c75dba5f424b02061c46dd63a7d06e844a9559932dd208c61087485e90901997deecd8b23f95368ad2

Download Submit
C:\ProgramData\ESET\ESET Security\Updfiles\upd.ver
Filesize
256KB

MD5
f9fa91f06ff3944b0456634c0c7acd9f

SHA1
5caad5d94957a0bb774aeafe29a31609fa55cc92

SHA256
24eded6474c3b09eb8c7cb8068a36e17160fb3adc834f45b771ef505920fc102

SHA512
29c1c451fcea2e36925bb9d4a8e85ce1213003e02ab72cb061116285a67292fccce3d76fe334eab503b0b9ace5524b797bd32b0ddc83ff273ebc84fc7bca8d5e

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET\ESET Security\ESET Security.lnk
Filesize
2KB

MD5
26a542c7650e25b7c72aa20131af98b8

SHA1
b3f6153500dc823550ec09466f1301e911b56254

SHA256
35625faaa3e58753e84c561c8a612dea9fbdf1de835b74b184681789f3c1f4c2

SHA512
9d57b7bd2333d1151a68bcce9d2b1d8b2c0c1b3ee2b3e21b33a4b5e1e4c3ca9cb93447f8bfff89666b2ca59e816ae51bd026ae15a8b14b409f73bcb92c2b6332

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET\ESET Security\ESET Security.lnk~RFe59930f.TMP
Filesize
2KB

MD5
1b70c739908f79deb4559f69e87d6fd5

SHA1
0716f3e95ee2905284a26ffa295d7b866909b297

SHA256
fce7c38bca245e6e1be83c7842a4bbc2e41459c0ade4301969bf40f4db8b6b72

SHA512
5868cec3b79c6371befdb6c905a3a9407fff420b8576835abb775bd39dc3f4c88ea72078d988446eaec9cd022f252967c8ca2376eadfdd703d7b57fb0ee0338f

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET\ESET Security\ESET SysInspector.lnk
Filesize
1KB

MD5
e5715472eca871bc54dc741d85d8978f

SHA1
ece576d46e3c5e77b56399c5e9e962e75fd37e83

SHA256
ffe8f0f26a51f80c32c2f0dc82fee437d3c347ed7640ae36a8dd6df4207e55c6

SHA512
0abcacc6e32b28ab35a7eb5b3caa29507d385a36febfc8dace5a943ea003f68008a973b9e625ba85fc31f588659ca5d8fd02853bf9a2f99f4942a4702bfa1610

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET\ESET Security\ESET SysInspector.lnk
Filesize
1KB

MD5
4c46317d5fc77d6b6e25034260e14ae1

SHA1
70604fdbeae320df65c12f2f34f59b470d135832

SHA256
d038ee0937b71d3f7c2ec022a5238f9068ed81d36cba96d2828129b85e897dcc

SHA512
92713d041c8d94ea248581c455a7ed13e5c7e040316c9d41ca6451632257741c8c9d5491216250cb5b5626169f81115198ee7d9e105c9ded13fdfb897b58a4ed

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET\ESET Security\ESET SysInspector.lnk
Filesize
1KB

MD5
b9007fe82cd8c23a19691f46d8be0712

SHA1
9c00045916212a00192f1839322ee7809b428cad

SHA256
8ae2f36eb39dbfcdaa8cc5bb6d77bc4b883f938ee29602b505d6c08f87000a6e

SHA512
210aeeecd7826f77bcdf1f69c5d4d7a7c72e6e46de59a92766c790a84d71a7785a9a6fa49377710ba03f7605dac8453fe6e2fb6100d90c7af780eac4d9cbd92e

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET\ESET Security\ESET SysInspector.lnk~RFe5993ba.TMP
Filesize
1KB

MD5
16298ce947762a07211a786550b6ef05

SHA1
8bda5be27901754f508ef746bd267fbe26b362e5

SHA256
1aa534fe95dc4e13d44b6fb05ec3be2b9a564769a554f58a12ac55c125de2c73

SHA512
1619725e0042cc125a4d19fe7dba4eaf15b6f1e2d2ca7044c14e94e9e4d9fcf4961f5fbb53f5ca41baacfbd67bf5a54fe02a09881405402f389603ef49e00e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7c63e.LOG
Filesize
2KB

MD5
0bd5f7be60584d54b937b855aa4373ea

SHA1
0ea63d3d8eb8d9142bde1a2c132985b4aaf48c16

SHA256
856379a78052b8dab7c432cce6bce85890d14f1fdce1ef511eaf6bccd1b865b6

SHA512
cf55179dcf5819dfdd242e9a97034eb9e20a2f78c60255cd355c322c4e0d4d1b12a186e703f96b5ebfc86ab1677dadd23580762a61a1346560511bc21c91c3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSFA251.tmp
Filesize
240B

MD5
94f5556147fc26ce43601ce008252947

SHA1
9d2696c2d8d1a8b06bc297b196bb6217e9bf77e6

SHA256
a69e5f7ce224d46fefe1bd6b07546029c2b08c4e7d66cfea0c495ffc7b00ac14

SHA512
c04414a3ff8585e27956c88bfa8317b0a10c15f71a7feb4e7d443864318f74317c4e1a468005d82c7113a739320510a23c8cb0ccf14b929d39bc27b63c04cbbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSFA2A1.tmp
Filesize
242B

MD5
49b6a9939d8e93cd50e559a64ed32c6d

SHA1
254c52b68b19f5f92d34f8a9eeb1ab6e38417612

SHA256
ce360c831c6ce3db2a77af66f1c262285aa8ab723d21283f40e0b510e5a263a8

SHA512
ec1380753621de10d63c343dcbb0b8fa2acb8e0f863760f450dded692ae9d08b3aade780522a57c55710c006064123093b6cf2fa8591279a9797107d1c55454e

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSFA37E.tmp
Filesize
224B

MD5
2c7e1fcab74f2a6f026131078bd4c91c

SHA1
bdd7ad4fcb3e2f44dc33ce50d3474169dd257dd6

SHA256
3993708208c2b2f89c51a60c5b76dd80e0b9d83ddb9538b282da2a93e129c30d

SHA512
d5ba6db8d79e815043492d9cb34cd4b97b78af41de0772109b83fc1c2defd7239c57487df5e97f99892d7024872838c0dc8df9eade4f22915b449b0cef379c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSFA380.tmp
Filesize
218B

MD5
0513f72c8a90c38a5caa96902296f00f

SHA1
6f74ee7796c7ddb83df5beba9b86cde1db758903

SHA256
dbc8ba293164535cadd0e9c6a0a68f53d6c1def014203292b1695c7723dd9e06

SHA512
6ffc4c815d1a66a9d58040bdfa58389f49e776d66e266f902146390443f20ec22a59478d0a788e36a22233102ffddbf46d1131ee07001787ec7d3119c2bea4bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSFA382.tmp
Filesize
218B

MD5
e016ef27bcdde5d7191b59344e975282

SHA1
7c7ea7497d736ea5738527ced1598cd483ac5402

SHA256
c86868e5843615e2843dad8a86cd9312921f9431da3dcfd0da0c4bc2d22bf0b1

SHA512
cef2dfc1aeaa78c073c0d252ac3fbd13df9bb6038e0cc579ab37e3e1d70ea948fa987f0bbebe328ba41134a1ece08ca2c020c17103953f1144daeafba6cf3597

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSFA3D5.tmp
Filesize
234B

MD5
672e2d0429bf9d0a938822b810838d69

SHA1
46c20ce40109eefefab025e1eaba9c7d16095cc4

SHA256
53bb37ea2ec43cf7e35c356a293fd4f6f28e76a29f46b64ac6d760d870083994

SHA512
27316fd107233391f42922b76780c7328990832ad309bc8ac383c55961ba461b9bf6f427537cae481bc48e508b9b6c245de586d4654e0da1d001c0ecfcc47993

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSFA425.tmp
Filesize
226B

MD5
cf4dd75d7bbf1aed05888c5c677cd436

SHA1
3810c6174337d0d5623d7007d603946a24e0da72

SHA256
5daf3981d013505bcf271c58446614c16b9bdc0f701dd1ffc8e3b3afcaaa7f2b

SHA512
0e2d6f55de2c177f41f0bf29f256a3067b316d671ed85a7c6d24756bdc203668fed90058e146df40d87cc2bc4010a49179a688b7ffb3e939c542f90995fad3bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSFA427.tmp
Filesize
224B

MD5
e80628afa51b3c8af1372c99c34b9feb

SHA1
0d9663c19658e56bade95b9ccdedf0a3577a0dde

SHA256
863c549d1d3e81d54f360bbbdbfa9fa989dc9c3877a8f647be7acf2683e14287

SHA512
9cef42b25c04f258fd65eb386e2eeec761feb6251433d9eac3d58e6ebb95b61e799a7c43a7576c68679284cd810723ec0256b3c37277aa27e49982e9bdc0edfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSFA601.tmp
Filesize
232B

MD5
1e41b2744c4a8390eb2df0742922d5d0

SHA1
78382c540ada4f1d5178e05379f6f8324f99a070

SHA256
5f357213eba26280f735f323ce258814c6f1dd2f063937084ef6d659492ad13e

SHA512
9ad7d0a138b15bb01988c6d7cd0730f4de5f48d4683d7dc7ded0516bae12b4c105a4b7fce719f22296f92aa288736eaaa9c9eee3567d08f837f0721200455650

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSFA603.tmp
Filesize
226B

MD5
cb8191b547a73e24f7f1c61ed221e488

SHA1
0c6e798ba897add17005d6428794ab453b9663b0

SHA256
9f450af6d8616d3fa52f2b07084464d439a0814138b762a435fe47c4f23557df

SHA512
d7b04a710c0c74d57b47b17518ad38c4f78fc644e7b16383f15356930f380ed2c40db86663b7663ff1d51953eb7aa6aa8786c89a43187d6fc7b9f395e6525976

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSFA605.tmp
Filesize
228B

MD5
57a328103bfa80fd36ee0f702daebba0

SHA1
6eaa2c13931963498b7fef6eda49cdc99a3750b7

SHA256
73f32bfa966e9cf3dd576c7bae905a0ccc11c9ebd2cb57a6c3383331dc5080d6

SHA512
43fd11a0e6c169811c85936d360ed70493a4b62bde956720bdbd92066e8e4695d6fc2ee9c43af8265f26362f6b27e8d2932673c34b2eac931e9205f73b945ac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSFA677.tmp
Filesize
263B

MD5
0fcdddefcd3de6ebbb5785aa724003d9

SHA1
2f785b5dae97ecfb4ea78e8f012c8e57044a631c

SHA256
b64b3e582532d1368078c4a0beef52ebeda3dabc8c9b9e97f7d80955fa50ad1b

SHA512
dc767a26503baf30512083f70d45d4fb385263b1c9208fde103fe7ef65d4f3a5d7ae64c0bbb22ee396b4bb7db8cf896470e7f0cd1d7905e3d722d929447964b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\NSFA997.tmp
Filesize
227B

MD5
2d1621c37d3c70520a70849ea73a038c

SHA1
37a45a8e974bef2ad913d727cc4375206a5b6a53

SHA256
303d5a306445d86889980bedaea99edd04488b343775d1850f12947dcf78f3a3

SHA512
17d315b7948500f6718171fc2a72265ffc1ba849e5e0a85ecd9e45d1192fec5d7a1ce61f77cfc8d53d7e3d75971e5ff1f2f6e87070f5708c18400b0e3be85374

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.URL
Filesize
154B

MD5
6982a383faed6398d98ed4501b074a68

SHA1
893add981f1c868942826bfe255be9f7b0f08dac

SHA256
80aed49f06685faa934cd2973af79e8a0a01fc51a091f7e7c9acf83a7b09e734

SHA512
d592ba93db5e5d1395bfa9ffa3aa348d3e05c2e1d20c7bd44bbfdcd58bbc59906589f22ae81b8d8d9149f56c1e3b25650de252f1227a2800ffbbc795cb9cd3e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ehs_nt64.msi
Filesize
49.6MB

MD5
eee610bf8426669b29c45cb1486a1d2a

SHA1
4e52fd753e92981ec55e275e097a10724e5a8998

SHA256
0249f023755d94430a31854764349fe2a37f9672279bc8d2bd3a87d699d96c3b

SHA512
bfac33a1746770757accebdd0e304599c789ef573e4b776046076f166b2018ad47fce3451d8f7ebdc2176ecea68f299d563a1e618051f57701ef3877e05dc3b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\_InstData.xml
Filesize
15KB

MD5
14257d6db038b5ef84407617cf367fca

SHA1
2406a528a06ca3b40b397740a634a84f49ebf516

SHA256
f060be2a92834928321ab981d2f1e76506e45a53ce2fe8619b34dbf1f88a3db3

SHA512
72f0155b6ebe3014476f49b5d491f9d258c9d5129e30ccb85b67b934c488e445260c6aedd7a5485a7dbeba40e27c94ee24a996ca9bd301dec15ee19d8f757d23

Download Submit
C:\Windows\Installer\MSI6623.tmp
Filesize
1.0MB

MD5
a6b194bd0c4d8b9c59876267e67c0717

SHA1
12f92700f7fa9f907c8a1743c1fa96e3940ddf14

SHA256
305e89a89c6bda9c5b6d535ad3f659e78949e31605fc7430225f724c9621498b

SHA512
fb062816c5dcd7651178924850db00ba09924e3eb53c60c786e219d2c7e112d248fc826257b62f9e02cab6b38244424e697f3a148005631853ddbbb17489e512

Download Submit
C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\eamonm.cat
Filesize
11KB

MD5
8007d7a61c55f396e25a64abe1e55893

SHA1
b41a731ec92a0df1494b0db1cf5dc8991627f53f

SHA256
03efba211320204f3668fbce836c5e4c433309136dcef629abf799f845ebd7fa

SHA512
fb28e826558c4fde11773bffc641440c1d33a37a70685a60a9eff14224b1ab463e04ca16c99058f59b447de7d73df5f7a5e3c7adb48eac7670f04d633db5d55c

Download Submit
C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\eamonm.inf
Filesize
2KB

MD5
9b419d23c933d7111eac0fe878c5ea3d

SHA1
1d6924fa6e471130aaabc6d8aaaa37520a098c81

SHA256
6b0e0b936a7118e1a2aafe433ff72c049e2a0ddfd1553e250317f6aae20420a9

SHA512
cc1b2f47a35dce8fecfc38acdef61217069febcf053e1fef83ea7340177d57c2635170334bd5583fc32c1ee7041c353789f2e39f91f821938ad6b172cae6568c

Download Submit
C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\eamonm.sys
Filesize
188KB

MD5
1bb51cf9a323bfee00a1446f59159edf

SHA1
5f89bb73c2af4d21be3b28d3f509a4de153f0911

SHA256
85ff1a6413eb15e10cb27b1ca07286589318338537dadc46f7568b218a84f1d3

SHA512
ebbaff2c79e92f55b3a514aab084f0d8ff1a3c9f445ea790bc059ef2b92394ac47ade436aff5461102579d837d0d7df62cc7fccc47800174e90f67f7e6598f0f

Download Submit
C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\epfw.cat
Filesize
11KB

MD5
422a98fe231881334aad44254f28c29b

SHA1
bd8019f2a2122722fb0721e164786b551961346f

SHA256
88106ca17e1c7992e1347df35de0dccb3e46f1d695aaf8004ba40098d30272f3

SHA512
faea801378e6deaae5b72ab86ef8dede3bf186d2ff0fc48df17e5b6c31184a32cb3987bf19edbc25d2967c24a94c94b69670042570b995dc8ea1c88c5c94ba53

Download Submit
C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\epfw.inf
Filesize
1KB

MD5
7463843636ea9e4b29e55c54e0593f84

SHA1
7b9765fcf58f28cdd60d4903b22345c89b9e7b90

SHA256
3b65077080a82006658e995f6b1909fa01f4ed40fabae546aeb40e40885d163d

SHA512
f0ced6cb49813e391c22b31cc3cca20519bc31cc8eba9764ec7ca54c72640df1a0799843675e912a8ff39976a25348800a735d23f8fae8f9782d8fdc7e29baae

Download Submit
C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\epfw.sys
Filesize
77KB

MD5
1313f527ba97793ed9747d9dbfedf1b3

SHA1
7bf08a572712deefcd09a8933bfaf5bb2066e86d

SHA256
d4dcdc668906fd9a93aad1af93f7bb2602855dfadd13cf1d5a5753a0e13e55f2

SHA512
ecb9ca1db1ed19a7d29028ff83b0b6654dc7231447cc386f7d02a49c540d7f0a9956a41d6b17b0c8e21989e15aa2d951c001b1e2d9813affde5f64ee93152949

Download Submit
C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\edevmon.cat
Filesize
11KB

MD5
5dc9aa7bcb0e77d5057d1e7aa28c01bc

SHA1
28dda2d179cc670910ea24c1eef2ca3a11fc45c0

SHA256
2bfd4bccae9f7457b65985dd7a1a0fd90ee6e8c1b66e97cffa32d9bb09b38daa

SHA512
65a9f83cb7cb231da9e1aef69c2731ed53ad85e94ac7368a041e45d9ab1c06f5934494857024e229f214556179f3767e114cc0ffcd78cdb90c2d84aa15c10529

Download Submit
C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\edevmon.inf
Filesize
5KB

MD5
0118a06511577f484647ea9b5c46785e

SHA1
d85f3406b9ec398a7a32be208f9811e2777b12ae

SHA256
8aab4d7356c3a8ce23878c1794bd197b2b1a199cc5b518d338bef46bd61a1f16

SHA512
b54097301aac1025ec0a3942edc76bcd741a6c376417fb870fcfb70cd6be2c30ee27d8518683397b8a27fa20dcdbd00d48f7c94b8508ebd208ae32c62fba4adf

Download Submit
C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\edevmon.sys
Filesize
114KB

MD5
37c27022bda1ebe1a3cf3c77f40d1430

SHA1
eb929169b792e2a4291592f26e526e182245533d

SHA256
ea11e114116aa7b425ccabc5b3822f15150e23e4c5925877f0dcda57737f4f64

SHA512
2f20f037f5b4d776adcd5e1d23d1281d754cf1862341bb0014f172915decad08a558369e320d0af8a93c18c254cb46464fe75a2af7634528ad8bf61020cfbed7

Download Submit
C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\ekbdflt.cat
Filesize
11KB

MD5
ca138f7c4043fcd6eeb57a52c77f6320

SHA1
9269bd6843f0834063c2f989473ed63cf7461b2d

SHA256
4af9ed2d2e9470a7323196fa005364953511b0f7f3ada89bc02a99a0e4528d5f

SHA512
b60fc31c44ae565bcb73328c7fa0a99aacbbc2a57a5d95622a387cd6f6f7159e9ab569a3a491c5dbc60f699a8964073923045044fad8ba09ac1072f1bb14b3ab

Download Submit
C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\ekbdflt.inf
Filesize
1KB

MD5
49881c94c0d32c687430491e484906d6

SHA1
db70de2a97de9055d5f661068d01a1616e041f6e

SHA256
122f3e38b66ee1a37cdf8c791267db0ac8becd3c8ebeb9dfe8890d336bc79222

SHA512
2aeb41ed7be46e74342ce9549a16b9ce5129a3cc04a0eb35226dbefcc89518496dadbe0639f488f7c93a0a108eba08d87e98e44d93d58c5bd7baf1a32bc612f0

Download Submit
C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\ekbdflt.sys
Filesize
51KB

MD5
6ff5e0db82fbd22533c3cef1f3a72040

SHA1
a993b654554b747311d8f2c5fc16569cf1a8bd8e

SHA256
e2879a3e38f0b9b872df036f836629b0c6d6e29cd32ad4bff85741676cd1179e

SHA512
95012aa36f892dd1815f35e2b798bfe0a85bcf6acdaf38b105591b5eb079189a509fa1c2c0400cae764cd6d5486353e300ead6edbb59dff5ccc648237ac4d6d3

Download Submit
C:\Windows\System32\DriverStore\Temp\{c74d3266-a6c9-4245-bce7-a0082a5af877}\epfwwfp.cat
Filesize
11KB

MD5
459fe8917412b86a056ede871326761f

SHA1
9325a2542971d03e6bbf127185026d148dcb8fdc

SHA256
19fd9d5fe4d9fe9accea9c3039037182a49f05c0eb6234198f010a806b7ef7d9

SHA512
0dcc620ac3cc8a397e48fcb63317794ed572222092ebdef1101c49bb0eb83e366bbd8318bdc967e8777c7e68da5dd9266acd3613f4b0bee89d80d1ee4605e386

Download Submit
C:\Windows\System32\DriverStore\Temp\{c74d3266-a6c9-4245-bce7-a0082a5af877}\epfwwfp.inf
Filesize
1KB

MD5
6183a9913676f531c8349d165e99f7d7

SHA1
15556c160d22b052455e468872fe6236f1aa2cff

SHA256
00f9acecf03f23cbe7d97425f35dac0cbc1dd17d30a249cbf701f364200ba3a8

SHA512
dcce083c627f193ef108abf729b4106b496ded9b1c23024e9d1d8e5baa6f327c701bb1377143ef648f651acf747ce5d69f523dd0a69711850bf31372ef79e25c

Download Submit
C:\Windows\System32\DriverStore\Temp\{c74d3266-a6c9-4245-bce7-a0082a5af877}\epfwwfp.sys
Filesize
116KB

MD5
c9552fb3edd9740f9e30b16504a6374e

SHA1
4a0d01224855b98be44044c2a7d8f87c6d58d5f9

SHA256
1f813c620949dc2fc50f5870899887bc4df75496910ad85adf4f047d8b9aefee

SHA512
e29caeb92a1db49c1689afecf710cbd9d10cd6b1b44b9eeac8d46d3bed7fbb64d7f68e8dc88f66d970ccbac74093f9553f913b493695d7bd5636d1475f79637f

Download Submit
C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\ehdrv.cat
Filesize
11KB

MD5
c0bdffa371ddee4700e5f7bbd2070da8

SHA1
a97e6f3f29187e1d95fe61d6dac9179d0b4f7650

SHA256
b7b35bd0719873386b3320f0ab46ac051872af9fa9834cacec5707daa6fa1a17

SHA512
6c35becd3a2db23f7e83a77356e17582b4b23abaf3073ea31b0a796546184302a672e64fb6bed4dc2f53fe7512d88c7ec2c9c454937ec968a211f1806038ceb1

Download Submit
C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\ehdrv.inf
Filesize
1KB

MD5
3de6e5316c062932be5517590f83edb9

SHA1
b62ee86512b4f57915a4002a44fccfe89fb77691

SHA256
e788d121155124e8dd5c81eb9603f6aa8c78a8cf4b757a2b8b87d59945f9d296

SHA512
7297da48dfd354bf49f8fc8762426ba346ac97d71ea5ad7c8ed05f1449ed2f49afcaf95698cd443da6a4b19ba85fc4dac5acab63a5a625f1121bc2175fb23e04

Download Submit
C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\ehdrv.sys
Filesize
228KB

MD5
0454eb36de77c7c7f12d92fa0c184a3a

SHA1
07eddf2db51f3477219a193cd94d09af1deb9c99

SHA256
7619f1c7b91720c44d0cc8d23e30cd20e7d91ac8e5cb0514de78f1a2db99fc06

SHA512
fb7fb55676480b87696d3a50487a3f0f69b88dadd13c9ea84e8d1b1530120285322c8519845172f3d4ec15ad9b23e48dab72bfaa585995289c84c5d5a60a7fa5

Download Submit
C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\eelam.cat
Filesize
11KB

MD5
11d905d5f5782b5e15b0fa70f613b862

SHA1
2fd16cb9ae82246c682fb8d6506a05a6df3364ee

SHA256
339d3b56db804fb5c6312f27c58d4e102dff527e8ba414586f116f7033eeaa20

SHA512
bacbee932783db40bc75eb60673f6220506d80d1c14e8bd207d4da5adfdac70d4839ef209cae803ea8f38d4a448851f583a45c5af919b32790b155eeae63fec0

Download Submit
C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\eelam.inf
Filesize
1KB

MD5
a7d5c0c73d05acdffa664557874e7008

SHA1
3a98033c84a31e593ca4f27723dd70774c2674d0

SHA256
17af5930daa149addf4f3092516ca1cc9af8018a792de967193b391e99516a8d

SHA512
ca91643f28dca94cb25cc3af688f224139cedd0276c5b764b9c81b228854b8b7dc8a4ba87682681b020d93eb0d38e929bb0b247fab68bf88a16604048d9cfb62

Download Submit
C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\eelam.sys
Filesize
15KB

MD5
6482645cefe3e5237d154470e3e66ca7

SHA1
8048b5607ffbaee37e0a7b94091a2457181cda81

SHA256
56af45ea19ea3aaf91121cae00748f533041bf4071949d270be530568a0e9c45

SHA512
2b42a3e1ed6918d6a0a98739349cfc92596fb4f00c8acd901e57a3759cfa9e8da07da19386b6060af90bccb0e69df57e1e64fe0e310f6168f17dbf6e8e97da2e

Download Submit
C:\Windows\System32\catroot2\dberr.txt
Filesize
19KB

MD5
df6b69ec4ff2cab33c0de55f9449452a

SHA1
2d906f040d0d3107280507ee83e98cd3982bda17

SHA256
fa159ad0aa396cb6ca62e83b41ebaac68df3a8bf74b5fe0769f0362d69df1ecf

SHA512
816f1463a8360290dbd14f01d00b9dd21176d62bebdd626d91b3b83684bef1849057c0612da10390d0c9625143cdc68e0e3d72751e680dca89ce9f6ad927def0

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
23.7MB

MD5
6316008d9cf1b58461ec35dc3b46c1b8

SHA1
011171610c37ca91d900edaa0447caa54a109245

SHA256
3c46a1be4161b966fc9366aae1def370c5044574ec9f38fa0e8379ae9678fb61

SHA512
e11b3af10a92327bb6cf251c0f96752d316acffdc903cd2c0ba815139abedebc3ad80d0f19a73dcc7f9e6e435825f582a661fc6f8a151b01504db4b95a2e3918

Download Submit
\??\Volume{d2bbef64-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f7c3f59a-d0fe-4fea-947a-2e8ec3e7c2e4}_OnDiskSnapshotProp
Filesize
6KB

MD5
d1cad18174d01c1a615c7d6604f7ecef

SHA1
145bcde6689da2739738f29f7da937554c639810

SHA256
1a2d46913dbcce977a12684a7f64db78266d80abaf55210d1fc6681292cc794a

SHA512
f2ddafaf90a410cd1187c5f855732e4f77d2fc1b6845bfb87c03837d53def000db449c5abb58925f2efed714dee629f1d07cd26ab6652a41de47000c480cc573

Download Submit
memory/708-716-0x00007FF6889C0000-0x00007FF688A7E000-memory.dmp

Filesize
760KB

Download
memory/1248-1181-0x00007FF6889C0000-0x00007FF688A7E000-memory.dmp

Filesize
760KB

Download