Analysis
-
max time kernel
143s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 07:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe
-
Size
38.2MB
-
MD5
0d6f1a17bc5c87c304d2ba6ff25801e9
-
SHA1
69754bff37cf31ed4912a3a58c535ee3ac69d696
-
SHA256
aeb232d84afc6c6d95ea92940cee4c7707126b8204b95d6707f75a1eeec8a217
-
SHA512
78b7c4f149152e5bd15907b49a3fe392ddfb5b7af0a847357ca13db264eb204a5148e2ffb2d501dc38161a2bdb80f6c586fd0d027a1638dfb71d0a13aa69235e
-
SSDEEP
786432:l7YfqVD/drU8AkFI4ecXUEZBKRj06pysShPULwI6Kgvn:efmD/dA9kFnzUEXKRjFkJhUc
Malware Config
Signatures
-
Drops file in Drivers directory 21 IoCs
Processes:
ekrn.exedescription ioc process File created C:\Windows\system32\DRIVERS\SETBA7C.tmp ekrn.exe File opened for modification C:\Windows\system32\DRIVERS\SETC483.tmp ekrn.exe File opened for modification C:\Windows\system32\DRIVERS\eamonm.sys ekrn.exe File opened for modification C:\Windows\system32\DRIVERS\SETD1A4.tmp ekrn.exe File opened for modification C:\Windows\system32\DRIVERS\SETD31C.tmp ekrn.exe File opened for modification C:\Windows\system32\DRIVERS\eelam.sys ekrn.exe File opened for modification C:\Windows\system32\DRIVERS\SETC463.tmp ekrn.exe File created C:\Windows\system32\DRIVERS\SETC483.tmp ekrn.exe File opened for modification C:\Windows\system32\DRIVERS\edevmon.sys ekrn.exe File created C:\Windows\system32\DRIVERS\SETD31C.tmp ekrn.exe File opened for modification C:\Windows\system32\DRIVERS\SETBA7C.tmp ekrn.exe File created C:\Windows\system32\DRIVERS\SETBD1E.tmp ekrn.exe File created C:\Windows\system32\DRIVERS\SETC463.tmp ekrn.exe File opened for modification C:\Windows\system32\DRIVERS\ekbdflt.sys ekrn.exe File created C:\Windows\system32\DRIVERS\SETD174.tmp ekrn.exe File created C:\Windows\system32\DRIVERS\SETD1A4.tmp ekrn.exe File opened for modification C:\Windows\system32\DRIVERS\SETBD1E.tmp ekrn.exe File opened for modification C:\Windows\system32\DRIVERS\ehdrv.sys ekrn.exe File opened for modification C:\Windows\system32\DRIVERS\SETD174.tmp ekrn.exe File opened for modification C:\Windows\system32\DRIVERS\epfwwfp.sys ekrn.exe File opened for modification C:\Windows\system32\DRIVERS\epfw.sys ekrn.exe -
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
MsiExec.exemsiexec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe\MitigationOptions = "16777216" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe msiexec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe MsiExec.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe -
Executes dropped EXE 6 IoCs
Processes:
InstHelper.exeekrn.exeInstHelper.exeInstHelper.exeeguiproxy.exeegui.exepid process 708 InstHelper.exe 4952 ekrn.exe 1248 InstHelper.exe 5392 InstHelper.exe 5512 eguiproxy.exe 5584 egui.exe -
Loads dropped DLL 64 IoCs
Processes:
MsiExec.exeMsiExec.exeInstHelper.exeekrn.exepid process 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 4612 MsiExec.exe 708 InstHelper.exe 708 InstHelper.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe 4952 ekrn.exe -
Modifies system executable filetype association 2 TTPs 3 IoCs
Processes:
MsiExec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\Shellex\ContextMenuHandlers MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ESET Security Shell MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ESET Security Shell\ = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" MsiExec.exe -
Registers COM server for autorun 1 TTPs 9 IoCs
Processes:
MsiExec.exeekrn.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32\ = "C:\\Program Files\\ESET\\ESET Security\\shellExt.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\InprocServer32\ThreadingModel = "Both" ekrn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F43F5136-AA90-4005-9368-F91F5C120D69}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F43F5136-AA90-4005-9368-F91F5C120D69}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\InprocServer32 ekrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\InprocServer32\ = "C:\\Program Files\\ESET\\ESET Security\\eamsi.dll" ekrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F43F5136-AA90-4005-9368-F91F5C120D69}\InprocServer32\ = "C:\\Program Files\\ESET\\ESET Security\\eplgOutlook.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32\ThreadingModel = "Apartment" MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\egui = "\"C:\\Program Files\\ESET\\ESET Security\\ecmds.exe\" /run /hide /proxy" msiexec.exe -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 56 1956 msiexec.exe -
Checks for any installed AV software in registry 1 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key opened \REGISTRY\MACHINE\Software\Wow6432Node\ESET\NOD msiexec.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\ESET\NOD msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe -
Drops file in System32 directory 64 IoCs
Processes:
DrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeeguiproxy.exedescription ioc process File opened for modification C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\SETC116.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\eamonm.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ekbdflt.inf_amd64_dc1be21f8701f143\ekbdflt.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\SETBAF9.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\SETC115.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\eelam.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\eelam.inf_amd64_558ab54140135969\eelam.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\SETD1DD.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\SETB3E6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ehdrv.inf_amd64_f9f787db44129b00\ehdrv.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{c74d3266-a6c9-4245-bce7-a0082a5af877}\SETCEC0.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\edevmon.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\SETBAF9.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\SETD1DD.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\SETBAFA.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\SETC104.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\SETBAFA.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{c74d3266-a6c9-4245-bce7-a0082a5af877}\SETCEE1.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\SETCF6C.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\SETB3D5.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\eelam.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\ekbdflt.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\epfw.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\epfw.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\SETC097.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\SETC0A7.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\SETC0A8.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\eamonm.sys DrvInst.exe File created C:\Windows\system32\NOTICE_mod eguiproxy.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\ehdrv.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\SETBB0B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ekbdflt.inf_amd64_dc1be21f8701f143\ekbdflt.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\eamonm.inf_amd64_475748a313af7ed9\eamonm.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\eamonm.inf_amd64_475748a313af7ed9\eamonm.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\edevmon.inf_amd64_c2bb7368195daff0\edevmon.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\epfwwfp.inf_amd64_6841d12cae41b94f\epfwwfp.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\eelam.inf_amd64_558ab54140135969\eelam.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\SETC0A7.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\eamonm.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{c74d3266-a6c9-4245-bce7-a0082a5af877}\epfwwfp.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\SETCF6D.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\SETD1EE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\epfw.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\epfw.inf_amd64_39f5b61dc2f1fc3e\epfw.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\SETBB0B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\SETC097.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ekbdflt.inf_amd64_dc1be21f8701f143\ekbdflt.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\SETC116.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\SETCF6E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\SETCF6D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ehdrv.inf_amd64_f9f787db44129b00\ehdrv.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\SETC0A8.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{c74d3266-a6c9-4245-bce7-a0082a5af877} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\SETD1EE.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\eelam.sys DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe -
Drops file in Program Files directory 64 IoCs
Processes:
MsiExec.exemsiexec.exedescription ioc process File created C:\Program Files\ESET\ESET Security\Help\layout_mobile.css MsiExec.exe File created C:\Program Files\ESET\ESET Security\api-ms-win-crt-conio-l1-1-0.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\callmsi.exe msiexec.exe File created C:\Program Files\ESET\ESET Security\eguiParentalLang.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\ekrnAmonLang.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\ShellExtLang.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\edb.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\eguiDevmon.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\ekrnLicensing.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\eula.rtf MsiExec.exe File created C:\Program Files\ESET\ESET Security\Help\ielte8.css MsiExec.exe File created C:\Program Files\ESET\ESET Security\x86\eplgOutlook.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\eplgMailPluginsLang.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\eplgOutlook.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\msvcp140_1.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\SysInspector.exe msiexec.exe File created C:\Program Files\ESET\ESET Security\eguiHipsLang.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\ekrnHipsLang.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\api-ms-win-core-sysinfo-l1-1-0.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\ekrnScriptMon.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\windowsperformancerecordercontrol.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\eguiProxyLang.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\ekrnMailPluginsLang.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\ekrnCerberusLang.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\Help\no_internet_connection.html MsiExec.exe File created C:\Program Files\ESET\ESET Security\api-ms-win-core-errorhandling-l1-1-0.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\api-ms-win-core-profile-l1-1-0.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\ekrnHips.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\eguiAntitheftLang.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\Help\idh_wizard_activation_type.html MsiExec.exe File created C:\Program Files\ESET\ESET Security\api-ms-win-crt-process-l1-1-0.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\Drivers\eelam\eelam.inf msiexec.exe File created C:\Program Files\ESET\ESET Security\Help\warning.svg MsiExec.exe File created C:\Program Files\ESET\ESET Security\Help\important.svg MsiExec.exe File created C:\Program Files\ESET\ESET Security\api-ms-win-core-file-l2-1-0.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\Drivers\edevmon\edevmon.sys msiexec.exe File created C:\Program Files\ESET\ESET Security\Drivers\epfw\epfw.cat msiexec.exe File created C:\Program Files\ESET\ESET Security\ProtobufLite.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\updater.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\Drivers\eelam\eelam.sys msiexec.exe File created C:\Program Files\ESET\ESET Security\eguiScan.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\SecurityProductInformation.ini msiexec.exe File opened for modification C:\Program Files\ESET\ESET Security\Modules\em039_64\1902\em039_64.dll MsiExec.exe File created C:\Program Files\ESET\ESET Security\eula.cab msiexec.exe File created C:\Program Files\ESET\ESET Security\SysInspectorLang.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\api-ms-win-core-file-l1-1-0.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\Drivers\eelam\eelam.cat msiexec.exe File created C:\Program Files\ESET\ESET Security\ucrtbase.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\ekrnLang.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\Help\help.cab msiexec.exe File created C:\Program Files\ESET\ESET Security\concrt140.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\ecls.exe msiexec.exe File created C:\Program Files\ESET\ESET Security\eguiIPM.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\Drivers\epfwwfp\EpfwWfp.sys msiexec.exe File created C:\Program Files\ESET\ESET Security\api-ms-win-crt-runtime-l1-1-0.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\eguiActivation.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\sciter-x.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\eTpComm.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\Help\example.svg MsiExec.exe File created C:\Program Files\ESET\ESET Security\api-ms-win-crt-filesystem-l1-1-0.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\Drivers\ehdrv\ehdrv.inf msiexec.exe File created C:\Program Files\ESET\ESET Security\ekrnDemeter.dll msiexec.exe File created C:\Program Files\ESET\ESET Security\Drivers\epfwwfp\EpfwWfp.inf msiexec.exe -
Drops file in Windows directory 64 IoCs
Processes:
msiexec.exeDrvInst.exeDrvInst.exeDrvInst.exeekrn.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exesvchost.exedescription ioc process File opened for modification C:\Windows\Installer\MSI7177.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI77A4.tmp msiexec.exe File opened for modification C:\Windows\Installer\{A1B1AC12-A547-4F1D-9000-8E30D7929D04}\Icon_License msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI6AFA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7224.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI74E4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7842.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9EC1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAC6F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIADCA.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI7D15.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI81AD.tmp msiexec.exe File created C:\Windows\Installer\{A1B1AC12-A547-4F1D-9000-8E30D7929D04}\Icon_Uninstall msiexec.exe File opened for modification C:\Windows\ELAMBKUP\SETBA7D.tmp ekrn.exe File created C:\Windows\ELAMBKUP\SETBA7D.tmp ekrn.exe File created C:\Windows\inf\oem6.inf DrvInst.exe File created C:\Windows\INF\oem8.PNF ekrn.exe File created C:\Windows\inf\oem9.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI6D6D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9622.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIADDB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB94E.tmp msiexec.exe File opened for modification C:\Windows\inf\oem4.inf DrvInst.exe File opened for modification C:\Windows\inf\oem9.inf DrvInst.exe File created C:\Windows\INF\oem9.PNF ekrn.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI8100.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9054.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAEAD.tmp msiexec.exe File opened for modification C:\Windows\inf\oem7.inf DrvInst.exe File created C:\Windows\inf\oem8.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI6E1A.tmp msiexec.exe File created C:\Windows\inf\oem7.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSID2C4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6EF6.tmp msiexec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSIB9EC.tmp msiexec.exe File opened for modification C:\Windows\ELAMBKUP\eelam.sys ekrn.exe File opened for modification C:\Windows\inf\oem5.inf DrvInst.exe File created C:\Windows\INF\oem5.PNF ekrn.exe File opened for modification C:\Windows\inf\oem8.inf DrvInst.exe File created C:\Windows\Installer\e595d78.msi msiexec.exe File opened for modification C:\Windows\Installer\{A1B1AC12-A547-4F1D-9000-8E30D7929D04}\Icon_Help msiexec.exe File opened for modification C:\Windows\Installer\MSI9829.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAE8D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB97D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI676C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7FF5.tmp msiexec.exe File created C:\Windows\Installer\{A1B1AC12-A547-4F1D-9000-8E30D7929D04}\Icon_Product msiexec.exe File opened for modification C:\Windows\Installer\MSIAE0C.tmp msiexec.exe File created C:\Windows\Installer\e595d7c.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI6623.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\INF\oem4.PNF ekrn.exe File opened for modification C:\Windows\Installer\MSI6C62.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI97CA.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\INF\oem6.PNF ekrn.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
DrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exevssvc.exeDrvInst.exeDrvInst.exeDrvInst.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1752 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
DrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeMsiExec.exeDrvInst.exeDrvInst.exeInstHelper.exemsiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\ESET\Setup\CAError = "InstSupp!caRestrictDirectoryAccess=1627;CA;CAD=C:\\ProgramData\\ESET\\ESET Security\\Updfiles\\|" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\ESET\ESET Security\CurrentVersion\internal\ProductVersion = 31352e322e3131 InstHelper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\ESET\Setup MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\ESET MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\ESET\ESET Security InstHelper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe -
Modifies registry class 64 IoCs
Processes:
msiexec.exeMsiExec.exeregsvr32.exeekrn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\SourceList\Media\5 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\DeviceMisuse = "_Features" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\SourceList\PackageName = "ehs_nt64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\SourceList\Media\3 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ESET.SysInspector\shell\open\command\ = "\"C:\\Program Files\\ESET\\ESET Security\\SysInspector.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F43F5136-AA90-4005-9368-F91F5C120D69}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Parental = "_Features" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F43F5136-AA90-4005-9368-F91F5C120D69}\InprocServer32\ = "C:\\Program Files\\ESET\\ESET Security\\eplgOutlook.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\Shellex\ContextMenuHandlers MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Antitheft = "_Features" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\InprocServer32\ = "C:\\Program Files\\ESET\\ESET Security\\eamsi.dll" ekrn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\ProgID\ = "Eamsi.EamsiObject.1" ekrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32\ = "C:\\Program Files\\ESET\\ESET Security\\shellExt.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\_Features msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\ProductName = "ESET Security" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\79AA332A50D011E4585D700F695D0537 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\VersionIndependentProgID ekrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Demeter = "_Features" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\79AA332A50D011E4585D700F695D0537\21CA1B1A745AD1F40900E8037D29D940 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F43F5136-AA90-4005-9368-F91F5C120D69}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\Shellex\ContextMenuHandlers MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drives\Shellex\ContextMenuHandlers\ESET Security Shell MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32\ = "C:\\Program Files\\ESET\\ESET Security\\x86\\shellExt.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Antispam = "_Features" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Eamsi.EamsiObject\ = "EamsiObject Class" ekrn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\ProgID ekrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\AppID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F43F5136-AA90-4005-9368-F91F5C120D69}\ProgID MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ESET Security Shell\ = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\SourceList\Media\4 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA591527-7826-4165-93D8-5702F36C8AB9}\1.0\FLAGS\ = "0" ekrn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\DeviceControl = "_Features" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Encryption = "_Features" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Ipm = "_Features" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\InprocServer32 ekrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Eamsi.EamsiObject\CLSID\ = "{ECC7E393-B680-4109-86BD-7779105DF1BF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ESET Security Shell MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Firewall = "_Features" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\ = "EamsiObject Class" ekrn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA591527-7826-4165-93D8-5702F36C8AB9} ekrn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ESET.SysInspector\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\_Distributor msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21CA1B1A745AD1F40900E8037D29D940\SourceList\Media\2 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Eamsi.EamsiObject.1\ = "EamsiObject Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\EDTD = "_Features" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\TypeLib ekrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECC7E393-B680-4109-86BD-7779105DF1BF}\TypeLib\ = "{EA591527-7826-4165-93D8-5702F36C8AB9}" ekrn.exe Key created \REGISTRY\MACHINE\Software\Classes\ESET.SysInspector\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\Shellex\ContextMenuHandlers MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\_License msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\21CA1B1A745AD1F40900E8037D29D940\Updater = "_Features" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA591527-7826-4165-93D8-5702F36C8AB9}\1.0\HELPDIR\ = "C:\\Program Files\\ESET\\ESET Security" ekrn.exe -
Suspicious behavior: LoadsDriver 10 IoCs
Processes:
pid process 668 668 668 668 668 668 668 668 668 668 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exedescription pid process Token: SeShutdownPrivilege 2616 msiexec.exe Token: SeIncreaseQuotaPrivilege 2616 msiexec.exe Token: SeSecurityPrivilege 1956 msiexec.exe Token: SeCreateTokenPrivilege 2616 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2616 msiexec.exe Token: SeLockMemoryPrivilege 2616 msiexec.exe Token: SeIncreaseQuotaPrivilege 2616 msiexec.exe Token: SeMachineAccountPrivilege 2616 msiexec.exe Token: SeTcbPrivilege 2616 msiexec.exe Token: SeSecurityPrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeLoadDriverPrivilege 2616 msiexec.exe Token: SeSystemProfilePrivilege 2616 msiexec.exe Token: SeSystemtimePrivilege 2616 msiexec.exe Token: SeProfSingleProcessPrivilege 2616 msiexec.exe Token: SeIncBasePriorityPrivilege 2616 msiexec.exe Token: SeCreatePagefilePrivilege 2616 msiexec.exe Token: SeCreatePermanentPrivilege 2616 msiexec.exe Token: SeBackupPrivilege 2616 msiexec.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeShutdownPrivilege 2616 msiexec.exe Token: SeDebugPrivilege 2616 msiexec.exe Token: SeAuditPrivilege 2616 msiexec.exe Token: SeSystemEnvironmentPrivilege 2616 msiexec.exe Token: SeChangeNotifyPrivilege 2616 msiexec.exe Token: SeRemoteShutdownPrivilege 2616 msiexec.exe Token: SeUndockPrivilege 2616 msiexec.exe Token: SeSyncAgentPrivilege 2616 msiexec.exe Token: SeEnableDelegationPrivilege 2616 msiexec.exe Token: SeManageVolumePrivilege 2616 msiexec.exe Token: SeImpersonatePrivilege 2616 msiexec.exe Token: SeCreateGlobalPrivilege 2616 msiexec.exe Token: SeBackupPrivilege 3848 vssvc.exe Token: SeRestorePrivilege 3848 vssvc.exe Token: SeAuditPrivilege 3848 vssvc.exe Token: SeBackupPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe -
Suspicious use of FindShellTrayWindow 19 IoCs
Processes:
msiexec.exeeguiproxy.exepid process 2616 msiexec.exe 2616 msiexec.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe -
Suspicious use of SendNotifyMessage 17 IoCs
Processes:
eguiproxy.exepid process 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe 5512 eguiproxy.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exemsiexec.exeMsiExec.exesvchost.exeekrn.exeregsvr32.exeMsiExec.exedescription pid process target process PID 940 wrote to memory of 2616 940 2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe msiexec.exe PID 940 wrote to memory of 2616 940 2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe msiexec.exe PID 1956 wrote to memory of 3812 1956 msiexec.exe srtasks.exe PID 1956 wrote to memory of 3812 1956 msiexec.exe srtasks.exe PID 1956 wrote to memory of 2220 1956 msiexec.exe MsiExec.exe PID 1956 wrote to memory of 2220 1956 msiexec.exe MsiExec.exe PID 1956 wrote to memory of 4612 1956 msiexec.exe MsiExec.exe PID 1956 wrote to memory of 4612 1956 msiexec.exe MsiExec.exe PID 4612 wrote to memory of 1752 4612 MsiExec.exe taskkill.exe PID 4612 wrote to memory of 1752 4612 MsiExec.exe taskkill.exe PID 4612 wrote to memory of 708 4612 MsiExec.exe InstHelper.exe PID 4612 wrote to memory of 708 4612 MsiExec.exe InstHelper.exe PID 1612 wrote to memory of 5108 1612 svchost.exe DrvInst.exe PID 1612 wrote to memory of 5108 1612 svchost.exe DrvInst.exe PID 1612 wrote to memory of 428 1612 svchost.exe DrvInst.exe PID 1612 wrote to memory of 428 1612 svchost.exe DrvInst.exe PID 1612 wrote to memory of 3636 1612 svchost.exe DrvInst.exe PID 1612 wrote to memory of 3636 1612 svchost.exe DrvInst.exe PID 4952 wrote to memory of 3732 4952 ekrn.exe regsvr32.exe PID 4952 wrote to memory of 3732 4952 ekrn.exe regsvr32.exe PID 1612 wrote to memory of 2252 1612 svchost.exe DrvInst.exe PID 1612 wrote to memory of 2252 1612 svchost.exe DrvInst.exe PID 3732 wrote to memory of 428 3732 regsvr32.exe regsvr32.exe PID 3732 wrote to memory of 428 3732 regsvr32.exe regsvr32.exe PID 3732 wrote to memory of 428 3732 regsvr32.exe regsvr32.exe PID 1612 wrote to memory of 3548 1612 svchost.exe DrvInst.exe PID 1612 wrote to memory of 3548 1612 svchost.exe DrvInst.exe PID 1612 wrote to memory of 3172 1612 svchost.exe DrvInst.exe PID 1612 wrote to memory of 3172 1612 svchost.exe DrvInst.exe PID 1612 wrote to memory of 4216 1612 svchost.exe DrvInst.exe PID 1612 wrote to memory of 4216 1612 svchost.exe DrvInst.exe PID 2220 wrote to memory of 1248 2220 MsiExec.exe InstHelper.exe PID 2220 wrote to memory of 1248 2220 MsiExec.exe InstHelper.exe PID 2220 wrote to memory of 5392 2220 MsiExec.exe InstHelper.exe PID 2220 wrote to memory of 5392 2220 MsiExec.exe InstHelper.exe PID 4952 wrote to memory of 5512 4952 ekrn.exe eguiproxy.exe PID 4952 wrote to memory of 5512 4952 ekrn.exe eguiproxy.exe PID 4952 wrote to memory of 5584 4952 ekrn.exe egui.exe PID 4952 wrote to memory of 5584 4952 ekrn.exe egui.exe PID 940 wrote to memory of 5608 940 2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe msedge.exe PID 940 wrote to memory of 5608 940 2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe msedge.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_0d6f1a17bc5c87c304d2ba6ff25801e9_ryuk.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ehs_nt64.msi" /qb PRODUCTTYPE=eis CFG_POTENTIALLYUNWANTED_ENABLED=0 CFG_LIVEGRID_ENABLED=0 FIRSTSCAN_ENABLE=0 CFG_EPFW_MODE=0 ACTIVATION_DLG_SUPPRESS=02⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.cybermania.ws/2⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Sets file execution options in registry
- Adds Run key to start application
- Blocklisted process makes network request
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding E7DEDECD9F82DDB70AEF9806B9AEC4892⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\InstHelper.exe"C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\InstHelper.exe" -gv3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\InstHelper.exe"C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\InstHelper.exe" -sd "C:\Windows\Temp\eset\bts.stats" "ESET Security" "15.2.11.0" "1033"3⤵
- Executes dropped EXE
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 4D3DD90216891894CEC2A379CE3D49D5 E Global\MSI00002⤵
- Sets file execution options in registry
- Loads dropped DLL
- Modifies system executable filetype association
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /T /IM ehttpsrv.exe3⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\InstHelper.exe"C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\InstHelper.exe" -ci "C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\_InstData.xml"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files\ESET\ESET Security\ekrn.exe"C:\Program Files\ESET\ESET Security\ekrn.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Program Files\ESET\ESET Security\x86\eamsi.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\ESET\ESET Security\x86\eamsi.dll"3⤵
- Modifies registry class
-
C:\Program Files\ESET\ESET Security\eguiproxy.exe"C:\Program Files\ESET\ESET Security\eguiproxy.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\ESET\ESET Security\egui.exe"C:\Program Files\ESET\ESET Security\egui.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\ESET\ESET Security\Drivers\eelam\eelam.inf" "9" "4d8859be3" "000000000000014C" "Service-0x0-3e7$\Default" "0000000000000140" "208" "C:\Program Files\ESET\ESET Security\Drivers\eelam"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\ESET\ESET Security\Drivers\ehdrv\ehdrv.inf" "9" "446a2f407" "0000000000000140" "Service-0x0-3e7$\Default" "0000000000000164" "208" "C:\Program Files\ESET\ESET Security\Drivers\ehdrv"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\ESET\ESET Security\Drivers\ekbdflt\ekbdflt.inf" "9" "4f39970b7" "0000000000000178" "Service-0x0-3e7$\Default" "000000000000017C" "208" "C:\Program Files\ESET\ESET Security\Drivers\ekbdflt"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\ESET\ESET Security\Drivers\eamonm\eamonm.inf" "9" "4d14d0413" "0000000000000188" "Service-0x0-3e7$\Default" "0000000000000140" "208" "C:\Program Files\ESET\ESET Security\Drivers\eamonm"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\ESET\ESET Security\Drivers\epfwwfp\epfwwfp.inf" "9" "48fcaabe7" "0000000000000140" "Service-0x0-3e7$\Default" "000000000000017C" "208" "C:\Program Files\ESET\ESET Security\Drivers\epfwwfp"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\ESET\ESET Security\Drivers\edevmon\edevmon.inf" "9" "48c1400ab" "0000000000000164" "Service-0x0-3e7$\Default" "0000000000000160" "208" "C:\Program Files\ESET\ESET Security\Drivers\edevmon"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\ESET\ESET Security\Drivers\epfw\epfw.inf" "9" "456eea8cb" "0000000000000150" "Service-0x0-3e7$\Default" "0000000000000184" "208" "C:\Program Files\ESET\ESET Security\Drivers\epfw"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4440 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4068 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5348 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5780 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5736 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=6148 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e595d7b.rbsFilesize
4.2MB
MD51192866dd371659f0bd01cff77636ed4
SHA175992238d2e92b5d7bf2d5d03d2cddbc378797fb
SHA256333db4a40a195ca142031d28c2ffc891a261dc40ae2a9349f03e9b1cccc9608f
SHA512a34b49485fa7de2962a56888ba355b84ed98ba295d2d040e06f926a534de7164e43158dd6c6e916b87443af3c48c55e034501c3aac48f8cedd3fc825301595eb
-
C:\Program Files\ESET\ESET Security\Help\help.cabFilesize
250KB
MD55f27d4885c24b14969920a4b0ba65552
SHA16a06e5b91211af280873e6234e8812d86d89cdfb
SHA2563c398a302ab91dbe1bca55cbe0d06c6c96ab1d42212c9b5f2aadb5cb44c45fd5
SHA512b90abb3ce9895b4e287d8e04ab41f80d5f2ce6e160d09cb0555583478d217f0586602e2959bb2f1cbaaa9cfbce2e2934f527e3c8124840e094b2ce0c95b848e4
-
C:\Program Files\ESET\ESET Security\Modules\em000_64\1067\em000_64.dllFilesize
201KB
MD58d181fa24bd70d91e2e1b1f5674a5c11
SHA14ea0dd216ca452cfe0b5525675d2f78e3bd4f9b2
SHA25628c7c9092921a4c0b7a5fea40c47065fbb3772ed6cfd6ca5e7ce2634565fc20f
SHA51209342cfff1faa0186b1202338613855a99f2b63fd453b4c30d1861ebe2181ca2879d54d55bdae250d3ee99b81fe4a0a5a2dd93536d88e072cefe8245823d1ece
-
C:\Program Files\ESET\ESET Security\Modules\em000k_64\1022\em000k_64.dllFilesize
58KB
MD57d016950c035870d2939d0472bde6a59
SHA10bef958548114b29500e5cf0bd0845f9beedc5fd
SHA2569c021e59e2d9d4b55535da2f59de339864e0e66a457f2fdd87ea1d34c74dbe8f
SHA512679c34197c6d66ffc10f9971bf4e6c5e349cdcaa54258fc2faffd902127d3c6979af8a64119e1d79559db2f261bb781007fae76d35476e8d4b6580e254631650
-
C:\Program Files\ESET\ESET Security\Modules\em006_64\1237\em006_64.dllFilesize
253KB
MD526c3f49161c7788c4634bf20a90fd199
SHA14b3d31c2d1120e7a6763fa791e49e21d727944d6
SHA25608121b0374ffe76455c2ee9c6780478d75e9a1ccd789b5467549aed01fd369aa
SHA5128a3a69988761581b788fd0269490049ec68f7f5e5ca35316bc40187eaa9e0d93b41878d64c586b53ce30c6eeae3f9a60a28fcb016f38ec55de812e6b42cf1727
-
C:\Program Files\ESET\ESET Security\Modules\em017_64\2031\em017_64.dllFilesize
15.3MB
MD55ad584a51434a1d5f8e0d9e27625852c
SHA1409d8a402dc8eebdd1e68bcef77afb152cadf90f
SHA256342e29c8012390a12efc044d18abbf1fbefddd73b4d0d5307bc0f992062513cc
SHA5127da55962fa8be50dcb625792393d81a78656a75e373c0d100b9a9e33e04b764fa4e52cfcaa706fd64234ac19edb570202b6c28d04ace83c03ded3ca6a0076e06
-
C:\Program Files\ESET\ESET Security\Modules\em024_64\1138\em024_64.dllFilesize
2.2MB
MD51ed3fcbd5a1a22ce6e3aa3f520e135b3
SHA10a5f1bfc03a03954244d43322c5674a9237e1751
SHA256c7add46fedf42ae2a0564af90504c5fff11ea3595cdd59c68d7194398241fbb8
SHA512f8ac32a9ac650442cd6d5661778996af16e5ac6b71dcbbeb3960e0b3aae01465811d89ef005dae0cb1128606087ec9feac7e86ee478d3a4a7d52a9804fbc890b
-
C:\Program Files\ESET\ESET Security\Modules\em039_64\1902\em039_64.dllFilesize
7.0MB
MD54c42a3f978f266b4ec91bdeeebc3e63d
SHA1875dbf6f583d5cc8e9bd8c43bb08ea2527fc6c44
SHA2565fba44fa6eda0e2fd05149acea11e0d422aa0f8198e6bfa50dfd23ea985f1221
SHA512960d3ec42371217ed7a3c424a162acbeda2e0f0744930380b4a6e21e4b52baf7841187b70b10059514ddbcdb3a4b4e28e9b4fee67fde29cbf6265dd5d7e8bda5
-
C:\Program Files\ESET\ESET Security\Modules\em045_64\1073\em045_64.dllFilesize
2.8MB
MD5f9d068eef6b55e55fd778f8a8909ccdf
SHA1fc02df7320b8762b5d0ff1ffd65f25bf995e2775
SHA256a47ba4859de9336133e6dab941900fee96fca96abc08de6be157b4d578b073e8
SHA5121050c986118fa5a4f53cde0f0f3675f461204708cc406aceee02a8b9a7405abf7eafc517e8a7e205e5caffa41cff8d2b511c82c57f4edb7ba2ff144a46d4da03
-
C:\Program Files\ESET\ESET Security\eula.cabFilesize
926KB
MD5c67405c72c3e55f37eb98bcddf2a5f08
SHA113000aa939e609c8e37d5aad98d555b2fefa12ee
SHA25647307aeeacacbcf68880db83d288e33528bdafe67359aafb665d28add58a82b0
SHA512546fa28987f2629863bd0fc6fd7e69e204959ac457abe18584fd43109251c5c8c732e355949f8633f7d70de0fc65a3ce76cc7a5c17f6d63c7d6fcd29a6c6b8f2
-
C:\Program Files\ESET\ESET Security\updater.dllFilesize
1.5MB
MD5b611e274aa2e063b0f3df5059cdeeb87
SHA1640f4851fd39421e7e7b21628ab94c1646004cb2
SHA256bbff73ff3ae76326da6563c07526201c5d11f1b0ab99140cbfee62bfc6b9345b
SHA512c0783bd2a53f9a8cc5c102bf473e9b442d07a860998b7446a14999e6badceb8834582248ac689b3c5f2f92aa87ad6a04e3acf9648e4602d7f84ceefb3d9b2d5b
-
C:\ProgramData\ESET\ESET Security\PKI\ctl\c864cbd7d9663fe5838a7cf099d504a9c2f1e749.stlFilesize
3KB
MD5b091959e805c22980eaaef6714643a37
SHA137c6932ec07a5747ad197b0741ada2b2ad6ed97a
SHA256b2423245e639a3db7638d99cbcf0d23a1ef93d46adfeafda4811abeac83c6567
SHA512a9f8cdd031a34a0ecf6a78a7cb614546e28c1f228055f52e6a341763428a72fb49ec4bec9512b00a96b5d4fdb0c4efe113bd93605a36b947f3d82ada87fba052
-
C:\ProgramData\ESET\ESET Security\UpdFiles\em000_64_l0_.dll.nupFilesize
203KB
MD56d2a0f7089c5676956fcabaa3565d5ef
SHA1335ac68e8b7c1a14c183cbb4ffa608ee754bee3b
SHA25696227812166e80571218d65ebb02bf104d42cc33dc8b8c96c213f2472ea32139
SHA512dd5aa5850d3eaf9f6bd8742f5c93eff2f77d57f10725a3cacbb342048a2e352b53af325a1ee8cd3f7cec03c39ba8361a4ba86024d94d371f148fb61928a3ed2e
-
C:\ProgramData\ESET\ESET Security\UpdFiles\em000k_64_l0_.dll.nupFilesize
60KB
MD50bb0344dda4455f0ee88359ad0dd542c
SHA12fae2bffa18cc74d9b5d7a0738028b099ac6522a
SHA2569caae628586f800c9cccb8ac034036a122e8306560c866dbcd1e541a9db9f841
SHA512e572b364e153899c3a3ddbe2d3e0f341aa59313d4bb64e23cf80e03c733d8eb1b2b97329656936d3f9dda586f52cd8c2c4145836408f461edeb1fb8a36d75f6d
-
C:\ProgramData\ESET\ESET Security\UpdFiles\em006_64_l0_.dll.nupFilesize
126KB
MD5a665fc1518d21c62014311d5e64cc6ee
SHA12a973c3c9021dad9da8bd230ecb50a3ad371b8a9
SHA256c3d36407a1b6290de5c9b1c7b5b242b39ceba54c87550df0216022cb439de4f1
SHA51236973e9c86dcb87372a6a794d3d9214274361f6116b65247ec5f6d948a8ef131561548a038e094ca488f1ef485a0771867ffc359999db3b1731d700466c03d38
-
C:\ProgramData\ESET\ESET Security\UpdFiles\em017_64_l0_.dll.nupFilesize
6.5MB
MD5137eed0114c07de242353e588e628be5
SHA14d232e445591a67b54089faa18bc7f6e3ebfea73
SHA25662b4e00e26a462dcb65138c0f7d46ed3b199c1006a29c1e82946cd5f350dc55e
SHA512088c537e2e598b5152c43c7f8dfa325eedc93c87f8af87c75dba5f424b02061c46dd63a7d06e844a9559932dd208c61087485e90901997deecd8b23f95368ad2
-
C:\ProgramData\ESET\ESET Security\Updfiles\upd.verFilesize
256KB
MD5f9fa91f06ff3944b0456634c0c7acd9f
SHA15caad5d94957a0bb774aeafe29a31609fa55cc92
SHA25624eded6474c3b09eb8c7cb8068a36e17160fb3adc834f45b771ef505920fc102
SHA51229c1c451fcea2e36925bb9d4a8e85ce1213003e02ab72cb061116285a67292fccce3d76fe334eab503b0b9ace5524b797bd32b0ddc83ff273ebc84fc7bca8d5e
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET\ESET Security\ESET Security.lnkFilesize
2KB
MD526a542c7650e25b7c72aa20131af98b8
SHA1b3f6153500dc823550ec09466f1301e911b56254
SHA25635625faaa3e58753e84c561c8a612dea9fbdf1de835b74b184681789f3c1f4c2
SHA5129d57b7bd2333d1151a68bcce9d2b1d8b2c0c1b3ee2b3e21b33a4b5e1e4c3ca9cb93447f8bfff89666b2ca59e816ae51bd026ae15a8b14b409f73bcb92c2b6332
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET\ESET Security\ESET Security.lnk~RFe59930f.TMPFilesize
2KB
MD51b70c739908f79deb4559f69e87d6fd5
SHA10716f3e95ee2905284a26ffa295d7b866909b297
SHA256fce7c38bca245e6e1be83c7842a4bbc2e41459c0ade4301969bf40f4db8b6b72
SHA5125868cec3b79c6371befdb6c905a3a9407fff420b8576835abb775bd39dc3f4c88ea72078d988446eaec9cd022f252967c8ca2376eadfdd703d7b57fb0ee0338f
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET\ESET Security\ESET SysInspector.lnkFilesize
1KB
MD5e5715472eca871bc54dc741d85d8978f
SHA1ece576d46e3c5e77b56399c5e9e962e75fd37e83
SHA256ffe8f0f26a51f80c32c2f0dc82fee437d3c347ed7640ae36a8dd6df4207e55c6
SHA5120abcacc6e32b28ab35a7eb5b3caa29507d385a36febfc8dace5a943ea003f68008a973b9e625ba85fc31f588659ca5d8fd02853bf9a2f99f4942a4702bfa1610
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET\ESET Security\ESET SysInspector.lnkFilesize
1KB
MD54c46317d5fc77d6b6e25034260e14ae1
SHA170604fdbeae320df65c12f2f34f59b470d135832
SHA256d038ee0937b71d3f7c2ec022a5238f9068ed81d36cba96d2828129b85e897dcc
SHA51292713d041c8d94ea248581c455a7ed13e5c7e040316c9d41ca6451632257741c8c9d5491216250cb5b5626169f81115198ee7d9e105c9ded13fdfb897b58a4ed
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET\ESET Security\ESET SysInspector.lnkFilesize
1KB
MD5b9007fe82cd8c23a19691f46d8be0712
SHA19c00045916212a00192f1839322ee7809b428cad
SHA2568ae2f36eb39dbfcdaa8cc5bb6d77bc4b883f938ee29602b505d6c08f87000a6e
SHA512210aeeecd7826f77bcdf1f69c5d4d7a7c72e6e46de59a92766c790a84d71a7785a9a6fa49377710ba03f7605dac8453fe6e2fb6100d90c7af780eac4d9cbd92e
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET\ESET Security\ESET SysInspector.lnk~RFe5993ba.TMPFilesize
1KB
MD516298ce947762a07211a786550b6ef05
SHA18bda5be27901754f508ef746bd267fbe26b362e5
SHA2561aa534fe95dc4e13d44b6fb05ec3be2b9a564769a554f58a12ac55c125de2c73
SHA5121619725e0042cc125a4d19fe7dba4eaf15b6f1e2d2ca7044c14e94e9e4d9fcf4961f5fbb53f5ca41baacfbd67bf5a54fe02a09881405402f389603ef49e00e79
-
C:\Users\Admin\AppData\Local\Temp\MSI7c63e.LOGFilesize
2KB
MD50bd5f7be60584d54b937b855aa4373ea
SHA10ea63d3d8eb8d9142bde1a2c132985b4aaf48c16
SHA256856379a78052b8dab7c432cce6bce85890d14f1fdce1ef511eaf6bccd1b865b6
SHA512cf55179dcf5819dfdd242e9a97034eb9e20a2f78c60255cd355c322c4e0d4d1b12a186e703f96b5ebfc86ab1677dadd23580762a61a1346560511bc21c91c3dd
-
C:\Users\Admin\AppData\Local\Temp\NSFA251.tmpFilesize
240B
MD594f5556147fc26ce43601ce008252947
SHA19d2696c2d8d1a8b06bc297b196bb6217e9bf77e6
SHA256a69e5f7ce224d46fefe1bd6b07546029c2b08c4e7d66cfea0c495ffc7b00ac14
SHA512c04414a3ff8585e27956c88bfa8317b0a10c15f71a7feb4e7d443864318f74317c4e1a468005d82c7113a739320510a23c8cb0ccf14b929d39bc27b63c04cbbf
-
C:\Users\Admin\AppData\Local\Temp\NSFA2A1.tmpFilesize
242B
MD549b6a9939d8e93cd50e559a64ed32c6d
SHA1254c52b68b19f5f92d34f8a9eeb1ab6e38417612
SHA256ce360c831c6ce3db2a77af66f1c262285aa8ab723d21283f40e0b510e5a263a8
SHA512ec1380753621de10d63c343dcbb0b8fa2acb8e0f863760f450dded692ae9d08b3aade780522a57c55710c006064123093b6cf2fa8591279a9797107d1c55454e
-
C:\Users\Admin\AppData\Local\Temp\NSFA37E.tmpFilesize
224B
MD52c7e1fcab74f2a6f026131078bd4c91c
SHA1bdd7ad4fcb3e2f44dc33ce50d3474169dd257dd6
SHA2563993708208c2b2f89c51a60c5b76dd80e0b9d83ddb9538b282da2a93e129c30d
SHA512d5ba6db8d79e815043492d9cb34cd4b97b78af41de0772109b83fc1c2defd7239c57487df5e97f99892d7024872838c0dc8df9eade4f22915b449b0cef379c5c
-
C:\Users\Admin\AppData\Local\Temp\NSFA380.tmpFilesize
218B
MD50513f72c8a90c38a5caa96902296f00f
SHA16f74ee7796c7ddb83df5beba9b86cde1db758903
SHA256dbc8ba293164535cadd0e9c6a0a68f53d6c1def014203292b1695c7723dd9e06
SHA5126ffc4c815d1a66a9d58040bdfa58389f49e776d66e266f902146390443f20ec22a59478d0a788e36a22233102ffddbf46d1131ee07001787ec7d3119c2bea4bc
-
C:\Users\Admin\AppData\Local\Temp\NSFA382.tmpFilesize
218B
MD5e016ef27bcdde5d7191b59344e975282
SHA17c7ea7497d736ea5738527ced1598cd483ac5402
SHA256c86868e5843615e2843dad8a86cd9312921f9431da3dcfd0da0c4bc2d22bf0b1
SHA512cef2dfc1aeaa78c073c0d252ac3fbd13df9bb6038e0cc579ab37e3e1d70ea948fa987f0bbebe328ba41134a1ece08ca2c020c17103953f1144daeafba6cf3597
-
C:\Users\Admin\AppData\Local\Temp\NSFA3D5.tmpFilesize
234B
MD5672e2d0429bf9d0a938822b810838d69
SHA146c20ce40109eefefab025e1eaba9c7d16095cc4
SHA25653bb37ea2ec43cf7e35c356a293fd4f6f28e76a29f46b64ac6d760d870083994
SHA51227316fd107233391f42922b76780c7328990832ad309bc8ac383c55961ba461b9bf6f427537cae481bc48e508b9b6c245de586d4654e0da1d001c0ecfcc47993
-
C:\Users\Admin\AppData\Local\Temp\NSFA425.tmpFilesize
226B
MD5cf4dd75d7bbf1aed05888c5c677cd436
SHA13810c6174337d0d5623d7007d603946a24e0da72
SHA2565daf3981d013505bcf271c58446614c16b9bdc0f701dd1ffc8e3b3afcaaa7f2b
SHA5120e2d6f55de2c177f41f0bf29f256a3067b316d671ed85a7c6d24756bdc203668fed90058e146df40d87cc2bc4010a49179a688b7ffb3e939c542f90995fad3bf
-
C:\Users\Admin\AppData\Local\Temp\NSFA427.tmpFilesize
224B
MD5e80628afa51b3c8af1372c99c34b9feb
SHA10d9663c19658e56bade95b9ccdedf0a3577a0dde
SHA256863c549d1d3e81d54f360bbbdbfa9fa989dc9c3877a8f647be7acf2683e14287
SHA5129cef42b25c04f258fd65eb386e2eeec761feb6251433d9eac3d58e6ebb95b61e799a7c43a7576c68679284cd810723ec0256b3c37277aa27e49982e9bdc0edfd
-
C:\Users\Admin\AppData\Local\Temp\NSFA601.tmpFilesize
232B
MD51e41b2744c4a8390eb2df0742922d5d0
SHA178382c540ada4f1d5178e05379f6f8324f99a070
SHA2565f357213eba26280f735f323ce258814c6f1dd2f063937084ef6d659492ad13e
SHA5129ad7d0a138b15bb01988c6d7cd0730f4de5f48d4683d7dc7ded0516bae12b4c105a4b7fce719f22296f92aa288736eaaa9c9eee3567d08f837f0721200455650
-
C:\Users\Admin\AppData\Local\Temp\NSFA603.tmpFilesize
226B
MD5cb8191b547a73e24f7f1c61ed221e488
SHA10c6e798ba897add17005d6428794ab453b9663b0
SHA2569f450af6d8616d3fa52f2b07084464d439a0814138b762a435fe47c4f23557df
SHA512d7b04a710c0c74d57b47b17518ad38c4f78fc644e7b16383f15356930f380ed2c40db86663b7663ff1d51953eb7aa6aa8786c89a43187d6fc7b9f395e6525976
-
C:\Users\Admin\AppData\Local\Temp\NSFA605.tmpFilesize
228B
MD557a328103bfa80fd36ee0f702daebba0
SHA16eaa2c13931963498b7fef6eda49cdc99a3750b7
SHA25673f32bfa966e9cf3dd576c7bae905a0ccc11c9ebd2cb57a6c3383331dc5080d6
SHA51243fd11a0e6c169811c85936d360ed70493a4b62bde956720bdbd92066e8e4695d6fc2ee9c43af8265f26362f6b27e8d2932673c34b2eac931e9205f73b945ac4
-
C:\Users\Admin\AppData\Local\Temp\NSFA677.tmpFilesize
263B
MD50fcdddefcd3de6ebbb5785aa724003d9
SHA12f785b5dae97ecfb4ea78e8f012c8e57044a631c
SHA256b64b3e582532d1368078c4a0beef52ebeda3dabc8c9b9e97f7d80955fa50ad1b
SHA512dc767a26503baf30512083f70d45d4fb385263b1c9208fde103fe7ef65d4f3a5d7ae64c0bbb22ee396b4bb7db8cf896470e7f0cd1d7905e3d722d929447964b6
-
C:\Users\Admin\AppData\Local\Temp\NSFA997.tmpFilesize
227B
MD52d1621c37d3c70520a70849ea73a038c
SHA137a45a8e974bef2ad913d727cc4375206a5b6a53
SHA256303d5a306445d86889980bedaea99edd04488b343775d1850f12947dcf78f3a3
SHA51217d315b7948500f6718171fc2a72265ffc1ba849e5e0a85ecd9e45d1192fec5d7a1ce61f77cfc8d53d7e3d75971e5ff1f2f6e87070f5708c18400b0e3be85374
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.URLFilesize
154B
MD56982a383faed6398d98ed4501b074a68
SHA1893add981f1c868942826bfe255be9f7b0f08dac
SHA25680aed49f06685faa934cd2973af79e8a0a01fc51a091f7e7c9acf83a7b09e734
SHA512d592ba93db5e5d1395bfa9ffa3aa348d3e05c2e1d20c7bd44bbfdcd58bbc59906589f22ae81b8d8d9149f56c1e3b25650de252f1227a2800ffbbc795cb9cd3e6
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ehs_nt64.msiFilesize
49.6MB
MD5eee610bf8426669b29c45cb1486a1d2a
SHA14e52fd753e92981ec55e275e097a10724e5a8998
SHA2560249f023755d94430a31854764349fe2a37f9672279bc8d2bd3a87d699d96c3b
SHA512bfac33a1746770757accebdd0e304599c789ef573e4b776046076f166b2018ad47fce3451d8f7ebdc2176ecea68f299d563a1e618051f57701ef3877e05dc3b1
-
C:\Users\Admin\AppData\Local\Temp\eset.temp\{02D83BBE-1039-1B69-E2AC-4BC3212DBAF1}\_InstData.xmlFilesize
15KB
MD514257d6db038b5ef84407617cf367fca
SHA12406a528a06ca3b40b397740a634a84f49ebf516
SHA256f060be2a92834928321ab981d2f1e76506e45a53ce2fe8619b34dbf1f88a3db3
SHA51272f0155b6ebe3014476f49b5d491f9d258c9d5129e30ccb85b67b934c488e445260c6aedd7a5485a7dbeba40e27c94ee24a996ca9bd301dec15ee19d8f757d23
-
C:\Windows\Installer\MSI6623.tmpFilesize
1.0MB
MD5a6b194bd0c4d8b9c59876267e67c0717
SHA112f92700f7fa9f907c8a1743c1fa96e3940ddf14
SHA256305e89a89c6bda9c5b6d535ad3f659e78949e31605fc7430225f724c9621498b
SHA512fb062816c5dcd7651178924850db00ba09924e3eb53c60c786e219d2c7e112d248fc826257b62f9e02cab6b38244424e697f3a148005631853ddbbb17489e512
-
C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\eamonm.catFilesize
11KB
MD58007d7a61c55f396e25a64abe1e55893
SHA1b41a731ec92a0df1494b0db1cf5dc8991627f53f
SHA25603efba211320204f3668fbce836c5e4c433309136dcef629abf799f845ebd7fa
SHA512fb28e826558c4fde11773bffc641440c1d33a37a70685a60a9eff14224b1ab463e04ca16c99058f59b447de7d73df5f7a5e3c7adb48eac7670f04d633db5d55c
-
C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\eamonm.infFilesize
2KB
MD59b419d23c933d7111eac0fe878c5ea3d
SHA11d6924fa6e471130aaabc6d8aaaa37520a098c81
SHA2566b0e0b936a7118e1a2aafe433ff72c049e2a0ddfd1553e250317f6aae20420a9
SHA512cc1b2f47a35dce8fecfc38acdef61217069febcf053e1fef83ea7340177d57c2635170334bd5583fc32c1ee7041c353789f2e39f91f821938ad6b172cae6568c
-
C:\Windows\System32\DriverStore\Temp\{00fa3d12-fcf2-264f-a012-c43d9acbd6e4}\eamonm.sysFilesize
188KB
MD51bb51cf9a323bfee00a1446f59159edf
SHA15f89bb73c2af4d21be3b28d3f509a4de153f0911
SHA25685ff1a6413eb15e10cb27b1ca07286589318338537dadc46f7568b218a84f1d3
SHA512ebbaff2c79e92f55b3a514aab084f0d8ff1a3c9f445ea790bc059ef2b92394ac47ade436aff5461102579d837d0d7df62cc7fccc47800174e90f67f7e6598f0f
-
C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\epfw.catFilesize
11KB
MD5422a98fe231881334aad44254f28c29b
SHA1bd8019f2a2122722fb0721e164786b551961346f
SHA25688106ca17e1c7992e1347df35de0dccb3e46f1d695aaf8004ba40098d30272f3
SHA512faea801378e6deaae5b72ab86ef8dede3bf186d2ff0fc48df17e5b6c31184a32cb3987bf19edbc25d2967c24a94c94b69670042570b995dc8ea1c88c5c94ba53
-
C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\epfw.infFilesize
1KB
MD57463843636ea9e4b29e55c54e0593f84
SHA17b9765fcf58f28cdd60d4903b22345c89b9e7b90
SHA2563b65077080a82006658e995f6b1909fa01f4ed40fabae546aeb40e40885d163d
SHA512f0ced6cb49813e391c22b31cc3cca20519bc31cc8eba9764ec7ca54c72640df1a0799843675e912a8ff39976a25348800a735d23f8fae8f9782d8fdc7e29baae
-
C:\Windows\System32\DriverStore\Temp\{0c2489fb-4003-b64f-aec5-3a161c935735}\epfw.sysFilesize
77KB
MD51313f527ba97793ed9747d9dbfedf1b3
SHA17bf08a572712deefcd09a8933bfaf5bb2066e86d
SHA256d4dcdc668906fd9a93aad1af93f7bb2602855dfadd13cf1d5a5753a0e13e55f2
SHA512ecb9ca1db1ed19a7d29028ff83b0b6654dc7231447cc386f7d02a49c540d7f0a9956a41d6b17b0c8e21989e15aa2d951c001b1e2d9813affde5f64ee93152949
-
C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\edevmon.catFilesize
11KB
MD55dc9aa7bcb0e77d5057d1e7aa28c01bc
SHA128dda2d179cc670910ea24c1eef2ca3a11fc45c0
SHA2562bfd4bccae9f7457b65985dd7a1a0fd90ee6e8c1b66e97cffa32d9bb09b38daa
SHA51265a9f83cb7cb231da9e1aef69c2731ed53ad85e94ac7368a041e45d9ab1c06f5934494857024e229f214556179f3767e114cc0ffcd78cdb90c2d84aa15c10529
-
C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\edevmon.infFilesize
5KB
MD50118a06511577f484647ea9b5c46785e
SHA1d85f3406b9ec398a7a32be208f9811e2777b12ae
SHA2568aab4d7356c3a8ce23878c1794bd197b2b1a199cc5b518d338bef46bd61a1f16
SHA512b54097301aac1025ec0a3942edc76bcd741a6c376417fb870fcfb70cd6be2c30ee27d8518683397b8a27fa20dcdbd00d48f7c94b8508ebd208ae32c62fba4adf
-
C:\Windows\System32\DriverStore\Temp\{10130c58-56c5-8e49-9ea6-ae62dec2eeb4}\edevmon.sysFilesize
114KB
MD537c27022bda1ebe1a3cf3c77f40d1430
SHA1eb929169b792e2a4291592f26e526e182245533d
SHA256ea11e114116aa7b425ccabc5b3822f15150e23e4c5925877f0dcda57737f4f64
SHA5122f20f037f5b4d776adcd5e1d23d1281d754cf1862341bb0014f172915decad08a558369e320d0af8a93c18c254cb46464fe75a2af7634528ad8bf61020cfbed7
-
C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\ekbdflt.catFilesize
11KB
MD5ca138f7c4043fcd6eeb57a52c77f6320
SHA19269bd6843f0834063c2f989473ed63cf7461b2d
SHA2564af9ed2d2e9470a7323196fa005364953511b0f7f3ada89bc02a99a0e4528d5f
SHA512b60fc31c44ae565bcb73328c7fa0a99aacbbc2a57a5d95622a387cd6f6f7159e9ab569a3a491c5dbc60f699a8964073923045044fad8ba09ac1072f1bb14b3ab
-
C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\ekbdflt.infFilesize
1KB
MD549881c94c0d32c687430491e484906d6
SHA1db70de2a97de9055d5f661068d01a1616e041f6e
SHA256122f3e38b66ee1a37cdf8c791267db0ac8becd3c8ebeb9dfe8890d336bc79222
SHA5122aeb41ed7be46e74342ce9549a16b9ce5129a3cc04a0eb35226dbefcc89518496dadbe0639f488f7c93a0a108eba08d87e98e44d93d58c5bd7baf1a32bc612f0
-
C:\Windows\System32\DriverStore\Temp\{60f8c8f5-c7e1-8e4a-bd63-33474c4c1f1e}\ekbdflt.sysFilesize
51KB
MD56ff5e0db82fbd22533c3cef1f3a72040
SHA1a993b654554b747311d8f2c5fc16569cf1a8bd8e
SHA256e2879a3e38f0b9b872df036f836629b0c6d6e29cd32ad4bff85741676cd1179e
SHA51295012aa36f892dd1815f35e2b798bfe0a85bcf6acdaf38b105591b5eb079189a509fa1c2c0400cae764cd6d5486353e300ead6edbb59dff5ccc648237ac4d6d3
-
C:\Windows\System32\DriverStore\Temp\{c74d3266-a6c9-4245-bce7-a0082a5af877}\epfwwfp.catFilesize
11KB
MD5459fe8917412b86a056ede871326761f
SHA19325a2542971d03e6bbf127185026d148dcb8fdc
SHA25619fd9d5fe4d9fe9accea9c3039037182a49f05c0eb6234198f010a806b7ef7d9
SHA5120dcc620ac3cc8a397e48fcb63317794ed572222092ebdef1101c49bb0eb83e366bbd8318bdc967e8777c7e68da5dd9266acd3613f4b0bee89d80d1ee4605e386
-
C:\Windows\System32\DriverStore\Temp\{c74d3266-a6c9-4245-bce7-a0082a5af877}\epfwwfp.infFilesize
1KB
MD56183a9913676f531c8349d165e99f7d7
SHA115556c160d22b052455e468872fe6236f1aa2cff
SHA25600f9acecf03f23cbe7d97425f35dac0cbc1dd17d30a249cbf701f364200ba3a8
SHA512dcce083c627f193ef108abf729b4106b496ded9b1c23024e9d1d8e5baa6f327c701bb1377143ef648f651acf747ce5d69f523dd0a69711850bf31372ef79e25c
-
C:\Windows\System32\DriverStore\Temp\{c74d3266-a6c9-4245-bce7-a0082a5af877}\epfwwfp.sysFilesize
116KB
MD5c9552fb3edd9740f9e30b16504a6374e
SHA14a0d01224855b98be44044c2a7d8f87c6d58d5f9
SHA2561f813c620949dc2fc50f5870899887bc4df75496910ad85adf4f047d8b9aefee
SHA512e29caeb92a1db49c1689afecf710cbd9d10cd6b1b44b9eeac8d46d3bed7fbb64d7f68e8dc88f66d970ccbac74093f9553f913b493695d7bd5636d1475f79637f
-
C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\ehdrv.catFilesize
11KB
MD5c0bdffa371ddee4700e5f7bbd2070da8
SHA1a97e6f3f29187e1d95fe61d6dac9179d0b4f7650
SHA256b7b35bd0719873386b3320f0ab46ac051872af9fa9834cacec5707daa6fa1a17
SHA5126c35becd3a2db23f7e83a77356e17582b4b23abaf3073ea31b0a796546184302a672e64fb6bed4dc2f53fe7512d88c7ec2c9c454937ec968a211f1806038ceb1
-
C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\ehdrv.infFilesize
1KB
MD53de6e5316c062932be5517590f83edb9
SHA1b62ee86512b4f57915a4002a44fccfe89fb77691
SHA256e788d121155124e8dd5c81eb9603f6aa8c78a8cf4b757a2b8b87d59945f9d296
SHA5127297da48dfd354bf49f8fc8762426ba346ac97d71ea5ad7c8ed05f1449ed2f49afcaf95698cd443da6a4b19ba85fc4dac5acab63a5a625f1121bc2175fb23e04
-
C:\Windows\System32\DriverStore\Temp\{db517b3f-2c41-3c48-8255-3aa4c05d796a}\ehdrv.sysFilesize
228KB
MD50454eb36de77c7c7f12d92fa0c184a3a
SHA107eddf2db51f3477219a193cd94d09af1deb9c99
SHA2567619f1c7b91720c44d0cc8d23e30cd20e7d91ac8e5cb0514de78f1a2db99fc06
SHA512fb7fb55676480b87696d3a50487a3f0f69b88dadd13c9ea84e8d1b1530120285322c8519845172f3d4ec15ad9b23e48dab72bfaa585995289c84c5d5a60a7fa5
-
C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\eelam.catFilesize
11KB
MD511d905d5f5782b5e15b0fa70f613b862
SHA12fd16cb9ae82246c682fb8d6506a05a6df3364ee
SHA256339d3b56db804fb5c6312f27c58d4e102dff527e8ba414586f116f7033eeaa20
SHA512bacbee932783db40bc75eb60673f6220506d80d1c14e8bd207d4da5adfdac70d4839ef209cae803ea8f38d4a448851f583a45c5af919b32790b155eeae63fec0
-
C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\eelam.infFilesize
1KB
MD5a7d5c0c73d05acdffa664557874e7008
SHA13a98033c84a31e593ca4f27723dd70774c2674d0
SHA25617af5930daa149addf4f3092516ca1cc9af8018a792de967193b391e99516a8d
SHA512ca91643f28dca94cb25cc3af688f224139cedd0276c5b764b9c81b228854b8b7dc8a4ba87682681b020d93eb0d38e929bb0b247fab68bf88a16604048d9cfb62
-
C:\Windows\System32\DriverStore\Temp\{de05d803-dada-3847-8ae2-aa980f12df0c}\eelam.sysFilesize
15KB
MD56482645cefe3e5237d154470e3e66ca7
SHA18048b5607ffbaee37e0a7b94091a2457181cda81
SHA25656af45ea19ea3aaf91121cae00748f533041bf4071949d270be530568a0e9c45
SHA5122b42a3e1ed6918d6a0a98739349cfc92596fb4f00c8acd901e57a3759cfa9e8da07da19386b6060af90bccb0e69df57e1e64fe0e310f6168f17dbf6e8e97da2e
-
C:\Windows\System32\catroot2\dberr.txtFilesize
19KB
MD5df6b69ec4ff2cab33c0de55f9449452a
SHA12d906f040d0d3107280507ee83e98cd3982bda17
SHA256fa159ad0aa396cb6ca62e83b41ebaac68df3a8bf74b5fe0769f0362d69df1ecf
SHA512816f1463a8360290dbd14f01d00b9dd21176d62bebdd626d91b3b83684bef1849057c0612da10390d0c9625143cdc68e0e3d72751e680dca89ce9f6ad927def0
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
23.7MB
MD56316008d9cf1b58461ec35dc3b46c1b8
SHA1011171610c37ca91d900edaa0447caa54a109245
SHA2563c46a1be4161b966fc9366aae1def370c5044574ec9f38fa0e8379ae9678fb61
SHA512e11b3af10a92327bb6cf251c0f96752d316acffdc903cd2c0ba815139abedebc3ad80d0f19a73dcc7f9e6e435825f582a661fc6f8a151b01504db4b95a2e3918
-
\??\Volume{d2bbef64-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f7c3f59a-d0fe-4fea-947a-2e8ec3e7c2e4}_OnDiskSnapshotPropFilesize
6KB
MD5d1cad18174d01c1a615c7d6604f7ecef
SHA1145bcde6689da2739738f29f7da937554c639810
SHA2561a2d46913dbcce977a12684a7f64db78266d80abaf55210d1fc6681292cc794a
SHA512f2ddafaf90a410cd1187c5f855732e4f77d2fc1b6845bfb87c03837d53def000db449c5abb58925f2efed714dee629f1d07cd26ab6652a41de47000c480cc573
-
memory/708-716-0x00007FF6889C0000-0x00007FF688A7E000-memory.dmpFilesize
760KB
-
memory/1248-1181-0x00007FF6889C0000-0x00007FF688A7E000-memory.dmpFilesize
760KB