77295683e2ba57adf91afc54701c46f06a7a847f3621b15f2acfa7ea914fcf26

Analysis

max time kernel
115s
max time network
128s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20-01-2025 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nefarius_DsHidMini_Drivers_x64_arm64_v3.5.1.msi
Size

17.2MB
MD5

a86c0cb5c3f36cbc15f2589a0ab0b08f
SHA1

2f47ec4cd9bca1ee7add56a96cc16ec00a9e1928
SHA256

77295683e2ba57adf91afc54701c46f06a7a847f3621b15f2acfa7ea914fcf26
SHA512

57316d2f849dd0d140e26a2ce2b59a554cdecb90c3885b3f299469eca6390ecc4c74637137146ba5a0670da25d3af4651a190d7ac9c2ca0ace56dbe0ea9087b2
SSDEEP

393216:cQPyqsHIqm1mJR4MjqESRhJKz9//f13N1Ds+:cQPxkIzs5qECP2Frs

Score

8^/10

discovery persistence privilege_escalation upx

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	4936	msiexec.exe
3	4936	msiexec.exe
5	3192	rundll32.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\nssmkig.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\nssmkig.sys	DrvInst.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	nefconc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Windows\CurrentVersion\Run\nefarius_DsHidMini_Updater = "\"C:\\Program Files\\Nefarius Software Solutions\\DsHidMini\\nefarius_DsHidMini_Updater.exe\" --autostart"	nefarius_DsHidMini_Updater.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7ca645d3-8327-ad48-a38e-2c810d553dc6}\SETF186.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ac05c785-a312-da4f-9b78-5603687086d9}\SETEBD8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7ca645d3-8327-ad48-a38e-2c810d553dc6}\dshidmini.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ac05c785-a312-da4f-9b78-5603687086d9}\SETEBD8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\igfilter.inf_amd64_1792e75f46f37352\nssmkig.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7ca645d3-8327-ad48-a38e-2c810d553dc6}\dshidmini.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dshidmini.inf_amd64_68109700ac2a2fb6\dshidmini.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7ca645d3-8327-ad48-a38e-2c810d553dc6}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\igfilter.inf_amd64_1792e75f46f37352\nssmkig.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7ca645d3-8327-ad48-a38e-2c810d553dc6}\SETF174.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7ca645d3-8327-ad48-a38e-2c810d553dc6}\dshidmini.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7ca645d3-8327-ad48-a38e-2c810d553dc6}\SETF186.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\igfilter.inf_amd64_1792e75f46f37352\igfilter.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7ca645d3-8327-ad48-a38e-2c810d553dc6}\SETF185.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7ca645d3-8327-ad48-a38e-2c810d553dc6}\SETF174.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ac05c785-a312-da4f-9b78-5603687086d9}\igfilter.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ac05c785-a312-da4f-9b78-5603687086d9}\SETEBD9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ac05c785-a312-da4f-9b78-5603687086d9}\igfilter.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\igfilter.inf_amd64_1792e75f46f37352\igfilter.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ac05c785-a312-da4f-9b78-5603687086d9}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ac05c785-a312-da4f-9b78-5603687086d9}\SETEBC7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dshidmini.inf_amd64_68109700ac2a2fb6\dshidmini.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dshidmini.inf_amd64_68109700ac2a2fb6\dshidmini.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ac05c785-a312-da4f-9b78-5603687086d9}\nssmkig.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ac05c785-a312-da4f-9b78-5603687086d9}\SETEBD9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7ca645d3-8327-ad48-a38e-2c810d553dc6}\SETF185.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ac05c785-a312-da4f-9b78-5603687086d9}\SETEBC7.tmp	DrvInst.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2832-629-0x00007FF696600000-0x00007FF696AA8000-memory.dmp	upx
behavioral1/memory/2832-634-0x00007FF696600000-0x00007FF696AA8000-memory.dmp	upx

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_x64\dshidmini.dll	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_x64\dshidmini.inf	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_ARM64\LICENSE	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_ARM64\igfilter.cat	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_ARM64\nssmkig.sys	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_x64\LICENSE	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\nefcon\ARM64\nefconc.exe	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe:updater.dll	nefarius_DsHidMini_Updater.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_ARM64\dshidmini.inf	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_x64\nssmkig.pdb	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\nefcon\x64\nefconc.exe	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_ARM64\LICENSE	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_x64\dshidmini.cat	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_ARM64\igfilter.inf	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_ARM64\nssmkig.pdb	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_x64\igfilter.cat	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_x64\igfilter.inf	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_ARM64\dshidmini.cat	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_ARM64\dshidmini.dll	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_x64\LICENSE	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_x64\nssmkig.sys	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\SFXCABE50615B274318CA1D428805603640F6\CommonLanguageRuntimeLibrary	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA7A1339136E473FAA64E0B6F6232C5512\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA53A14AAB5F427EC86CD9FBE8BEB448E8\System.Threading.Tasks.Extensions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8D949C0AF7456E3AEFD850EC3BA64703\System.Threading.Tasks.Extensions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA470961D2BE4999AA4F1B29373F616CCC\System.Memory.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC5E57C183049822A6AEC29310F4E80C3\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA53A14AAB5F427EC86CD9FBE8BEB448E8\Nefarius.Utilities.WixSharp.dll	rundll32.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\SFXCA5525E9904D46B15A49C21A84F2AF55CC\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e57db03.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA8D949C0AF7456E3AEFD850EC3BA64703\WixSharp.UI.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFD1D37E1F691AF488.TMP	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\SFXCABE50615B274318CA1D428805603640F6\DsHidMini.Installer.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5525E9904D46B15A49C21A84F2AF55CC\System.Threading.Tasks.Extensions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5525E9904D46B15A49C21A84F2AF55CC\Microsoft.Bcl.AsyncInterfaces.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAA425CB78154FE60B989C1EBCD90132C8\DsHidMini.Installer.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAA425CB78154FE60B989C1EBCD90132C8\WixToolset.Mba.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA53A14AAB5F427EC86CD9FBE8BEB448E8\System.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8643AAE27D4317EA55C8828709BA20E9\Nefarius.Utilities.DeviceManagement.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8643AAE27D4317EA55C8828709BA20E9\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA7A1339136E473FAA64E0B6F6232C5512\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAA425CB78154FE60B989C1EBCD90132C8\Microsoft.Bcl.AsyncInterfaces.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8D949C0AF7456E3AEFD850EC3BA64703\System.Runtime.CompilerServices.Unsafe.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA470961D2BE4999AA4F1B29373F616CCC\Nefarius.Utilities.DeviceManagement.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA470961D2BE4999AA4F1B29373F616CCC\Nefarius.Utilities.WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCABE50615B274318CA1D428805603640F6\WixSharp.UI.WPF.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA53A14AAB5F427EC86CD9FBE8BEB448E8\System.Buffers.dll	rundll32.exe
File created	C:\Windows\Installer\e57db03.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA80E0C58A4D4289BBEA39C33C2D281428\CliWrap.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\SFXCA5525E9904D46B15A49C21A84F2AF55CC\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5525E9904D46B15A49C21A84F2AF55CC\Nefarius.Utilities.WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCABE50615B274318CA1D428805603640F6\System.Memory.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAA425CB78154FE60B989C1EBCD90132C8\CliWrap.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	nefconc.exe
File opened for modification	C:\Windows\Installer\MSIE67A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA7A1339136E473FAA64E0B6F6232C5512\DsHidMini.Installer.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC5E57C183049822A6AEC29310F4E80C3\WixSharp.UI.WPF.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA7A1339136E473FAA64E0B6F6232C5512\System.Threading.Tasks.Extensions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA470961D2BE4999AA4F1B29373F616CCC\Nefarius.BthPS3.Shared.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC5E57C183049822A6AEC29310F4E80C3\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA80E0C58A4D4289BBEA39C33C2D281428\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA80E0C58A4D4289BBEA39C33C2D281428\CommonLanguageRuntimeLibrary	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA53A14AAB5F427EC86CD9FBE8BEB448E8\WixToolset.Mba.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8643AAE27D4317EA55C8828709BA20E9\System.Runtime.CompilerServices.Unsafe.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8643AAE27D4317EA55C8828709BA20E9\System.Threading.Tasks.Extensions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9956.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA8D949C0AF7456E3AEFD850EC3BA64703\Nefarius.Utilities.WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC5E57C183049822A6AEC29310F4E80C3\CliWrap.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA470961D2BE4999AA4F1B29373F616CCC\PInvoke.Kernel32.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA470961D2BE4999AA4F1B29373F616CCC\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAA425CB78154FE60B989C1EBCD90132C8\WixSharp.UI.WPF.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5525E9904D46B15A49C21A84F2AF55CC\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA5525E9904D46B15A49C21A84F2AF55CC\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA80E0C58A4D4289BBEA39C33C2D281428\System.Memory.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI137A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA8D949C0AF7456E3AEFD850EC3BA64703\CommonLanguageRuntimeLibrary	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA8D949C0AF7456E3AEFD850EC3BA64703\BthPS3Installer.exe	rundll32.exe
File created	C:\Windows\Installer\SourceHash{25784100-B9AA-4205-8D54-CA53A1CF8AC5}	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAA425CB78154FE60B989C1EBCD90132C8\Nefarius.Utilities.WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA53A14AAB5F427EC86CD9FBE8BEB448E8\WixSharp.UI.WPF.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA7A1339136E473FAA64E0B6F6232C5512\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe

Executes dropped EXE 2 IoCs

pid	Process
652	nefconc.exe
2832	nefarius_DsHidMini_Updater.exe

Loads dropped DLL 40 IoCs

pid	Process
4152	MsiExec.exe
4152	MsiExec.exe
4152	MsiExec.exe
4152	MsiExec.exe
4152	MsiExec.exe
4152	MsiExec.exe
4152	MsiExec.exe
4152	MsiExec.exe
4152	MsiExec.exe
4152	MsiExec.exe
4152	MsiExec.exe
4152	MsiExec.exe
4152	MsiExec.exe
1968	MsiExec.exe
1264	rundll32.exe
5032	MsiExec.exe
4684	rundll32.exe
5032	MsiExec.exe
1408	rundll32.exe
5032	MsiExec.exe
1036	rundll32.exe
1968	MsiExec.exe
3192	rundll32.exe
1968	MsiExec.exe
4108	rundll32.exe
1968	MsiExec.exe
72	rundll32.exe
1968	MsiExec.exe
4836	rundll32.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4448	MsiExec.exe
1956	rundll32.exe
4448	MsiExec.exe
2080	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4936	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 63 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	rundll32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ab2f6650cf45871d0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ab2f66500000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900ab2f6650000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dab2f6650000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ab2f665000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	rundll32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	runonce.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d190100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\GrpConv	grpconv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00148752AA9B5024D845AC351AFCA85C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\PackageCode = "4BEFFFC12ACECA5479C5790EB564F909"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\ProductIcon = "C:\\Windows\\Installer\\{25784100-B9AA-4205-8D54-CA53A1CF8AC5}\\app_icon.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\ProductName = "Nefarius DsHidMini Driver"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\00148752AA9B5024D845AC3517F7A65C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\SourceList\PackageName = "Nefarius_DsHidMini_Drivers_x64_arm64_v3.5.1.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00148752AA9B5024D845AC351AFCA85C\DsHidMini20Drivers	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\00148752AA9B5024D845AC3517F7A65C\00148752AA9B5024D845AC351AFCA85C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00148752AA9B5024D845AC351AFCA85C\BthPS3Feature = "DsHidMini20Drivers"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\Version = "50659329"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\AuthorizedLUAApp = "0"	msiexec.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe:updater.dll	nefarius_DsHidMini_Updater.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 921199.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Nefarius_BthPS3_Drivers_x64_arm64_v2.14.0.msi:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3392	msiexec.exe
3392	msiexec.exe
4964	msedge.exe
4964	msedge.exe
4248	msedge.exe
4248	msedge.exe
2832	nefarius_DsHidMini_Updater.exe
2832	nefarius_DsHidMini_Updater.exe
3140	msedge.exe
3140	msedge.exe
4180	identity_helper.exe
4180	identity_helper.exe
868	msedge.exe
868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4936	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4936	msiexec.exe
Token: SeSecurityPrivilege	3392	msiexec.exe
Token: SeCreateTokenPrivilege	4936	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4936	msiexec.exe
Token: SeLockMemoryPrivilege	4936	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4936	msiexec.exe
Token: SeMachineAccountPrivilege	4936	msiexec.exe
Token: SeTcbPrivilege	4936	msiexec.exe
Token: SeSecurityPrivilege	4936	msiexec.exe
Token: SeTakeOwnershipPrivilege	4936	msiexec.exe
Token: SeLoadDriverPrivilege	4936	msiexec.exe
Token: SeSystemProfilePrivilege	4936	msiexec.exe
Token: SeSystemtimePrivilege	4936	msiexec.exe
Token: SeProfSingleProcessPrivilege	4936	msiexec.exe
Token: SeIncBasePriorityPrivilege	4936	msiexec.exe
Token: SeCreatePagefilePrivilege	4936	msiexec.exe
Token: SeCreatePermanentPrivilege	4936	msiexec.exe
Token: SeBackupPrivilege	4936	msiexec.exe
Token: SeRestorePrivilege	4936	msiexec.exe
Token: SeShutdownPrivilege	4936	msiexec.exe
Token: SeDebugPrivilege	4936	msiexec.exe
Token: SeAuditPrivilege	4936	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4936	msiexec.exe
Token: SeChangeNotifyPrivilege	4936	msiexec.exe
Token: SeRemoteShutdownPrivilege	4936	msiexec.exe
Token: SeUndockPrivilege	4936	msiexec.exe
Token: SeSyncAgentPrivilege	4936	msiexec.exe
Token: SeEnableDelegationPrivilege	4936	msiexec.exe
Token: SeManageVolumePrivilege	4936	msiexec.exe
Token: SeImpersonatePrivilege	4936	msiexec.exe
Token: SeCreateGlobalPrivilege	4936	msiexec.exe
Token: SeCreateTokenPrivilege	4936	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4936	msiexec.exe
Token: SeLockMemoryPrivilege	4936	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4936	msiexec.exe
Token: SeMachineAccountPrivilege	4936	msiexec.exe
Token: SeTcbPrivilege	4936	msiexec.exe
Token: SeSecurityPrivilege	4936	msiexec.exe
Token: SeTakeOwnershipPrivilege	4936	msiexec.exe
Token: SeLoadDriverPrivilege	4936	msiexec.exe
Token: SeSystemProfilePrivilege	4936	msiexec.exe
Token: SeSystemtimePrivilege	4936	msiexec.exe
Token: SeProfSingleProcessPrivilege	4936	msiexec.exe
Token: SeIncBasePriorityPrivilege	4936	msiexec.exe
Token: SeCreatePagefilePrivilege	4936	msiexec.exe
Token: SeCreatePermanentPrivilege	4936	msiexec.exe
Token: SeBackupPrivilege	4936	msiexec.exe
Token: SeRestorePrivilege	4936	msiexec.exe
Token: SeShutdownPrivilege	4936	msiexec.exe
Token: SeDebugPrivilege	4936	msiexec.exe
Token: SeAuditPrivilege	4936	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4936	msiexec.exe
Token: SeChangeNotifyPrivilege	4936	msiexec.exe
Token: SeRemoteShutdownPrivilege	4936	msiexec.exe
Token: SeUndockPrivilege	4936	msiexec.exe
Token: SeSyncAgentPrivilege	4936	msiexec.exe
Token: SeEnableDelegationPrivilege	4936	msiexec.exe
Token: SeManageVolumePrivilege	4936	msiexec.exe
Token: SeImpersonatePrivilege	4936	msiexec.exe
Token: SeCreateGlobalPrivilege	4936	msiexec.exe
Token: SeCreateTokenPrivilege	4936	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4936	msiexec.exe
Token: SeLockMemoryPrivilege	4936	msiexec.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4936	msiexec.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4936	msiexec.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4492	msiexec.exe
4492	msiexec.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4960	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 4152	3392	msiexec.exe	78
PID 3392 wrote to memory of 4152	3392	msiexec.exe	78
PID 3392 wrote to memory of 4152	3392	msiexec.exe	78
PID 3392 wrote to memory of 4924	3392	msiexec.exe	84
PID 3392 wrote to memory of 4924	3392	msiexec.exe	84
PID 3392 wrote to memory of 1968	3392	msiexec.exe	86
PID 3392 wrote to memory of 1968	3392	msiexec.exe	86
PID 1968 wrote to memory of 1264	1968	MsiExec.exe	87
PID 1968 wrote to memory of 1264	1968	MsiExec.exe	87
PID 3392 wrote to memory of 5032	3392	msiexec.exe	88
PID 3392 wrote to memory of 5032	3392	msiexec.exe	88
PID 5032 wrote to memory of 4684	5032	MsiExec.exe	89
PID 5032 wrote to memory of 4684	5032	MsiExec.exe	89
PID 4684 wrote to memory of 652	4684	rundll32.exe	90
PID 4684 wrote to memory of 652	4684	rundll32.exe	90
PID 4976 wrote to memory of 4224	4976	svchost.exe	93
PID 4976 wrote to memory of 4224	4976	svchost.exe	93
PID 4976 wrote to memory of 1992	4976	svchost.exe	94
PID 4976 wrote to memory of 1992	4976	svchost.exe	94
PID 652 wrote to memory of 2700	652	nefconc.exe	95
PID 652 wrote to memory of 2700	652	nefconc.exe	95
PID 2700 wrote to memory of 968	2700	runonce.exe	96
PID 2700 wrote to memory of 968	2700	runonce.exe	96
PID 4976 wrote to memory of 1556	4976	svchost.exe	97
PID 4976 wrote to memory of 1556	4976	svchost.exe	97
PID 4976 wrote to memory of 4052	4976	svchost.exe	99
PID 4976 wrote to memory of 4052	4976	svchost.exe	99
PID 5032 wrote to memory of 1408	5032	MsiExec.exe	100
PID 5032 wrote to memory of 1408	5032	MsiExec.exe	100
PID 5032 wrote to memory of 1036	5032	MsiExec.exe	101
PID 5032 wrote to memory of 1036	5032	MsiExec.exe	101
PID 1968 wrote to memory of 3192	1968	MsiExec.exe	102
PID 1968 wrote to memory of 3192	1968	MsiExec.exe	102
PID 3192 wrote to memory of 748	3192	rundll32.exe	103
PID 3192 wrote to memory of 748	3192	rundll32.exe	103
PID 2068 wrote to memory of 4248	2068	explorer.exe	105
PID 2068 wrote to memory of 4248	2068	explorer.exe	105
PID 4248 wrote to memory of 236	4248	msedge.exe	106
PID 4248 wrote to memory of 236	4248	msedge.exe	106
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107
PID 4248 wrote to memory of 5108	4248	msedge.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Nefarius_DsHidMini_Drivers_x64_arm64_v3.5.1.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4936

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B53A0D2E5C6EABA70731860BAE1C1CB0 U
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4152
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4924
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3981524B0CF18EF9C62F6F2C9010C4ED
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIDBE9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240639015 2 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:1264
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIFF54.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240648031 34 DsHidMini.Installer!Nefarius.DsHidMini.Setup.CustomActions.InstallBthPS3
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" https://github.com/nefarius/BthPS3/releases/download/setup-v2.14.0/Nefarius_BthPS3_Drivers_x64_arm64_v2.14.0.msi
      4⤵
      PID:748
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI987.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240650765 40 DsHidMini.Installer!Nefarius.DsHidMini.Setup.CustomActions.RegisterUpdater
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:4108
  - - C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe
      "C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe" --install --silent
      4⤵
      Adds Run key to start application
      Drops file in Program Files directory
      Executes dropped EXE
      NTFS ADS
      Suspicious behavior: EnumeratesProcesses
      PID:2832
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI137A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240653187 45 DsHidMini.Installer!Nefarius.DsHidMini.Setup.CustomActions.OpenBetaArticle
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:72
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.nefarius.at/projects/DsHidMini/Experimental/Version-3-Beta/
      4⤵
      PID:3360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcbb9d3cb8,0x7ffcbb9d3cc8,0x7ffcbb9d3cd8
        5⤵
        
        PID:2316
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI162B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240653890 49 DsHidMini.Installer!Nefarius.DsHidMini.Setup.CustomActions.OpenDonationPage
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:4836
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F7A62467C3E8CB65CEB3BAEEB5C7D536 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIE67A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240641765 11 DsHidMini.Installer!Nefarius.DsHidMini.Setup.CustomActions.InstallDrivers
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - Checks SCSI registry key(s)
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Program Files\Nefarius Software Solutions\DsHidMini\nefcon\X64\nefconc.exe
      "C:\Program Files\Nefarius Software Solutions\DsHidMini\nefcon\X64\nefconc.exe" --inf-default-install --inf-path "C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_X64\igfilter.inf"
      4⤵
      Adds Run key to start application
      Drops file in Windows directory
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:652
    - - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        Checks processor information in registry
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:2700
      - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        Modifies data under HKEY_USERS
        
        PID:968
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF465.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240645234 26 WixSharp!WixSharp.ManagedProjectActions.WixSharp_AfterInstall_Action
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:1408
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF939.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240646468 30 WixSharp!WixSharp.ManagedProjectActions.CancelRequestHandler
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:1036
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CBE1A1F4D23D91860CE9AA593430EAC1 U
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4052
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8AEE5E5B6257CD21A6901E34985603D0
  2⤵
  - Loads dropped DLL
  PID:4448
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9956.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240687546 54 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:1956
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9C45.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240688218 63 WixSharp!WixSharp.ManagedProjectActions.WixSharp_Load_Action
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:2080

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1f2a1f42-2e01-e04f-aa11-a0a848cc7f2a}\igfilter.inf" "9" "4275ffd9f" "0000000000000154" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_X64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4224
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\igfilter.inf_amd64_1792e75f46f37352\igfilter.inf" "0" "4275ffd9f" "0000000000000164" "WinSta0\Default"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  PID:1992
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\igfilter.inf_amd64_1792e75f46f37352\igfilter.inf" "0" "4797fa4d3" "000000000000010C" "WinSta0\Default"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  PID:1556
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{a1c3a4f5-2234-6a47-9119-6892cf489c0e}\dshidmini.inf" "9" "4f1109cbf" "0000000000000160" "WinSta0\Default" "0000000000000168" "208" "C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_X64"
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4052

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/nefarius/BthPS3/releases/download/setup-v2.14.0/Nefarius_BthPS3_Drivers_x64_arm64_v2.14.0.msi
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcbb9d3cb8,0x7ffcbb9d3cc8,0x7ffcbb9d3cd8
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,1626874614389899605,2983456117679782221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:868
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Nefarius_BthPS3_Drivers_x64_arm64_v2.14.0.msi"
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57db01.rbs

Filesize
17KB

MD5
343979141f4ea24f14f64428102c6da6

SHA1
739dad977d67327c10c20b52ed60065f8a114f9e

SHA256
60403f6d32df827aa6a3c779dd59c326754fd871ab114282ba80643ecdf16bac

SHA512
0b44be0b59c2ed6270682ccce9b09a6b820ae23886d1635bdea0be7e933c54c4a33a988a8ac42c892881b042fd13758039a881b4c83b93237b5595753fce9ca5

Download Submit
C:\PROGRA~1\NEFARI~1\DSHIDM~1\drivers\DSHIDM~2\dshidmini.cat

Filesize
11KB

MD5
3ef9984bc1ade541843e7b7be82f67ef

SHA1
b3a6e652b0266b11395eac4d565e0ce5f574c7f7

SHA256
90645fe17aed1227d423938315b775fed27e7625e92aa0d28a005aca3c78e978

SHA512
c26b5f53f0d7c81fa9755cd2ec4adb3f84a946fa2d620703a3dff7a49c6fb976d9b9a4b6b2f86e49510161926db29c18bd92e8fff8d781704c91ca2859d5480e

Download Submit
C:\PROGRA~1\NEFARI~1\DSHIDM~1\drivers\DSHIDM~2\dshidmini.dll

Filesize
331KB

MD5
60279aafc8baeba0cb6c52b93d37af77

SHA1
8835697b77c50dc79768eb43992ccc0d7981825d

SHA256
349f8f482ac7b91a661f4bc68ab381c1f82ae91955e84f159b2a7953919dd86a

SHA512
5670f4714de674030b0db8f0f0361021b4aa8865ec417dfd0e1c571d766eba302adda8394c9d0ac202242a6f7fbfac73f851f875fb01127dd91dafc454d5ce82

Download Submit
C:\PROGRA~1\NEFARI~1\DSHIDM~1\drivers\NSSMKI~2\igfilter.cat

Filesize
11KB

MD5
e479ab5fef954214ceb26db6a0cc24cf

SHA1
d7417ff98b4b3aa1b6f508eb71e510230a84661c

SHA256
eabd50ea697d44accd4124d51c17a20b37af55b48e4c4b8334f8c1135ae290bd

SHA512
220527c83c57a53341113dbe3c70f5c1697cb072aa94c79723dc02778934e2298d0c24f3884898e2640f7df0925fbef1524801a11f26f5235669e0a7faf98737

Download Submit
C:\PROGRA~1\NEFARI~1\DSHIDM~1\drivers\NSSMKI~2\nssmkig.sys

Filesize
38KB

MD5
bdb75b589104cbaeb75b511feed1961d

SHA1
2310dca23cb54cdb854b451a287985bdab40efb7

SHA256
3e0d18e9b66889363c7fe2a6d13bfda596ac83b55ddbfb1faea236769ecda1bb

SHA512
5c7fdf7555faf9ed5ade5237110fba633c89d968ded70927a89493b28eea7af71ac5a79170dfb9842afa48d04cba6b440467f202fd5fd306cbfd2dc1b4c82fb9

Download Submit
C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_X64\dshidmini.inf

Filesize
21KB

MD5
f1aa14868509717cb5597bd7bc4d0bd2

SHA1
809382f07daaa3ce763e5efe9e464f0c62972485

SHA256
69a45c913ad8919351a0862b5eaea6f494079a626e32aa6e345dfc2bfc45c8b3

SHA512
3d531728d8e267362e2099213172f19e2ad76d91a7e890e20e9bcc42c7d08a1684699ae2f07cfbf1a2ea5293981448619e6636ab7c8f2fc4d7485252999fbb8b

Download Submit
C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_X64\igfilter.inf

Filesize
2KB

MD5
747745cc58c6d65a339ef20e6ab18a9c

SHA1
7ecb1d34ed0d2eb4d40af3c64273abfe76d6a456

SHA256
e760ad778f0c60a17b6a6b82876b03e009482da59c2515142a8ab43fcfcb28a1

SHA512
61611cabbb554bf37576f497aacccefee93937dd6355575a5991b04ea97a2fba716f7292a3cb9588c7f05e8190ff84284d1bba1e86734caf930994daf9d3cf25

Download Submit
C:\Program Files\Nefarius Software Solutions\DsHidMini\nefcon\x64\nefconc.exe

Filesize
582KB

MD5
f04f1a09e3a7e6d605be84b4393c6bd8

SHA1
14bf911f5517bc06855737bdf0f5c7bb9964a1f7

SHA256
1716bd0a51d03d35559be1e420fb9e86858538221642aa2e2d937da1f2910cc3

SHA512
0d6b1e5ff81a897052bb14fa490f1106da18357b0b90dd3393f5c2db266d71e2e88ecad83069226fbbd6ccbbd08a9385dbdc35248a195f566203a1effddfd584

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
71bd195d7c58500ba8a871cf9308a385

SHA1
4ccbbd6d61a80f21a86adb44adbe9018fcc0d09a

SHA256
adea38b7c56668aaf6e0536f8aa40de32e398d248a975b573becfdbf880499ae

SHA512
9b230b2a5073903847e17c5835f7ffba35647925e742a4e82dbac36e22fe6d74ebe3c686e38c1c8762db82c034480be83202f58424515603c572551e3b93ef02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_35E9AC8BDBFF76B8DAD6DDAFD42E3BC2

Filesize
727B

MD5
c8585dfc48577c688ba5eaf273c1f490

SHA1
8384790f80e143c55eefc32f709de2238042603d

SHA256
4d2810960ec0f7a7b5431159659a30e1b85b96481e58952c72453563fb62bf70

SHA512
1472d30c034defa92d957638c72eba79de60ab533fdf60dc32d638e7f3385ad108277939b19dd0cbbd17389193ea830cf1d927d247e0fdf9521b95b2a0d2aed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
a0cb20d98fd71cf57d7da90834608d35

SHA1
806211b77bd71026a6f3c6cdb10f5f7724563aa0

SHA256
4d246aba43cc43ee629a9879f6bd3502b3d3656dfe11f0c9a29c7a7a89ad722c

SHA512
fa7543436d91734abc480114024f041989d8b780d0e01d63224ea41be0e1c4e9901dc04111db6e499c479ea0d52d6e78f630ae8a8fa46e0a22d315f47ff01358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
87538cc53de76653f21c696cb91edc5a

SHA1
6e26344093d67018258c47193a058f5994641296

SHA256
e0eb635713e52d1d8720c0090c12090a7b64287d21803c93d7152aa580819d14

SHA512
0a562e215e7e906ddf37c5e70422d808bcd428a6001026fbb0f7eef321cbad10d2a07e6b44eb47a4a67b28a7b528d58e4a9ff7aec16386e9ac8b2449880cc764

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_35E9AC8BDBFF76B8DAD6DDAFD42E3BC2

Filesize
408B

MD5
88e710aee7458f6c65ca87ea973ef46d

SHA1
c770bb47c6329640b3da65b52d9aa19ffb5fd666

SHA256
c1de4730b65ef506faf502725917bbe2b9a8a046c1a817065b5e643e69308f34

SHA512
b14c8ee311786440c5d38e9ab486f3d7adec88a2e563e4c1b301d3f06c2e51e5d25befd166ead3368717906fb5bae167d3b535b38c967c4995e1504d91fe2803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
4f1b23a9a4445a53bf808266b5660953

SHA1
52e7af3b3e99a0b762a67c812068221bb05ee7ec

SHA256
d8ee6abbde2ee6a1b81328b3de4b428808f6ac39af5d96fe578f51f5ff733a32

SHA512
19b174e21c17f41a7ac910420c51780814a499679b15af49eda001f88f70ef803b79b817635d50c6c27ce8db057e2ea5ddc9538aec138d5664a29a761a732dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log

Filesize
651B

MD5
79dd9d574bf7da4d10dee390db653a12

SHA1
ddb3e64a2e79b01101cbd6d553eda0659451bc84

SHA256
4c0cac895c138615c44f674f0a92304ec664e87fbd3721eb9f403cc03f2fea34

SHA512
f08b39971a8cc77761dea295906bead275aac4011821a3ea1c0a78ae1162bbbb1cf51cc93fbbb7c72cc4ac1bd2cb7d69cdd27ef6ff93d31ef66be8f97615e4b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e36b25e2b04803ea9ec1b7282ff2f7ff

SHA1
767d9fd98602e1a43ed4e140f4153d31362d1d3f

SHA256
fd5d4314cbe5d9707280df3b8c00e379703fbfb50a2bcdd12482453eb4c05dbc

SHA512
a71cb48d22098269e7a846cc1e1f16a8067ba9c48e5074f85232b6f0282cd76e66dec9be1ed3b3f09da8aa451cbe660a478b15bffddf8afbb2ef47e682db5b07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
867B

MD5
8669faae3389e8e3bacdec684bca8fb4

SHA1
8dbfaeda4832ea3a0152ef8e9714032abeb285a4

SHA256
4857d5cb75be48dcc877dbda462cf63d53983b9f5e3efa4fb22bfab488f5ddf4

SHA512
eb48854a23b8353ecb93662bc24917aa63217c7a68d0ed448a04edffd29568e1233516531ce68185097c1648df494d9fde7a3eeaea32b4a43a5002ba8f02b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7bda3318066a1856c31d7e6a8e6ff36a

SHA1
149354bf4568172f303e61b178db568eb0a974f0

SHA256
615d3db984df5dfbdfb621b5185412037ddb4e886fa1b900e9136db18be47ce3

SHA512
477c69977f801d3d7cad3c7669e14055b68208355808dcf645c3826cf81ef89292659b966b6b2eb4da167e709d6916b1d182d33654b0b533a7cbba214d49faff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cdbd06f11499d88cad124abc777b863c

SHA1
5809a23dcf816ebf216b1cbb66af6b1da5ac40ca

SHA256
7f58adb4d32a9a99258ba78e02e8969b69fae1805032f69c3194e8605d9dd469

SHA512
2ac77d129ec0de078a3ca5463bf0e790da464425d61826ff9d43fd95cd531f80496dd87e72074fd7dba9490bbe81c2f34a95ce443060e1cc7bd5be036bb684c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a4b135abb3b714c8096531aa2a1e35fe

SHA1
9ccf1cf2c4f29ebd40741ca45986a5dba7614d8d

SHA256
7033da183dd3042b78bd25449ae3f06f73eb3eb6b1466346dd2259cf22880aa4

SHA512
8b89519b1dc7cb37e3e87a6aafd4186fe6349ff1e5e3a677c28cb4749822e681d9966a52a33486eb571427155fa685f9adfc34d2442b04c20fc858b619091c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1238d2303f0239c261a03512e3d2d5a5

SHA1
b87cfda61c93601f889bac6864a4e7ec223150db

SHA256
b980cda794f9194408fecab4fddd739eb17f99a34cf9467b15b7020d8b08d51e

SHA512
4df4207e4b818ae55edc70cd931ac560c4b5e1e13dfff710bb09c64824d89e9e527a817118d966f5b7d84cd5f64be7eda2af0a9d94b7f3cade4375d02e97099d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI15764\DsHidMini.Installer.exe

Filesize
78KB

MD5
0f009c3f82b93d466a9394fb9f39d9df

SHA1
c1b87e0d95ed87ecd2cb4fa099f359d4c2182be1

SHA256
8b59fbee97b5d1e38911b7f13104d3f174976b6a68330457073410694f2aea98

SHA512
1efdfdd9f2fd55a4b58af88f264fec08c08b5bf2df885a4d98918ac0f42c0d3bd82ba6b2e5612663d03355136a440ab858acfece85e7327bf3e0a7baa692ca5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI15764\EmbeddedUI.config

Filesize
593B

MD5
88e7367e86635960eb31431438d7b5d5

SHA1
c0ba8113584bc664da7a9106d99b378821e6db2f

SHA256
72c8b8e5df0fda9af57c79e355e1c8a3fd192c0090094a1d08820a07edbf442a

SHA512
4975a97f130377348eb3c92bf9e4f735ddb458bb5e64bd6ab0b40df88a900a894ae7c2e7d72d569c49b365ef4ed330a1ae9cb6be73502eb71cf27ccf46d5982d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI15764\WixSharp.UI.CA.dll

Filesize
4.4MB

MD5
af959255fe0bc50b7376ac1a500bdd1f

SHA1
3e028b8ec66bd76ad11d46ce099c5ba4d4040be2

SHA256
41e42bdaca5ce7d1e95a9feee354e30b84b92b00ea850571ecc97b1e382441a8

SHA512
13953ec892942bae7fd18f745e46161cadb508aab5f6d4a75d299809db43dfaeba6f16f3f889b8350cf90282063c38c1c01bad4f2507e224ff4ee18cc01ca425

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI15764\WixSharp.UI.WPF.dll

Filesize
77KB

MD5
99c6a5a9c0ea244dbdba20959ed9bce3

SHA1
45d7c33ce32929293975c9d7fcd2bb81e1159af2

SHA256
01ad61f06b11151f3d40772d2fed23c8feaa9c8e94aa30485d7563546543c615

SHA512
22e5843ec2763024c9986feb68737a536e78f845b4ec2454d6c56e76a2a6d311787b1bd8a26f3b17605dc262a5c7c838d5f85e8308ddaa16a350e2d723b3a338

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI15764\WixSharp.UI.dll

Filesize
671KB

MD5
e7b6ae8436560af201c68b2e9f702a0a

SHA1
c6c49f6a12a9111b848ff94bd4b82fc405f24bce

SHA256
0b4d3db2b56a640d2effcd16fe0ee15d82d94eef3487105e659b2969ff099a21

SHA512
fa6321151af071be66e33ca6a084b8c075a5d1d7188edcd09ab1c100a2e969204355c1b78eefb8adcec3017ea2085b128106596c66b706da153b5f4b855dca44

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI15764\WixSharp.dll

Filesize
651KB

MD5
66550a02ac05492b177a7b88b3ed3890

SHA1
4ef96ee06246c7540dcc55c0aa53e598feeca348

SHA256
0c45486156c43d25daaf06c4b5f71b00b59fb04eca5582126481a3ef8a189df1

SHA512
675a99325393bbb6221c01e8bd347f0ca01cd565bd16832712ba01395e6d704691dac6d3f7a42e73bdf109ae935d34226621e1bc998db7d1dca69b7cfc59a268

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI15764\WixToolset.Dtf.WindowsInstaller.dll

Filesize
193KB

MD5
b82b13d16e7f3d3607026f61b7295224

SHA1
d17b76907ea442b6cc5a79361a8fcec91075e20d

SHA256
bcc548e72b190d8f39dcb19538444e2576617a21caba6adcb4116511e1d2ddee

SHA512
be8c0b8b585fc77693e7481ca5d3f57a8b213c1190782fd4700676af9c0b671523c1a4fa58f15947a14c1ff6d4cda65d7353c6ba848a3a247dfcda864869e93f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI15764\WixToolset.Mba.Core.dll

Filesize
165KB

MD5
1e43e0952b5cc4c73245acad8114ee63

SHA1
c2b3b179555ba569ebfd9ddabd776d3151ea114e

SHA256
e9002b2aa130d682df9242c479e20ac54b7a9b00c11ed75738ec9b12648a78e8

SHA512
2e283305c038e36d4c9b0db00f20df88624b51dd7345f43eb992fd1671ce67c9a63067445ed90d88ff6276a608f2ea2ef8bfe7c0bda5e1043786df024a71b7ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI15980\WixSharp.UI.dll

Filesize
671KB

MD5
19769632e246c6726bf03ab45027609d

SHA1
7adfa73ab64dd505a5e77df526eca75a6ecccd03

SHA256
65d3f4b95caaa2b24388ffd04533ae2699ebb28fc20487f805fd3149cbb126a1

SHA512
9f504686f0fa9ea79a6a5b2f76ebe4d8047ca27f23912630504d262a4fe105120ee9a1e64e42938de482402bd309b5ff643f5a4998489f1b745555a90a57d13c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 921199.crdownload

Filesize
13.7MB

MD5
12b4ec82231647228f63feab9d5e404f

SHA1
21442a1d4e59707a8decb60e724dffac337f0408

SHA256
8d1e0df0b171506af3b0db913f53a696a17505b181a68dbaea46f9b606fdf3a1

SHA512
b14073fafba99792e71402bf3d91cf491cb413647550d23ec0b0deeae652bac7ec9501551f2ce9d330d78555f2742773624a3e289d2067a48379cffc22780670

Download Submit
C:\Windows\Installer\MSIDBE9.tmp

Filesize
4.4MB

MD5
fcf5a28268fa4647dd5d0213dd24b154

SHA1
373010ad918ff5933cedcda0e08e4c0df465abec

SHA256
d0dc14516779d8fcc7837de8902c02eb989e86b8455d98d0f774b95994f661f1

SHA512
dd255dc42d24f7aced66b603573ff19e79f11a67adcf762dd0d2906e3a191c973e2320f6d02449904b9383215d406ae49e62380c8b58671452e7c6cb48c9ee17

Download Submit
C:\Windows\Installer\MSIE67A.tmp

Filesize
4.4MB

MD5
3e526c3ef05d7f99927a6c6d399a1328

SHA1
3db87e2745f6820c2d286036da2e6b6d3d8481ac

SHA256
4f9f98aa99621851922a477c1ed7c30e73c388e4eb7014b576b96a442bd467d8

SHA512
838c5ce48e06f35008f28eca441c379e2ce57599cfffdd826673fe8c55da5e0d9455fe774ab284e5e3ec31ba3117985d44c2d8f6b0bdf15de79cbd21361f4966

Download Submit
C:\Windows\Installer\SFXCA470961D2BE4999AA4F1B29373F616CCC\BthPS3Installer.exe

Filesize
28KB

MD5
88f2570206ea78eb6d0c62068b8ab208

SHA1
f407298207a4cad6343371ea6bc4ce26f6102737

SHA256
95e88ab1ecea4d118ce3673f9979333ac202235e0ca742375bed5f9f973962ee

SHA512
4a6763c33ab1150cd607f18e0ce1a340ed315dd8292763a4b95c166f958016ff17acfd03b3174bd8dbdf36ed94d98eb6d4633aac76bf5e7194a1b3300ff7228c

Download Submit
C:\Windows\Installer\SFXCA470961D2BE4999AA4F1B29373F616CCC\Nefarius.Utilities.Bluetooth.dll

Filesize
240KB

MD5
0203aeb6181d4932ed1fd6e54de6a1ba

SHA1
2d2c266c581af98dd04a19214b40f197cec99122

SHA256
6374049b24c55770e7d7aa5a2ee9dbddfeff26681f239e173811a26bdc65c28d

SHA512
a1b472c29a1fdbb33a9de02db8761212a5aef8612051dd42595ffbebfd4f50bea583e42a9faf0053c4a179a96f36ff70b80c531e5be39408762b2c61f8416b6c

Download Submit
C:\Windows\Installer\SFXCA470961D2BE4999AA4F1B29373F616CCC\Nefarius.Utilities.DeviceManagement.dll

Filesize
316KB

MD5
3bf5d50a5e8bdc8e32cc6a99905e86d9

SHA1
3e4d8b3eff83e4462cd81e82ebdfab12d3080a6d

SHA256
5576cadde358a0c49af1077f1a0ae28de28fdc5efabb7c7c810a9e8e308d8398

SHA512
7a39ca50cca3590b23a305ed216ded553d7d2f30962cb87c5c1684fe2f3ad351675d236cc7b96cbdc9c2e5e4b67929ca9b393111865c7d4ef94f4ba955381450

Download Submit
C:\Windows\Installer\SFXCA7A1339136E473FAA64E0B6F6232C5512\CliWrap.dll

Filesize
196KB

MD5
3fa33fe88ee3652962f1cf9621a5147b

SHA1
06c206a4ee8b5dcba77bed9e6ef626161ec76762

SHA256
f430bb1244e18a26b9eeeb0e51cd2cb6747feb52236593bfb8085004fae7d049

SHA512
730b80c1bf56e96b65b7e2d2363fad27a58bf8e1ce49831b64e533c5b7644cedfd09284d0fd270d3d34865ea895f52f095e0423a81a0b6162f942a070f7fa10a

Download Submit
C:\Windows\Installer\SFXCA7A1339136E473FAA64E0B6F6232C5512\Microsoft.Bcl.AsyncInterfaces.dll

Filesize
26KB

MD5
ff34978b62d5e0be84a895d9c30f99ae

SHA1
74dc07a8cccee0ca3bf5cf64320230ca1a37ad85

SHA256
80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc

SHA512
7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28

Download Submit
C:\Windows\Installer\SFXCA7A1339136E473FAA64E0B6F6232C5512\Nefarius.Utilities.DeviceManagement.dll

Filesize
288KB

MD5
21a0ec9951f062973f0e6958239e7156

SHA1
f4030df5ffe8163d967fb39eccfcf67ae95a0a7f

SHA256
9b67ff59603a2063cb22cb5d72248cf329721e708e98b5ee01464a56e5b37b66

SHA512
fb5e9f67fc94dc9721917543b3f2f5ccb920a2b24b5fb41db9e27dc83136c215e9a24edfeefb726cb80f0be330837ef40b107f565a3358ad5cb30fe4e7a0d191

Download Submit
C:\Windows\Installer\SFXCA7A1339136E473FAA64E0B6F6232C5512\Nefarius.Utilities.WixSharp.dll

Filesize
7KB

MD5
8e3052b9606929d18a87a734e9f733f5

SHA1
687d29585fe314892d283d9fe2a48eb29e4c028b

SHA256
65488d7ddd7d2b443fd3594df4bd34875523ee517a8894d391cdde2ba14d918e

SHA512
3017ba186aba85af758f1e74bb908623829d4b5f94628121ce843c32f7d73ac7705a26731d9501b7ba0ea3195d4cc28fc74d70970d08a2fc1179553b28d720f5

Download Submit
C:\Windows\Installer\SFXCA7A1339136E473FAA64E0B6F6232C5512\System.Buffers.dll

Filesize
20KB

MD5
ecdfe8ede869d2ccc6bf99981ea96400

SHA1
2f410a0396bc148ed533ad49b6415fb58dd4d641

SHA256
accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb

SHA512
5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741

Download Submit
C:\Windows\Installer\SFXCA7A1339136E473FAA64E0B6F6232C5512\System.Memory.dll

Filesize
138KB

MD5
f09441a1ee47fb3e6571a3a448e05baf

SHA1
3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde

SHA256
bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f

SHA512
0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6

Download Submit
C:\Windows\Installer\SFXCA7A1339136E473FAA64E0B6F6232C5512\System.Runtime.CompilerServices.Unsafe.dll

Filesize
17KB

MD5
c610e828b54001574d86dd2ed730e392

SHA1
180a7baafbc820a838bbaca434032d9d33cceebe

SHA256
37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf

SHA512
441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396

Download Submit
C:\Windows\Installer\SFXCA7A1339136E473FAA64E0B6F6232C5512\System.Threading.Tasks.Extensions.dll

Filesize
25KB

MD5
e1e9d7d46e5cd9525c5927dc98d9ecc7

SHA1
2242627282f9e07e37b274ea36fac2d3cd9c9110

SHA256
4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6

SHA512
da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11

Download Submit
C:\Windows\Installer\SFXCA8643AAE27D4317EA55C8828709BA20E9\DsHidMini.Installer.pdb

Filesize
42KB

MD5
4c43332373b14738770925072c9d0fea

SHA1
3702399312e1fbbb9fa0fe6ab6e61f8a41373202

SHA256
38593b258a6e1ca81b68052d9664a0950fb3dd0d50000c0a7b3459fe3d13ad46

SHA512
01b884134d5245949866e7f68c06db927b8a8a011770e3ad52cb349ab16587dd65c99d04d47605d737589827e0497460afee48e7c287c14328c4cde3ee78e380

Download Submit
C:\Windows\Installer\SFXCA8D949C0AF7456E3AEFD850EC3BA64703\WixSharp.dll

Filesize
653KB

MD5
ca64e60b4874854ff33bf6ce8619cebb

SHA1
1e6482398589998d9dd00c701ef80bc6891e4425

SHA256
521b0fd93a12783fb8b460e91be8ee1612a9a9767474aad4bcb150b097b1998f

SHA512
61d691512fcfa681e48a20ab74a8df59b6dd511db47f5ef0691c597afb6800b70d2a6637fd808d4a9791bc71d7eaf0f46426ca10b836349a16d4c4e06014b910

Download Submit
C:\Windows\Installer\SFXCABE50615B274318CA1D428805603640F6\CommonLanguageRuntimeLibrary

Filesize
5.2MB

MD5
50bcc296471dabd5892bd9106de4414d

SHA1
1fafe0cf2c7acb7b6eace56d97f62c5a0b2820c6

SHA256
d6578bec8382baa60ee2a8f729a095e25c4d3043cf3bc7dda9469d6e46c649ef

SHA512
0f733ac048ba8c9b759acee59f9791c235bb4abc1c9ac3e72b207744f0f43cf50ae750234d8ee936a2668689f00f182ed600f96ed4179a0fb79b2009626e22bc

Download Submit
C:\Windows\Installer\SFXCABE50615B274318CA1D428805603640F6\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Windows\Installer\SFXCABE50615B274318CA1D428805603640F6\System.dll

Filesize
3.4MB

MD5
3b16d7926849a5d81f0cc81cdcb9d0dc

SHA1
0f9837cd0f75b34179551d5220295bc504225c82

SHA256
625afaaeda91cf8a838be15e9c6e9e650076b41b0eeb13a3de4f2e8045f09130

SHA512
f2c2217b1dc1bea4c7c3f225caca6f493af1cc354ab664cedf1521e6f74ade602d8051bdd728c5e0e8a0ffd0e40ec3381e8583705eee482e9a8a38bb5f59e43a

Download Submit
C:\Windows\Installer\e57dafe.msi

Filesize
17.2MB

MD5
a86c0cb5c3f36cbc15f2589a0ab0b08f

SHA1
2f47ec4cd9bca1ee7add56a96cc16ec00a9e1928

SHA256
77295683e2ba57adf91afc54701c46f06a7a847f3621b15f2acfa7ea914fcf26

SHA512
57316d2f849dd0d140e26a2ce2b59a554cdecb90c3885b3f299469eca6390ecc4c74637137146ba5a0670da25d3af4651a190d7ac9c2ca0ace56dbe0ea9087b2

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
107KB

MD5
769c89d0e1d96187adcce83638df7ef3

SHA1
0cd7e5cdffec052f028c7ff017666d7aca27b804

SHA256
a5722c4c99754081d848e60fe6ab8c407258bd383b9ec261d1c6c8687d32e9f5

SHA512
c33566a3e7afec5a06fcf472888a64731140805021e46af4a19bb295ba01d9468ee4c9e7043b6df2cd5eb727c646a04a0fd66b0494522c557f4236489e73bff8

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
11a97e3dba741c9e4a6a76cbd0ca99ae

SHA1
c134e843d3f8dc2ee3b7b40a0bbc2aa3c79abf9b

SHA256
245c68b89ff776d5fd7cd452e1eab2fa1ed822b374420f55eaa6d77d21923fcf

SHA512
5f4bb9a934eb3a05a155509080c1f768cf3133de948b648895560a92a34773c3559ef43c6c6f71c6a0b2e727607429723f2236746372e9bc380a91f39d62eb7b

Download Submit
\??\Volume{50662fab-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{26aa398a-ce2e-413d-9e83-f818ae1fb002}_OnDiskSnapshotProp

Filesize
6KB

MD5
2770c00cf9c77d73c21a7bd2d4071ac0

SHA1
c2d6bf8539a852ed498d66031e83b9b89b395e2d

SHA256
3ce1574c2c8205f120d622da18052f966eb98ea5a132cfa88f1f7e375b8c1355

SHA512
d4e947a07d9dc181cde6f59069a46ea1e938d6cb37840ace29daa4a232bf8900596c371dbf06397f04aa032a5e016bc09a95434e2e54befb8c4720f0f0766edc

Download Submit
memory/652-213-0x00007FFC9FB50000-0x00007FFC9FB60000-memory.dmp

Filesize
64KB

Download
memory/1264-116-0x000001B4495E0000-0x000001B44968A000-memory.dmp

Filesize
680KB

Download
memory/1264-114-0x000001B4305F0000-0x000001B430624000-memory.dmp

Filesize
208KB

Download
memory/1408-410-0x00000291BA9C0000-0x00000291BA9DA000-memory.dmp

Filesize
104KB

Download
memory/1956-932-0x0000014844280000-0x000001484432A000-memory.dmp

Filesize
680KB

Download
memory/2080-980-0x0000015B1D520000-0x0000015B1D52E000-memory.dmp

Filesize
56KB

Download
memory/2080-982-0x0000015B36770000-0x0000015B367B2000-memory.dmp

Filesize
264KB

Download
memory/2080-984-0x0000015B368E0000-0x0000015B36936000-memory.dmp

Filesize
344KB

Download
memory/2832-634-0x00007FF696600000-0x00007FF696AA8000-memory.dmp

Filesize
4.7MB

Download
memory/2832-629-0x00007FF696600000-0x00007FF696AA8000-memory.dmp

Filesize
4.7MB

Download
memory/3192-528-0x000002F577EA0000-0x000002F577F52000-memory.dmp

Filesize
712KB

Download
memory/3192-532-0x000002F5771C0000-0x000002F5771E2000-memory.dmp

Filesize
136KB

Download
memory/4052-892-0x0000000004CF0000-0x0000000004D9A000-memory.dmp

Filesize
680KB

Download
memory/4052-890-0x0000000004C40000-0x0000000004CEE000-memory.dmp

Filesize
696KB

Download
memory/4152-59-0x0000000005140000-0x00000000056E6000-memory.dmp

Filesize
5.6MB

Download
memory/4152-60-0x0000000004D30000-0x0000000004DC2000-memory.dmp

Filesize
584KB

Download
memory/4152-34-0x0000000073B3E000-0x0000000073B3F000-memory.dmp

Filesize
4KB

Download
memory/4152-74-0x0000000073B3E000-0x0000000073B3F000-memory.dmp

Filesize
4KB

Download
memory/4152-73-0x0000000009480000-0x00000000094AC000-memory.dmp

Filesize
176KB

Download
memory/4152-39-0x00000000027C0000-0x00000000027F4000-memory.dmp

Filesize
208KB

Download
memory/4152-43-0x00000000048E0000-0x000000000498E000-memory.dmp

Filesize
696KB

Download
memory/4152-69-0x0000000008E40000-0x0000000008E4E000-memory.dmp

Filesize
56KB

Download
memory/4152-68-0x0000000008E60000-0x0000000008E98000-memory.dmp

Filesize
224KB

Download
memory/4152-67-0x00000000067A0000-0x00000000067A8000-memory.dmp

Filesize
32KB

Download
memory/4152-66-0x0000000006790000-0x0000000006798000-memory.dmp

Filesize
32KB

Download
memory/4152-64-0x0000000006770000-0x000000000678C000-memory.dmp

Filesize
112KB

Download
memory/4152-62-0x0000000004B30000-0x0000000004B3A000-memory.dmp

Filesize
40KB

Download
memory/4152-47-0x00000000049C0000-0x0000000004A6A000-memory.dmp

Filesize
680KB

Download
memory/4152-51-0x0000000004850000-0x000000000486A000-memory.dmp

Filesize
104KB

Download
memory/4152-55-0x0000000004870000-0x000000000488A000-memory.dmp

Filesize
104KB

Download
memory/4684-200-0x0000026B7E890000-0x0000026B7E8DE000-memory.dmp

Filesize
312KB

Download
memory/4684-203-0x0000026B7DD40000-0x0000026B7DD4A000-memory.dmp

Filesize
40KB

Download
memory/4684-201-0x0000026B7DD30000-0x0000026B7DD38000-memory.dmp

Filesize
32KB

Download
memory/4684-209-0x0000026B7E910000-0x0000026B7E918000-memory.dmp

Filesize
32KB

Download
memory/4684-207-0x0000026B7DDB0000-0x0000026B7DDBA000-memory.dmp

Filesize
40KB

Download
memory/4684-215-0x0000026B7E8E0000-0x0000026B7E906000-memory.dmp

Filesize
152KB

Download
memory/4684-217-0x0000026B7DDC0000-0x0000026B7DDCA000-memory.dmp

Filesize
40KB

Download
memory/4684-192-0x0000026B657A0000-0x0000026B657BA000-memory.dmp

Filesize
104KB

Download
memory/4684-198-0x0000026B657F0000-0x0000026B6580A000-memory.dmp

Filesize
104KB

Download
memory/4684-197-0x0000026B65790000-0x0000026B65798000-memory.dmp

Filesize
32KB

Download
memory/4684-194-0x0000026B7DD70000-0x0000026B7DDA8000-memory.dmp

Filesize
224KB

Download