77295683e2ba57adf91afc54701c46f06a7a847f3621b15f2acfa7ea914fcf26

Analysis

user interaction
yes
max time kernel
50s
max time network
88s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nefarius_DsHidMini_Drivers_x64_arm64_v3.5.1.msi
Size 17.2MB
Sample260702-vs4l3aaw4y
SHA256 77295683e2ba57adf91afc54701c46f06a7a847f3621b15f2acfa7ea914fcf26
MD5 a86c0cb5c3f36cbc15f2589a0ab0b08f
SHA1 2f47ec4cd9bca1ee7add56a96cc16ec00a9e1928
SHA512 57316d2f849dd0d140e26a2ce2b59a554cdecb90c3885b3f299469eca6390ecc4c74637137146ba5a0670da25d3af4651a190d7ac9c2ca0ace56dbe0ea9087b2
SSDEEP 393216:cQPyqsHIqm1mJR4MjqESRhJKz9//f13N1Ds+:cQPxkIzs5qECP2Frs
TLSH
T1B2073306B7E5043AEC6B5130BE9F47148736BD640731C6EF66403229AE3B7D28A7B725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation ransomware upx

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1000	msiexec.exe
8	1964	rundll32.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\nssmkig.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\nssmkig.sys	DrvInst.exe

Executes dropped EXE 3 IoCs

pid	Process
1608	nefconc.exe
2288	nefarius_DsHidMini_Updater.exe
1096	nefarius_DsHidMini_Updater.exe

Loads dropped DLL 25 IoCs

pid	Process
3600	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe
5812	MsiExec.exe
2540	rundll32.exe
4720	MsiExec.exe
3336	rundll32.exe
4720	MsiExec.exe
4932	rundll32.exe
4720	MsiExec.exe
124	rundll32.exe
5812	MsiExec.exe
1964	rundll32.exe
5812	MsiExec.exe
2472	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	nefconc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Windows\CurrentVersion\Run\nefarius_DsHidMini_Updater = "\"C:\\Program Files\\Nefarius Software Solutions\\DsHidMini\\nefarius_DsHidMini_Updater.exe\" --autostart"	nefarius_DsHidMini_Updater.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{19568533-683e-224a-b592-174827c9283c}\SETA9A5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{19568533-683e-224a-b592-174827c9283c}\SETA9A6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a45c5ff4-bba3-6046-acfb-37d1ec4b892a}\SETADEC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dshidmini.inf_amd64_68109700ac2a2fb6\dshidmini.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{19568533-683e-224a-b592-174827c9283c}\SETA9A5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\igfilter.inf_amd64_1792e75f46f37352\igfilter.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{19568533-683e-224a-b592-174827c9283c}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\igfilter.inf_amd64_1792e75f46f37352\nssmkig.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a45c5ff4-bba3-6046-acfb-37d1ec4b892a}\SETADEB.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{19568533-683e-224a-b592-174827c9283c}\SETA994.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\igfilter.inf_amd64_1792e75f46f37352\igfilter.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dshidmini.inf_amd64_68109700ac2a2fb6\dshidmini.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{19568533-683e-224a-b592-174827c9283c}\SETA994.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{19568533-683e-224a-b592-174827c9283c}\SETA9A6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\igfilter.inf_amd64_1792e75f46f37352\nssmkig.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a45c5ff4-bba3-6046-acfb-37d1ec4b892a}\dshidmini.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{19568533-683e-224a-b592-174827c9283c}\igfilter.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a45c5ff4-bba3-6046-acfb-37d1ec4b892a}\dshidmini.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dshidmini.inf_amd64_68109700ac2a2fb6.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a45c5ff4-bba3-6046-acfb-37d1ec4b892a}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{19568533-683e-224a-b592-174827c9283c}\nssmkig.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{19568533-683e-224a-b592-174827c9283c}\igfilter.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\igfilter.inf_amd64_1792e75f46f37352.ini	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a45c5ff4-bba3-6046-acfb-37d1ec4b892a}\SETADEC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dshidmini.inf_amd64_68109700ac2a2fb6\dshidmini.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a45c5ff4-bba3-6046-acfb-37d1ec4b892a}\SETADDA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a45c5ff4-bba3-6046-acfb-37d1ec4b892a}\dshidmini.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a45c5ff4-bba3-6046-acfb-37d1ec4b892a}\SETADDA.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a45c5ff4-bba3-6046-acfb-37d1ec4b892a}\SETADEB.tmp	DrvInst.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c66d-414.dat	upx
behavioral2/memory/2288-415-0x00007FF6268C0000-0x00007FF626D68000-memory.dmp	upx
behavioral2/memory/2288-424-0x00007FF6268C0000-0x00007FF626D68000-memory.dmp	upx
behavioral2/memory/1096-489-0x00007FF6268C0000-0x00007FF626D68000-memory.dmp	upx
behavioral2/memory/4448-697-0x00007FF6268C0000-0x00007FF626D68000-memory.dmp	upx
behavioral2/memory/4448-729-0x00007FF6268C0000-0x00007FF626D68000-memory.dmp	upx

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_ARM64\igfilter.cat	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_ARM64\igfilter.inf	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_x64\igfilter.inf	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_ARM64\LICENSE	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_ARM64\dshidmini.cat	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_ARM64\dshidmini.inf	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_x64\LICENSE	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_x64\nssmkig.pdb	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_ARM64\nssmkig.pdb	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_x64\nssmkig.sys	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe:updater.dll	nefarius_DsHidMini_Updater.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_ARM64\dshidmini.dll	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_x64\dshidmini.inf	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_ARM64\LICENSE	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_ARM64\nssmkig.sys	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_x64\LICENSE	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_x64\igfilter.cat	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\nefcon\ARM64\nefconc.exe	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\nefcon\x64\nefconc.exe	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_x64\dshidmini.cat	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_x64\dshidmini.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\SFXCA2DEA1194FE4B549BAD14FE81A962E349\WixToolset.Mba.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9E99.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA827B077D034F1A383F3E531E05555A76\System.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA1793CECCC744A11991EB3DD5E856A8DE\Nefarius.Utilities.DeviceManagement.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA1793CECCC744A11991EB3DD5E856A8DE\WixSharp.UI.WPF.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA3BD70D452C43188B4DBBA3FF1041DFB2\System.Threading.Tasks.Extensions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA56B29144C94BFB896D03C0E46BFC8A44\Nefarius.Utilities.DeviceManagement.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\Microsoft.Bcl.AsyncInterfaces.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA827B077D034F1A383F3E531E05555A76\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA1793CECCC744A11991EB3DD5E856A8DE\WixToolset.Mba.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA56B29144C94BFB896D03C0E46BFC8A44\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA56B29144C94BFB896D03C0E46BFC8A44\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\CliWrap.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	nefconc.exe
File opened for modification	C:\Windows\Installer\MSIB0AC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA56B29144C94BFB896D03C0E46BFC8A44\Nefarius.Utilities.WixSharp.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF9AC3482C4056B922.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA3BD70D452C43188B4DBBA3FF1041DFB2\System.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA56B29144C94BFB896D03C0E46BFC8A44\System.Memory.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\SFXCA2DEA1194FE4B549BAD14FE81A962E349\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\System.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\System.Threading.Tasks.Extensions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA827B077D034F1A383F3E531E05555A76\WixToolset.Mba.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA1793CECCC744A11991EB3DD5E856A8DE\CliWrap.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA1793CECCC744A11991EB3DD5E856A8DE\DsHidMini.Installer.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA1793CECCC744A11991EB3DD5E856A8DE\Nefarius.Utilities.WixSharp.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFC61E600D0B97237B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\Newtonsoft.Json.dll	rundll32.exe
File created	C:\Windows\Installer\{25784100-B9AA-4205-8D54-CA53A1CF8AC5}\app_icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA56B29144C94BFB896D03C0E46BFC8A44\System.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA56B29144C94BFB896D03C0E46BFC8A44\CommonLanguageRuntimeLibrary	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA1793CECCC744A11991EB3DD5E856A8DE\System.Runtime.CompilerServices.Unsafe.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA3BD70D452C43188B4DBBA3FF1041DFB2\System.Memory.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA1793CECCC744A11991EB3DD5E856A8DE\System.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA56B29144C94BFB896D03C0E46BFC8A44\DsHidMini.Installer.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA827B077D034F1A383F3E531E05555A76\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA827B077D034F1A383F3E531E05555A76\WixSharp.UI.WPF.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA1793CECCC744A11991EB3DD5E856A8DE\System.Memory.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA56B29144C94BFB896D03C0E46BFC8A44\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI92D0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA2DEA1194FE4B549BAD14FE81A962E349\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\{25784100-B9AA-4205-8D54-CA53A1CF8AC5}\app_icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA56B29144C94BFB896D03C0E46BFC8A44\System.Runtime.CompilerServices.Unsafe.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA2DEA1194FE4B549BAD14FE81A962E349\System.Threading.Tasks.Extensions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA2DEA1194FE4B549BAD14FE81A962E349\WixSharp.UI.WPF.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA827B077D034F1A383F3E531E05555A76\DsHidMini.Installer.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA1793CECCC744A11991EB3DD5E856A8DE\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA2DEA1194FE4B549BAD14FE81A962E349\System.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\WixToolset.Mba.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA827B077D034F1A383F3E531E05555A76\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA3BD70D452C43188B4DBBA3FF1041DFB2\System.Runtime.CompilerServices.Unsafe.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA56B29144C94BFB896D03C0E46BFC8A44\Microsoft.Bcl.AsyncInterfaces.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA2DEA1194FE4B549BAD14FE81A962E349\Nefarius.Utilities.DeviceManagement.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA827B077D034F1A383F3E531E05555A76\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA3BD70D452C43188B4DBBA3FF1041DFB2\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA3BD70D452C43188B4DBBA3FF1041DFB2\CommonLanguageRuntimeLibrary	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA2DEA1194FE4B549BAD14FE81A962E349\Nefarius.Utilities.WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA33D.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1000	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1896	msedge.exe

Checks SCSI registry key(s) 3 TTPs 53 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000730b2d3be93fb2c00000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801730b2d3b0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101730b2d3b000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3730b2d3b00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6730b2d3b00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	rundll32.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\GrpConv	grpconv.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00148752AA9B5024D845AC351AFCA85C\BthPS3Feature = "DsHidMini20Drivers"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\PackageCode = "4BEFFFC12ACECA5479C5790EB564F909"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\00148752AA9B5024D845AC3517F7A65C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\00148752AA9B5024D845AC3517F7A65C\00148752AA9B5024D845AC351AFCA85C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\Version = "50659329"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\SourceList\PackageName = "Nefarius_DsHidMini_Drivers_x64_arm64_v3.5.1.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00148752AA9B5024D845AC351AFCA85C\DsHidMini20Drivers	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\ProductName = "Nefarius DsHidMini Driver"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\ProductIcon = "C:\\Windows\\Installer\\{25784100-B9AA-4205-8D54-CA53A1CF8AC5}\\app_icon.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00148752AA9B5024D845AC351AFCA85C\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00148752AA9B5024D845AC351AFCA85C	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe:updater.dll	nefarius_DsHidMini_Updater.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5472	msiexec.exe
5472	msiexec.exe
2288	nefarius_DsHidMini_Updater.exe
2288	nefarius_DsHidMini_Updater.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1000	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1000	msiexec.exe
Token: SeSecurityPrivilege	5472	msiexec.exe
Token: SeCreateTokenPrivilege	1000	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1000	msiexec.exe
Token: SeLockMemoryPrivilege	1000	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1000	msiexec.exe
Token: SeMachineAccountPrivilege	1000	msiexec.exe
Token: SeTcbPrivilege	1000	msiexec.exe
Token: SeSecurityPrivilege	1000	msiexec.exe
Token: SeTakeOwnershipPrivilege	1000	msiexec.exe
Token: SeLoadDriverPrivilege	1000	msiexec.exe
Token: SeSystemProfilePrivilege	1000	msiexec.exe
Token: SeSystemtimePrivilege	1000	msiexec.exe
Token: SeProfSingleProcessPrivilege	1000	msiexec.exe
Token: SeIncBasePriorityPrivilege	1000	msiexec.exe
Token: SeCreatePagefilePrivilege	1000	msiexec.exe
Token: SeCreatePermanentPrivilege	1000	msiexec.exe
Token: SeBackupPrivilege	1000	msiexec.exe
Token: SeRestorePrivilege	1000	msiexec.exe
Token: SeShutdownPrivilege	1000	msiexec.exe
Token: SeDebugPrivilege	1000	msiexec.exe
Token: SeAuditPrivilege	1000	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1000	msiexec.exe
Token: SeChangeNotifyPrivilege	1000	msiexec.exe
Token: SeRemoteShutdownPrivilege	1000	msiexec.exe
Token: SeUndockPrivilege	1000	msiexec.exe
Token: SeSyncAgentPrivilege	1000	msiexec.exe
Token: SeEnableDelegationPrivilege	1000	msiexec.exe
Token: SeManageVolumePrivilege	1000	msiexec.exe
Token: SeImpersonatePrivilege	1000	msiexec.exe
Token: SeCreateGlobalPrivilege	1000	msiexec.exe
Token: SeCreateTokenPrivilege	1000	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1000	msiexec.exe
Token: SeLockMemoryPrivilege	1000	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1000	msiexec.exe
Token: SeMachineAccountPrivilege	1000	msiexec.exe
Token: SeTcbPrivilege	1000	msiexec.exe
Token: SeSecurityPrivilege	1000	msiexec.exe
Token: SeTakeOwnershipPrivilege	1000	msiexec.exe
Token: SeLoadDriverPrivilege	1000	msiexec.exe
Token: SeSystemProfilePrivilege	1000	msiexec.exe
Token: SeSystemtimePrivilege	1000	msiexec.exe
Token: SeProfSingleProcessPrivilege	1000	msiexec.exe
Token: SeIncBasePriorityPrivilege	1000	msiexec.exe
Token: SeCreatePagefilePrivilege	1000	msiexec.exe
Token: SeCreatePermanentPrivilege	1000	msiexec.exe
Token: SeBackupPrivilege	1000	msiexec.exe
Token: SeRestorePrivilege	1000	msiexec.exe
Token: SeShutdownPrivilege	1000	msiexec.exe
Token: SeDebugPrivilege	1000	msiexec.exe
Token: SeAuditPrivilege	1000	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1000	msiexec.exe
Token: SeChangeNotifyPrivilege	1000	msiexec.exe
Token: SeRemoteShutdownPrivilege	1000	msiexec.exe
Token: SeUndockPrivilege	1000	msiexec.exe
Token: SeSyncAgentPrivilege	1000	msiexec.exe
Token: SeEnableDelegationPrivilege	1000	msiexec.exe
Token: SeManageVolumePrivilege	1000	msiexec.exe
Token: SeImpersonatePrivilege	1000	msiexec.exe
Token: SeCreateGlobalPrivilege	1000	msiexec.exe
Token: SeCreateTokenPrivilege	1000	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1000	msiexec.exe
Token: SeLockMemoryPrivilege	1000	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1000	msiexec.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1000	msiexec.exe
5472	msiexec.exe
3600	MsiExec.exe
5812	MsiExec.exe
4720	MsiExec.exe
4396	explorer.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 5472 wrote to memory of 3600	5472	msiexec.exe	89
PID 5472 wrote to memory of 5776	5472	msiexec.exe	95
PID 5472 wrote to memory of 5812	5472	msiexec.exe	97
PID 5812 wrote to memory of 2540	5812	MsiExec.exe	98
PID 5472 wrote to memory of 4720	5472	msiexec.exe	99
PID 4720 wrote to memory of 3336	4720	MsiExec.exe	100
PID 3336 wrote to memory of 1608	3336	rundll32.exe	101
PID 1608 wrote to memory of 2596	1608	nefconc.exe	105
PID 2596 wrote to memory of 948	2596	runonce.exe	106
PID 4720 wrote to memory of 4932	4720	MsiExec.exe	113
PID 4720 wrote to memory of 124	4720	MsiExec.exe	114
PID 5812 wrote to memory of 1964	5812	MsiExec.exe	115
PID 1964 wrote to memory of 1664	1964	rundll32.exe	116
PID 4396 wrote to memory of 612	4396	explorer.exe	118
PID 612 wrote to memory of 1576	612	msedge.exe	119
PID 612 wrote to memory of 2692	612	msedge.exe	121
PID 612 wrote to memory of 1896	612	msedge.exe	122
PID 612 wrote to memory of 2692	612	msedge.exe	121
PID 612 wrote to memory of 2692	612	msedge.exe	121
PID 612 wrote to memory of 4428	612	msedge.exe	123
PID 612 wrote to memory of 4428	612	msedge.exe	123
PID 612 wrote to memory of 3680	612	msedge.exe	124
PID 612 wrote to memory of 4704	612	msedge.exe	125
PID 612 wrote to memory of 3680	612	msedge.exe	124
PID 612 wrote to memory of 3680	612	msedge.exe	124
PID 612 wrote to memory of 4704	612	msedge.exe	125
PID 612 wrote to memory of 4704	612	msedge.exe	125
PID 612 wrote to memory of 4408	612	msedge.exe	126
PID 612 wrote to memory of 1960	612	msedge.exe	127
PID 612 wrote to memory of 4408	612	msedge.exe	126
PID 612 wrote to memory of 4408	612	msedge.exe	126
PID 612 wrote to memory of 1960	612	msedge.exe	127
PID 612 wrote to memory of 1960	612	msedge.exe	127
PID 5812 wrote to memory of 2472	5812	MsiExec.exe	128
PID 2472 wrote to memory of 2288	2472	rundll32.exe	129
PID 612 wrote to memory of 1412	612	msedge.exe	131
PID 612 wrote to memory of 1412	612	msedge.exe	131
PID 612 wrote to memory of 2536	612	msedge.exe	132
PID 612 wrote to memory of 2536	612	msedge.exe	132
PID 612 wrote to memory of 2708	612	msedge.exe	133
PID 612 wrote to memory of 2708	612	msedge.exe	133
PID 612 wrote to memory of 4444	612	msedge.exe	135
PID 612 wrote to memory of 4684	612	msedge.exe	136
PID 612 wrote to memory of 4444	612	msedge.exe	135
PID 612 wrote to memory of 4684	612	msedge.exe	136
PID 612 wrote to memory of 4684	612	msedge.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Nefarius_DsHidMini_Drivers_x64_arm64_v3.5.1.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1000

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3CE54FEDA0086158421964CD634BE217 U
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3600
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5776
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B1CB2513A6DDD2DCCCB0430E9A02F3BC
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI92D0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240751937 2 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2540
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIBDAE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240762750 34 DsHidMini.Installer!Nefarius.DsHidMini.Setup.CustomActions.InstallBthPS3
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" https://github.com/nefarius/BthPS3/releases/download/setup-v2.17.0/Nefarius_BthPS3_Drivers_x64_arm64_v2.17.0.msi
      4⤵
      PID:1664
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSICADE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240765875 40 DsHidMini.Installer!Nefarius.DsHidMini.Setup.CustomActions.RegisterUpdater
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe
      "C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe" --install --silent
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      NTFS ADS
      Suspicious behavior: EnumeratesProcesses
      PID:2288
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIDADD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240770296 45 DsHidMini.Installer!Nefarius.DsHidMini.Setup.CustomActions.OpenBetaArticle
    3⤵
    PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.nefarius.at/projects/DsHidMini/Experimental/Version-3-Beta/
      4⤵
      PID:3396
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIE713.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240773046 49 DsHidMini.Installer!Nefarius.DsHidMini.Setup.CustomActions.OpenDonationPage
    3⤵
    PID:2144
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A72FEB4EFE01B3AB5696212DCFCF4F6A E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA33D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240755796 11 DsHidMini.Installer!Nefarius.DsHidMini.Setup.CustomActions.InstallDrivers
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Program Files\Nefarius Software Solutions\DsHidMini\nefcon\X64\nefconc.exe
      "C:\Program Files\Nefarius Software Solutions\DsHidMini\nefcon\X64\nefconc.exe" --inf-default-install --inf-path "C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_X64\igfilter.inf"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1608
    - - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        Checks processor information in registry
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:2596
      - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        Modifies data under HKEY_USERS
        
        PID:948
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB0AC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240759171 26 WixSharp!WixSharp.ManagedProjectActions.WixSharp_AfterInstall_Action
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4932
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB679.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240760546 30 WixSharp!WixSharp.ManagedProjectActions.CancelRequestHandler
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:124

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5024

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7fed95e9-1db3-2e45-bc40-88b6b4f80e29}\igfilter.inf" "9" "4275ffd9f" "00000000000000EC" "WinSta0\Default" "0000000000000114" "208" "C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_X64"
1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2664

C:\Windows\system32\DrvInst.exe
DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\igfilter.inf_amd64_1792e75f46f37352\igfilter.inf" "0" "4275ffd9f" "0000000000000198" "WinSta0\Default"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
PID:5676

C:\Windows\system32\DrvInst.exe
DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\igfilter.inf_amd64_1792e75f46f37352\igfilter.inf" "0" "4797fa4d3" "00000000000001A0" "WinSta0\Default"
1⤵
- Drops file in Drivers directory
PID:1568

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2f73d4ef-92fb-7840-a8fe-93b4c6079561}\dshidmini.inf" "9" "4f1109cbf" "0000000000000194" "WinSta0\Default" "0000000000000114" "208" "C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_X64"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4848

C:\Windows\System32\grpconv.exe
grpconv -o
1⤵
PID:2764

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/nefarius/BthPS3/releases/download/setup-v2.17.0/Nefarius_BthPS3_Drivers_x64_arm64_v2.17.0.msi
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ffe59d2c188,0x7ffe59d2c194,0x7ffe59d2c1a0
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,8542301444547607524,13399528974037183322,262144 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:2
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,10474672484701247964,17818739538960191884,524288 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,7317626693504388233,5778816086290456945,524288 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:13
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,14877294648656669536,9657923210432436861,2097152 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,6807819938659605060,5525365730539010421,2097152 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,3580479781084361020,11777533078173975442,2097152 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,4302204783266251853,18101430815136363289,2097152 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,8746747192021837644,11479684268175717677,524288 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,10328819785212502859,10767198818896741891,524288 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,17272225121941443136,5554350000264522513,524288 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,5321215503813047567,5368792211349594690,524288 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6012,i,8495041912505217372,11158205949232556539,2097152 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,9929168080582745892,9263539701675939908,524288 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,12920899378654530650,12051951815909976214,524288 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,12920899378654530650,12051951815909976214,524288 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6748,i,10354650522606712219,3117193955133839040,2097152 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7296,i,12954302962247908941,1468754630119723728,524288 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:14
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,5710548671410859887,14948634108999677657,524288 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:14
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,7336546504963943608,13277838157997965325,524288 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,6988443591780714482,12009796861994669737,524288 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,11188337914473348993,10369626590891480110,524288 --field-trial-handle=2572,i,10742304566781065556,6057291563572703830,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
    3⤵
    PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4780

C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe
"C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe" --autostart
1⤵
- Executes dropped EXE
PID:1096

C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe
"C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe"
1⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e598eeb.rbs

Path C:\Config.Msi\e598eeb.rbs
Size 17KB
SHA256 aa7950c899c8c4dae47395a3f77221207bfe56ba6d0424c650a44e852ed66cc7
MD5 5a3f2a2100a14eee2911a7bf1bbc2b16
SHA1 15858e4acd73161818848ab3d83548ecc4d1cc28
SHA512 1debcffcaefdedbd626ab3530970537975da31ee6c20302790ad24f13e9188279a6a32839509cc27d094a68828a466ab96ce373b05667346235e901f07f2b66b
SSDEEP 384:CRUz6YJcsJGmXfn9zuECAABbSQDPgLhIjKVPGtj9tPKNvjyIjyqYj:CRUz6YJcsJGmXfn9zuECAABbSQDPgL2b
TLSH
T1E9821084BB2582C3F00762B0875F27897732C59C0B45058B6EFE532CEB7769B4DAA257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dshidmini.cat

Path C:\PROGRA~1\NEFARI~1\DSHIDM~1\drivers\DSHIDM~2\dshidmini.cat
Size 11KB
SHA256 90645fe17aed1227d423938315b775fed27e7625e92aa0d28a005aca3c78e978
MD5 3ef9984bc1ade541843e7b7be82f67ef
SHA1 b3a6e652b0266b11395eac4d565e0ce5f574c7f7
SHA512 c26b5f53f0d7c81fa9755cd2ec4adb3f84a946fa2d620703a3dff7a49c6fb976d9b9a4b6b2f86e49510161926db29c18bd92e8fff8d781704c91ca2859d5480e
SSDEEP 192:q3/C2GGjgJCUyV6m2ffNEwm1ahYC1Wtz8giZTOebR5X01k9z3AAdYiEkLcw:jZM1ah3u89bt5R9z3d1EkL
TLSH
T1CE423AA2856C4043EDABAD6093F8E5933C3937CF6C50146952EEF3690DA73C8E71866D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dshidmini.dll

Path C:\PROGRA~1\NEFARI~1\DSHIDM~1\drivers\DSHIDM~2\dshidmini.dll
Size 331KB
SHA256 349f8f482ac7b91a661f4bc68ab381c1f82ae91955e84f159b2a7953919dd86a
MD5 60279aafc8baeba0cb6c52b93d37af77
SHA1 8835697b77c50dc79768eb43992ccc0d7981825d
SHA512 5670f4714de674030b0db8f0f0361021b4aa8865ec417dfd0e1c571d766eba302adda8394c9d0ac202242a6f7fbfac73f851f875fb01127dd91dafc454d5ce82
SSDEEP 6144:4sn/RUd1G64i8FmE64rIyuaxYo9pSNIz08Q+:vE1JQFThr0cYbNIzrL
TLSH
T1BA744B68F3B024A1F4F78674CEA288C3F6B470022F2196DB66A485851F67BF4A53D35D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igfilter.cat

Path C:\PROGRA~1\NEFARI~1\DSHIDM~1\drivers\NSSMKI~2\igfilter.cat
Size 11KB
SHA256 eabd50ea697d44accd4124d51c17a20b37af55b48e4c4b8334f8c1135ae290bd
MD5 e479ab5fef954214ceb26db6a0cc24cf
SHA1 d7417ff98b4b3aa1b6f508eb71e510230a84661c
SHA512 220527c83c57a53341113dbe3c70f5c1697cb072aa94c79723dc02778934e2298d0c24f3884898e2640f7df0925fbef1524801a11f26f5235669e0a7faf98737
SSDEEP 192:2YdgMX7CpJCDnEwKUNhYCHcsb+QCjVi6KrIX01k9z3AYzZ58u:2NzUNh3r49R9zzzZ58u
TLSH
T11C3219A6456C5082FDA7BCB083E8F9837C3E37CB6C105069669FE6191D573C9EB1422D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nssmkig.sys

Path C:\PROGRA~1\NEFARI~1\DSHIDM~1\drivers\NSSMKI~2\nssmkig.sys
Size 38KB
SHA256 3e0d18e9b66889363c7fe2a6d13bfda596ac83b55ddbfb1faea236769ecda1bb
MD5 bdb75b589104cbaeb75b511feed1961d
SHA1 2310dca23cb54cdb854b451a287985bdab40efb7
SHA512 5c7fdf7555faf9ed5ade5237110fba633c89d968ded70927a89493b28eea7af71ac5a79170dfb9842afa48d04cba6b440467f202fd5fd306cbfd2dc1b4c82fb9
SSDEEP 768:XjEBkuu3oLRbKbf6xYiQcpAMxkEnpcH3vEpw9z98:TVTeR3x7dxr2HfEp4zq
TLSH
T11C038DA1A69818D6EDABCD30A1E4D513BD7876930F61C5CF1194C5101FABBD1FF3822A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dshidmini.inf

Path C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\dshidmini_X64\dshidmini.inf
Size 21KB
SHA256 69a45c913ad8919351a0862b5eaea6f494079a626e32aa6e345dfc2bfc45c8b3
MD5 f1aa14868509717cb5597bd7bc4d0bd2
SHA1 809382f07daaa3ce763e5efe9e464f0c62972485
SHA512 3d531728d8e267362e2099213172f19e2ad76d91a7e890e20e9bcc42c7d08a1684699ae2f07cfbf1a2ea5293981448619e6636ab7c8f2fc4d7485252999fbb8b
SSDEEP 192:B36ZzaKVy0fwGdAG/rV6fzjfnEzjfGipLv8Evfxpmx8we/wSwAMpMMp4pOf:cZz40ff/Ifzjfnojeov8Evfxbwecyk
TLSH
T1B5A2C252E3FD1518F1F2AE819BF580678A277892593DCA1D10A8474F1BE3E008D63BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igfilter.inf

Path C:\Program Files\Nefarius Software Solutions\DsHidMini\drivers\nssmkig_X64\igfilter.inf
Size 2KB
SHA256 e760ad778f0c60a17b6a6b82876b03e009482da59c2515142a8ab43fcfcb28a1
MD5 747745cc58c6d65a339ef20e6ab18a9c
SHA1 7ecb1d34ed0d2eb4d40af3c64273abfe76d6a456
SHA512 61611cabbb554bf37576f497aacccefee93937dd6355575a5991b04ea97a2fba716f7292a3cb9588c7f05e8190ff84284d1bba1e86734caf930994daf9d3cf25
TLSH
T13A51745561874BF994B333D26B932DC0F498402C35362808BDEFE689B37AA1CD3761B1
MD5 SHA1 SHA512 TLSH

Submit Download

nefarius_DsHidMini_Updater.exe

Path C:\Program Files\Nefarius Software Solutions\DsHidMini\nefarius_DsHidMini_Updater.exe
Size 2.3MB
SHA256 5ed619715c276d0ace6b43a64f7d48aecbb7c4a33850f50807bae7b10ca093f4
MD5 c20d4abfff0f5184770faac5540f06fe
SHA1 3ae9bfc38e5e595ec31e05ed2a026123621178cd
SHA512 c1b685c717182112c807c448ee929a5b786e0529b809f00f52bc53288a65dbd5ffa9c9fafac0e674ea445830d182ee872c5354eb8e7454e18edd24689aa8c00c
SSDEEP 49152:dgMtR34rf+geJ02uJ0KeYWyhvp2qf8cL/A5oPPr7uPzLHID:WMtk+gQQpe7Sx2q1c5onurkD
TLSH
T189B53343A1F33568D01F2B396AA3FBCCE450A7E2F853462945413188A8755B62F8B6F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nefconc.exe

Path C:\Program Files\Nefarius Software Solutions\DsHidMini\nefcon\x64\nefconc.exe
Size 582KB
SHA256 1716bd0a51d03d35559be1e420fb9e86858538221642aa2e2d937da1f2910cc3
MD5 f04f1a09e3a7e6d605be84b4393c6bd8
SHA1 14bf911f5517bc06855737bdf0f5c7bb9964a1f7
SHA512 0d6b1e5ff81a897052bb14fa490f1106da18357b0b90dd3393f5c2db266d71e2e88ecad83069226fbbd6ccbbd08a9385dbdc35248a195f566203a1effddfd584
SSDEEP 12288:SmTp2f8iWOZiu7uRt3eWuHE0e14BdpfVuW70q2cJto9VuZH:fTp2f8iWOZiu7uRt3nIE0+4BdpfVuW7R
TLSH
T1C5C47C5AA69402F8E4BB913C89424902F772B8660371CBEF03E046672F677E55F7E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ae8bf7188c718ad6c0b3d2ffbeb6aefa6a51ebb451034e527ecf66f304e76dcb
MD5 21913c83c918dddf7c3e8f68be09ccde
SHA1 0a05dca8355164f292bc4f68633e98d529659eed
SHA512 c35f6909ce981b1d75224a6a80dab825cec65a12d744f09578490ceba2fcc4f4185df28386bacd976e4a189af31b24c3ef82999cf16117dd751f76a2ca4b0bed
TLSH
T15E71A10B86520923C3E115F6C1EA14C937BCF4523D232E1E9D88A3FF5B6730C6042936
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4d08.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a4d08.TMP
Size 3KB
SHA256 3bcd0a6f31c9744cfb803bc1f40f0de703670ee60916c6aac8d057d2b4d8e74f
MD5 774ca8629a1b9629d219539e746f2eed
SHA1 ce6c24967f1791241f843cfb9def359838fd37e7
SHA512 009530dcffb1b75a2cec33e5ff0729562b9a7f6a19ba66465431e4cfe07b6a3fe914403ca2c0e7284cc4170b00598bff643948be55b4d4ec7c0df2bf37d1edcf
TLSH
T17571800B4A520923C3E115F6C5EA68C537BCF8923E236E1E9C88A3FF576774D6042836
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ca6fd0f9c7651399b587f6ccd8d94242eb39943af4058cddd92163971a50344e
MD5 971507aa6f04a325b889ded370ffada6
SHA1 ff79c9acf3717df249d0a9fcf8fcadd32cd7a73e
SHA512 b90c2e62dfb3ae35f4d1151b6341df72a66bc2b2e86630071a3bf3f0418e869740901f2c5ef893b08ad8fff018613e926686b009f76b65cd15efeeb7af0d330a
SSDEEP 192:sxR0RMyM/jK1Ml8wly/f4e0s6YQuCjZSD8FzoA8p6D/g6+WN7cg/Y+euFfeG1Ign:sxR0mTy/f4e0s6YWNa1g/5f/tFfTn
TLSH
T12962E916AA345D3B8CCBD20DFA557F53C6F91463A1801E48AAFC8A0C02E77DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d4bc1ed8618963e3629b43dda63ae47500df243f64d5f2a180840bf127308c75
MD5 f61635e9a40c818ff8a88c342c363fbd
SHA1 34f14e45a856d8f90123ee6fae381501f9d133da
SHA512 3788be9396a5b558cb28a408d012aabd786b7d0195c3299e780b0ef1fda6b5c16fec975aed345152695f41fca66e5c88391e77ac0159de838bd517ee1313088f
SSDEEP 192:sxRzRMyM/jK1Ml8wly/f4e0sxQuCE1jL8FzoA8p6D/g6+WN7cg/Y+XuFfeG1IgtJ:sxRzeTy/f4e0sxWijL1g/5f/wFfT3
TLSH
T1A162F905AA345D3B8CCBD209FA557F53D6F91573A2901E48AAFC8A1C01E77ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1fe4c47a5431901ca3012e44caf8975f0e90f195f1809358e26b97767b2f74a8
MD5 cbd1cf9f1b08bf02dc813fd3e9e6949e
SHA1 92a005f43a59293a3dce75501e3a664ea1708458
SHA512 fe8fc0f14e7cb8b5dfcb44c1875baf2e722594f3d16e398c2c26650272184e9281c13077508c45b39c68ec7a40747ed3c1ab78a2c115a253c5c31c8198290438
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXe0GXroddXR:7dUhBHE7tgWgEyf3wu1ja8RGEdNR
TLSH
T107E2FB3B680CCB7F4F4049DCE8297E9AADA901CF9698CD5447EA840C03C6BEF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 42a5d15923017a10f239aa23f003497c3a58b65967a26052777c159b05e721ae
MD5 10ecbce7f3a7253200d2669931020c47
SHA1 30ae531a77988be6903fed7df98c8d8707283821
SHA512 e3c46c8003d6905b02c54c71035dcfe129ab1e04af6936e84008db582d07edf7b64206af966bd5d0c61e3bfe708deb44fa1f5e436e1af9ace7208ddbd888e420
SSDEEP 96:KYVWKmsK6qoKfKpafG6MsMaW0xpgqaK4vgwac6yZIKqHzc5t7xxNWlqggVNK4sgO:8t34afG6MsMl0x6qivgwh6yZIKqHzc5I
TLSH
T1E0B18B54747B2780783D395A9168941FD28270A331D6F83B3B6A51E21FABE018EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 71a22fe9d65b3ce4544a4e9daee474ee38846eb7ec51313c5563bac29371a4e2
MD5 5c4cd20a429f610f671e7659bc59f8fe
SHA1 0ae0161e5e25d4f4ea504f9440250dfbd0b23d76
SHA512 028b6dcade3abd031af7c3fc7771f49b117fb96691fc15d5ba9a6ccb259183b7dd211187d861ac15ef0dc77becdaba846916c1120092e0addd97222d0cba9bfd
SSDEEP 768:4j+9t3JcXG5+t4McvnWgWWR+2SrXH78tRMoDl8BvTPaN:n9t3JtJPWg1bSroBDl0WN
TLSH
T199F2BF31A8558D738CF2D689B2177383AEF411A3D58D1E98C4D86B0E42877DD2B07D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 88fc31669f2281e82f73ffd0e48e352739789f929a21d978749ff8d0c80998da
MD5 615b1ced2da1de955cde7dfaf38f2aeb
SHA1 0aaee776f6444fb89b4fa0b84e5b06fbbda5efa6
SHA512 8849dba2d683b7cb03f5f8e6f87f41f6a7684bf5982f97e8fcd147059020e3c3813167bc89ce7b15ee611de9173a95110999622e021ed2ab85c0f8e669df2e6f
SSDEEP 768:4rv+4UNbdp3JPm5+thMcvnWgWWR+2SrXH78tRMoQ:4bsb/3JhJPWg1bSroBQ
TLSH
T17A03BF31A8689D738CF6D285B107B7837FF4109389C84E88D4D95B4E429B9DE2B0BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d040886456c19990e8e84e512b2a21fe52661397b30a136eaaab43fa224092d4
MD5 bb5ff01ad5950931412f61adcf7295d1
SHA1 0e8da014d2b9bd9354f48aef7fe6cfb4166009bc
SHA512 2adfa9f150044ec7c5a1852876cf0d62578298e4ef7a4aaaeb71885855e50dc5f1730f1fcf5e7dac5549a7a4b14f72e960e768482009f26dc3da4c8623f4e738
SSDEEP 768:Orv+4UNbdp3OO5JMcvnWgWWR+2SrXH78tRkf+8rr6F:Obsb/33JPWg1bSroCDr6
TLSH
T10203BF32A8688D739CF2D685720A72037FF44193D6C91B88C4D91B4E429F9DE270BDA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9f876b26232b31862a3397dfa692bdbff8ce28253beb8cce5b902b3c690674fd
MD5 760563bb66f684169f3fb1812f7d7914
SHA1 9bf7a2950a360f4536263b6e01109ae4ea533309
SHA512 f9752b6c1c82638b5d25b2f971c5b10f9f7ee51a31c9470f6348680134e40761576f6b1d1949fc52926f6b8f2878bd535f1b53de5352446e2d2b2e81bb9f14ce
SSDEEP 768:uj+9p3JtXG5+tLMcvnWgWWR+2SrXH78tRMoDl8BvTPaN:N9p3JRJPWg1bSroBDl0WN
TLSH
T17FF2BF31A8558D738CF6E689B2177383AEF411E3958C1E98C4D86B0E42877DD2B07D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

DsHidMini.Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\MSI22932\DsHidMini.Installer.exe
Size 78KB
SHA256 8b59fbee97b5d1e38911b7f13104d3f174976b6a68330457073410694f2aea98
MD5 0f009c3f82b93d466a9394fb9f39d9df
SHA1 c1b87e0d95ed87ecd2cb4fa099f359d4c2182be1
SHA512 1efdfdd9f2fd55a4b58af88f264fec08c08b5bf2df885a4d98918ac0f42c0d3bd82ba6b2e5612663d03355136a440ab858acfece85e7327bf3e0a7baa692ca5d
SSDEEP 1536:IlRyFk9hUnPueGhPdZutW/ZmmA4cC2fW3w7vOg7b0NQ7+Rtcwa+U7vSA7vHG7vMr:IlRy+hkG3ZuQ/ZmmA412fWA9f5/apslh
TLSH
T14D735B547FAC425AD6FF0B35A87202A51B36FB876A10DB8D0DE890DD8D227439722773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EmbeddedUI.config

Path C:\Users\Admin\AppData\Local\Temp\MSI22932\EmbeddedUI.config
Size 593B
SHA256 72c8b8e5df0fda9af57c79e355e1c8a3fd192c0090094a1d08820a07edbf442a
MD5 88e7367e86635960eb31431438d7b5d5
SHA1 c0ba8113584bc664da7a9106d99b378821e6db2f
SHA512 4975a97f130377348eb3c92bf9e4f735ddb458bb5e64bd6ab0b40df88a900a894ae7c2e7d72d569c49b365ef4ed330a1ae9cb6be73502eb71cf27ccf46d5982d
TLSH
T138F08B2144C4BFA64F721AA33B669464CBB893B3288C044CB4BE6D574F214990207233
MD5 SHA1 SHA512 TLSH

Submit Download

WixSharp.UI.CA.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI22932\WixSharp.UI.CA.dll
Size 4.4MB
SHA256 41e42bdaca5ce7d1e95a9feee354e30b84b92b00ea850571ecc97b1e382441a8
MD5 af959255fe0bc50b7376ac1a500bdd1f
SHA1 3e028b8ec66bd76ad11d46ce099c5ba4d4040be2
SHA512 13953ec892942bae7fd18f745e46161cadb508aab5f6d4a75d299809db43dfaeba6f16f3f889b8350cf90282063c38c1c01bad4f2507e224ff4ee18cc01ca425
SSDEEP 98304:qQ0gUEROBPyqkPWnzc0NOqbZWrm2SB+RuL7FeUq+6KEh/vHEY5/6:NQPyqoQc08qbqm2mWEeT+KkY96
TLSH
T12E26331226A0A075F4FD2E319978966603EFBE721771C9CBB7040E7B5C196D3C3B2266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixSharp.UI.WPF.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI22932\WixSharp.UI.WPF.dll
Size 77KB
SHA256 01ad61f06b11151f3d40772d2fed23c8feaa9c8e94aa30485d7563546543c615
MD5 99c6a5a9c0ea244dbdba20959ed9bce3
SHA1 45d7c33ce32929293975c9d7fcd2bb81e1159af2
SHA512 22e5843ec2763024c9986feb68737a536e78f845b4ec2454d6c56e76a2a6d311787b1bd8a26f3b17605dc262a5c7c838d5f85e8308ddaa16a350e2d723b3a338
SSDEEP 1536:edAbIe6W07ZffvRAfGG1B8oC9mZApyFeonB2W+cyFXnAVJvpzyFXnAnZYvGyFXnv:3L07Zffa839mZApi5nSGKQAPIcF
TLSH
T1B3734D657D2E823ED7DE4B3A903302B1933C5B89FA56C70B796650BC58C3347926136B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixSharp.UI.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI22932\WixSharp.UI.dll
Size 671KB
SHA256 0b4d3db2b56a640d2effcd16fe0ee15d82d94eef3487105e659b2969ff099a21
MD5 e7b6ae8436560af201c68b2e9f702a0a
SHA1 c6c49f6a12a9111b848ff94bd4b82fc405f24bce
SHA512 fa6321151af071be66e33ca6a084b8c075a5d1d7188edcd09ab1c100a2e969204355c1b78eefb8adcec3017ea2085b128106596c66b706da153b5f4b855dca44
SSDEEP 12288:1XL3Gkk04KMnSuOlK7QLggsdZvm45tWstQ7XG5sft7IFNeie6tty8:1XL3rk04tSjKBZvm45t5Q7WWFM2stty
TLSH
T152E4D00D37EC9E2AE1778671B99001490725C29BCB37EAF9F88514AA02DB731C673E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI22932\WixSharp.dll
Size 651KB
SHA256 0c45486156c43d25daaf06c4b5f71b00b59fb04eca5582126481a3ef8a189df1
MD5 66550a02ac05492b177a7b88b3ed3890
SHA1 4ef96ee06246c7540dcc55c0aa53e598feeca348
SHA512 675a99325393bbb6221c01e8bd347f0ca01cd565bd16832712ba01395e6d704691dac6d3f7a42e73bdf109ae935d34226621e1bc998db7d1dca69b7cfc59a268
SSDEEP 12288:IjKGRg0Ohczm+4w2SlwEhSiwAifpZmTI9639A2VGS7KzFi/RvAF8CX+fR1Yjd:l2379/RvAF86yR1Yj
TLSH
T1F8E46B0567E85A35E7FF1F38E4B461562673F8069A31EB5F098894ED0EA37409C31BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI22932\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 bcc548e72b190d8f39dcb19538444e2576617a21caba6adcb4116511e1d2ddee
MD5 b82b13d16e7f3d3607026f61b7295224
SHA1 d17b76907ea442b6cc5a79361a8fcec91075e20d
SHA512 be8c0b8b585fc77693e7481ca5d3f57a8b213c1190782fd4700676af9c0b671523c1a4fa58f15947a14c1ff6d4cda65d7353c6ba848a3a247dfcda864869e93f
SSDEEP 3072:QLxw5Btsb/b3xYxGI65OdtHMzBTx8j69UgoTqdzjDCnfKlRUjW01KyIEjZpjWja9:QLWkzBuGI0b8j6jomdCJjeU
TLSH
T1E4149D2953FC473ECEFE8778E2654252D7B2E1E67103D71A9C8281A62163384B792397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Mba.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI22932\WixToolset.Mba.Core.dll
Size 165KB
SHA256 e9002b2aa130d682df9242c479e20ac54b7a9b00c11ed75738ec9b12648a78e8
MD5 1e43e0952b5cc4c73245acad8114ee63
SHA1 c2b3b179555ba569ebfd9ddabd776d3151ea114e
SHA512 2e283305c038e36d4c9b0db00f20df88624b51dd7345f43eb992fd1671ce67c9a63067445ed90d88ff6276a608f2ea2ef8bfe7c0bda5e1043786df024a71b7ef
SSDEEP 1536:t/L6YAFEWyoWhoDYszYG7FW1o5oaOfZVYTA/hy2H/No818ywNDPQ0mTpy0pfVaBu:1qzYZ685Vo818ywNzQ0OpPunsBYAPxxf
TLSH
T1E1F3E629039CACBDC68A0F3DA0D1847586B4EB1D58D2E3A69A01FBF73523F941D135B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir612_1429592247\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nefarius_BthPS3_Drivers_x64_arm64_v2.17.0.msi.crdownload

Path C:\Users\Admin\Downloads\Nefarius_BthPS3_Drivers_x64_arm64_v2.17.0.msi.crdownload
Size 14.5MB
SHA256 db73155e3dd04b266cc2eb339ffca81efcd32216ce46cef52a8e7ebd1ed9f610
MD5 a62fe0dfb602893b0fa2b0aba408f147
SHA1 c112a29f54151e80a09d08eb9fc4c716b4b66464
SHA512 064cfef3295f7feef05b5df58d0b9ac0a3bfe4d3d4c0b2c14f9ffbacd1a0ea580f81173f1c9b967d68233d155644454e2e887d3ff3ae0ea24d518c0e3ea4c58c
SSDEEP 393216:Ez2cJxrmEqNQgmZyvb26HQ/lpyththXBmVC/:EzpXmEqHmZC26kpyththX4VC
TLSH
T1A2E62308B6E40B3AE97761744E62A004D737FC14073084EBF255E27AAE7FB90D97A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI92D0.tmp

Path C:\Windows\Installer\MSI92D0.tmp
Size 4.4MB
SHA256 d0dc14516779d8fcc7837de8902c02eb989e86b8455d98d0f774b95994f661f1
MD5 fcf5a28268fa4647dd5d0213dd24b154
SHA1 373010ad918ff5933cedcda0e08e4c0df465abec
SHA512 dd255dc42d24f7aced66b603573ff19e79f11a67adcf762dd0d2906e3a191c973e2320f6d02449904b9383215d406ae49e62380c8b58671452e7c6cb48c9ee17
SSDEEP 98304:WS94BodwzfhX9pOmTS3XMNJjlVw5G8rVA6NHHrB8/i5zxV:WS94uKz1P7S4j/w5NNHHr/V
TLSH
T1622633147BF414A6DC7F1036CEA35B40D93BBC764239D25F435021998F6B392AB3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA33D.tmp

Path C:\Windows\Installer\MSIA33D.tmp
Size 4.4MB
SHA256 4f9f98aa99621851922a477c1ed7c30e73c388e4eb7014b576b96a442bd467d8
MD5 3e526c3ef05d7f99927a6c6d399a1328
SHA1 3db87e2745f6820c2d286036da2e6b6d3d8481ac
SHA512 838c5ce48e06f35008f28eca441c379e2ce57599cfffdd826673fe8c55da5e0d9455fe774ab284e5e3ec31ba3117985d44c2d8f6b0bdf15de79cbd21361f4966
SSDEEP 98304:e9n4OsFIeuq5aOdDAW/EEYwiCWxvXxLTl2+:el4dCjqEawCUPh0+
TLSH
T15526330673A504BDFA67427A48AF5B0DC7773D5427A2DAEF0B8006489F2BB91C53B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLanguageRuntimeLibrary

Path C:\Windows\Installer\SFXCA1793CECCC744A11991EB3DD5E856A8DE\CommonLanguageRuntimeLibrary
Size 5.2MB
SHA256 d6578bec8382baa60ee2a8f729a095e25c4d3043cf3bc7dda9469d6e46c649ef
MD5 50bcc296471dabd5892bd9106de4414d
SHA1 1fafe0cf2c7acb7b6eace56d97f62c5a0b2820c6
SHA512 0f733ac048ba8c9b759acee59f9791c235bb4abc1c9ac3e72b207744f0f43cf50ae750234d8ee936a2668689f00f182ed600f96ed4179a0fb79b2009626e22bc
SSDEEP 49152:QugZkGzNMbBJQrCzB9+xOXsCMnmRip3ul92b9sk/IRUnbF9X:27NMb6C92359X
TLSH
T1CF466C03ABE85E56F2BB4F369476130586F3F85A2313934E2115E2699C637D2BE43363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Windows\Installer\SFXCA1793CECCC744A11991EB3DD5E856A8DE\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Windows\Installer\SFXCA1793CECCC744A11991EB3DD5E856A8DE\System.dll
Size 3.4MB
SHA256 625afaaeda91cf8a838be15e9c6e9e650076b41b0eeb13a3de4f2e8045f09130
MD5 3b16d7926849a5d81f0cc81cdcb9d0dc
SHA1 0f9837cd0f75b34179551d5220295bc504225c82
SHA512 f2c2217b1dc1bea4c7c3f225caca6f493af1cc354ab664cedf1521e6f74ade602d8051bdd728c5e0e8a0ffd0e40ec3381e8583705eee482e9a8a38bb5f59e43a
SSDEEP 49152:VhbL6fADZxrPEBg58qpOJrUOMsCDiwYS5m9dpVp4DPqBxfh9+YwvbFw1ehe:VS218qpOJoOMtDiwYKQ1yC1ee
TLSH
T1DBF57C10FFF94E2AF2FF4B38A13110119AB5FD896722D70F1895F12E6866B508D953A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CliWrap.dll

Path C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\CliWrap.dll
Size 196KB
SHA256 f430bb1244e18a26b9eeeb0e51cd2cb6747feb52236593bfb8085004fae7d049
MD5 3fa33fe88ee3652962f1cf9621a5147b
SHA1 06c206a4ee8b5dcba77bed9e6ef626161ec76762
SHA512 730b80c1bf56e96b65b7e2d2363fad27a58bf8e1ce49831b64e533c5b7644cedfd09284d0fd270d3d34865ea895f52f095e0423a81a0b6162f942a070f7fa10a
SSDEEP 3072:nKKb1cX4o2k3F3/8Gut/Q3gAh8u7ZMbZ2sYMsZ6bGiH3Ewmj4OR0ZjjgugHdJfTC:npK4s/2uwqiH3EdIgzfC
TLSH
T1FE149F1497AC8F27EAEFA77DF8A01291CB36E706E446FB4F5D0CB6D924527805C80167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Bcl.AsyncInterfaces.dll

Path C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\Microsoft.Bcl.AsyncInterfaces.dll
Size 26KB
SHA256 80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc
MD5 ff34978b62d5e0be84a895d9c30f99ae
SHA1 74dc07a8cccee0ca3bf5cf64320230ca1a37ad85
SHA512 7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28
SSDEEP 384:cOJWqnwCBbNAP0VES2j0cX6dAl+NWpVzrdcoquWeP/WxR5kHRN7dDFcYR9zPrf8O:culwCBhdVv2wK5fdcUtFFn9zT8pY
TLSH
T14FC27C1A935C1317CEAF2EB4E570D9422935E78A2C22EB3E1588F2950D97345EB31738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nefarius.Utilities.DeviceManagement.dll

Path C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\Nefarius.Utilities.DeviceManagement.dll
Size 288KB
SHA256 9b67ff59603a2063cb22cb5d72248cf329721e708e98b5ee01464a56e5b37b66
MD5 21a0ec9951f062973f0e6958239e7156
SHA1 f4030df5ffe8163d967fb39eccfcf67ae95a0a7f
SHA512 fb5e9f67fc94dc9721917543b3f2f5ccb920a2b24b5fb41db9e27dc83136c215e9a24edfeefb726cb80f0be330837ef40b107f565a3358ad5cb30fe4e7a0d191
SSDEEP 3072:zsu7nXiMGyVU0X9+u9KIlaNFEKEev9nQQ2KwfxhaI9B/KNkwvGo5cvfcjESATOVf:tiyVB48srE8xI9B8vl2fPfi
TLSH
T152542901B5692F7BD60D8ABA343E052219ED541EA03DB6FC85ECB85D3ED6E830D542E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nefarius.Utilities.WixSharp.dll

Path C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\Nefarius.Utilities.WixSharp.dll
Size 7KB
SHA256 65488d7ddd7d2b443fd3594df4bd34875523ee517a8894d391cdde2ba14d918e
MD5 8e3052b9606929d18a87a734e9f733f5
SHA1 687d29585fe314892d283d9fe2a48eb29e4c028b
SHA512 3017ba186aba85af758f1e74bb908623829d4b5f94628121ce843c32f7d73ac7705a26731d9501b7ba0ea3195d4cc28fc74d70970d08a2fc1179553b28d720f5
SSDEEP 96:UQJGcCtok0yuGPljHY2D65mphhD6GoRXZqWwlcuwuGubccDVddH9KFs:Utok0yuG9jre5UZASxFbYQtd
TLSH
T17BF18525F3885337FCBB873299B7A3819B74F64888139F7F14C4920A9C2529946A1B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Buffers.dll

Path C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\System.Buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\System.Memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\System.Runtime.CompilerServices.Unsafe.dll
Size 17KB
SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
MD5 c610e828b54001574d86dd2ed730e392
SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
TLSH
T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.Extensions.dll

Path C:\Windows\Installer\SFXCA85C2479F334C57C88EDF026602B9FEDB\System.Threading.Tasks.Extensions.dll
Size 25KB
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
TLSH
T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DsHidMini.Installer.pdb

Path C:\Windows\Installer\SFXCAE4EAA3D4354D506ADC0E0065F5F54517\DsHidMini.Installer.pdb
Size 42KB
SHA256 38593b258a6e1ca81b68052d9664a0950fb3dd0d50000c0a7b3459fe3d13ad46
MD5 4c43332373b14738770925072c9d0fea
SHA1 3702399312e1fbbb9fa0fe6ab6e61f8a41373202
SHA512 01b884134d5245949866e7f68c06db927b8a8a011770e3ad52cb349ab16587dd65c99d04d47605d737589827e0497460afee48e7c287c14328c4cde3ee78e380
SSDEEP 768:8W7hMT7dJaGsh0Ret6EPTgkuc5Ix0gZXrZfUDPW9t9CLRvm5Ij9b:zC7dJaDeM9PTFuYytZXrZcTW9tUtvpZ
TLSH
T14213BF2BDBAAC31EFBAB6A7625E746D12730D31495064F1FD1C97200F52730E96A368C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e598ee8.msi

Path C:\Windows\Installer\e598ee8.msi
Size 17.2MB
SHA256 77295683e2ba57adf91afc54701c46f06a7a847f3621b15f2acfa7ea914fcf26
MD5 a86c0cb5c3f36cbc15f2589a0ab0b08f
SHA1 2f47ec4cd9bca1ee7add56a96cc16ec00a9e1928
SHA512 57316d2f849dd0d140e26a2ce2b59a554cdecb90c3885b3f299469eca6390ecc4c74637137146ba5a0670da25d3af4651a190d7ac9c2ca0ace56dbe0ea9087b2
SSDEEP 393216:cQPyqsHIqm1mJR4MjqESRhJKz9//f13N1Ds+:cQPxkIzs5qECP2Frs
TLSH
T1B2073306B7E5043AEC6B5130BE9F47148736BD640731C6EF66403229AE3B7D28A7B725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 71KB
SHA256 aae18de74a9376a04727185b43de78fd6c3166e9201fbc71fa3850f0550df879
MD5 c72a5ab9f57d80234cb455f3a0c78ec2
SHA1 593805b7a8a8d63a1d469eb071a0401d3744ef3f
SHA512 da2531e9b2386244d834673787e7cd56414345e891e35b26814b3533065b480bf9a5c96269695ef6154748d7353fe1a2c52d4dbeb255a57df4a2dc77b721ea01
SSDEEP 1536:TjLHChLucAfZpUDLU5eoWWEdhnU41ZAe+A8u+K+2SRkUaq2qgeqni0nYYNjKSBLT:zaxK2
TLSH
T190737F06D1D88E5CC5B209B3725BED75D91A65CA730F0DA632ADB340DCC2B142FBA47A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dshidmini.inf_amd64_68109700ac2a2fb6.ini

Path C:\Windows\System32\DriverStore\FileRepository\dshidmini.inf_amd64_68109700ac2a2fb6.ini
Size 426B
SHA256 3fb1f234dd16c203ab353badb839e1e809257df59acec8bee41e23c657b00333
MD5 6e8468c7a3dae1a9b725c6d63f67348a
SHA1 8359879348b4b5f9962ce2ffa4598d2bb13bfa37
SHA512 3936b6074aba5a4cccb5f4b1950c48fb446d58ba139f2fb5d1b1d2bda6f79ac707a69a8a666ca108cf1adf6acf2e1b557cb4c20d4954b9bd234b099bf1388613
TLSH
T1FFE0E51942AB92FE5807C0C7223E32388045B9D369BA3C403510E850CF4FC328804EFB
MD5 SHA1 SHA512 TLSH

Submit Download

igfilter.inf_amd64_1792e75f46f37352.ini

Path C:\Windows\System32\DriverStore\FileRepository\igfilter.inf_amd64_1792e75f46f37352.ini
Size 419B
SHA256 7f9b96b3929bc608b9d134374f7fb3403d6065d60789cefece4f59f91047472e
MD5 e175d4804d7252f6f7fb2fdef5c42473
SHA1 1248910c195d1c7fa8ca0491ab87c6f0f94b8e28
SHA512 dc1dd5780ec5ec0d55ebe6fbc7d40c907fa235cf7f82230e3920dbd3df5a0fed9cc044631d45a9c9d1ba418131693c51f3e997f27bd63113de54cfb55e74b21c
TLSH
T185E092E611B3C2DF3711F462B22906B89D5F61A1882B7BC170A2D15CBF179605DB42B3
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 805ec7f0c386e86ccd048bbc443b9570887acfa7f5076713af6b1017462732b0
MD5 a49b4b87cb84899d56ccd8539c7239a8
SHA1 5a2882d7e5b150449b900c92ac46fe798b3602b8
SHA512 2a859788e73cde30e0d19c1603ebc7fc71d7e23b88363b681d41216e571d8f7cd1ea7f21e9463ac047f104fa0c48700a9723dfaef9079fdc1502805b6ce3bf35
SSDEEP 24576:cFo3DMPrdoO/vvTL/SALriVQfbORA7Mok2dJt2VTdel6ZMqr8YRm7ihK/+f:mHE
TLSH
T12457B22437F92200F7B79E7CA8F06A6349397D5BAC16DE8D45411B4E0822F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7fbff933-d797-4ad5-8e50-f38b20ba7f1a}_OnDiskSnapshotProp

Path \??\Volume{3b2d0b73-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7fbff933-d797-4ad5-8e50-f38b20ba7f1a}_OnDiskSnapshotProp
Size 6KB
SHA256 a4464b1a442ca0210faa6f98dc6213311057205321e70b998226e6fa5b6c1c2a
MD5 b840dea33e4550d755b230f535d65e09
SHA1 df4f3c796a3138efb89ed1379e74df7de4d0e560
SHA512 309897a3e8de32e78b6711f7d25756fb92ee6ed8ee76d44737de7dcd625d891c221b203a80b7404b135e0ec32ed62c3c814e228b8f3133a94a175498bd4ed4dc
SSDEEP 96:F/tj/oYgvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:P8Y8b++uVmN
TLSH
T183D187185AE54711F2B3AB3128F18557A877B911FF33CB8E0198238E6670A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-489-0x00007FF6268C0000-0x00007FF626D68000-memory.dmp

Download

memory/1608-168-0x00007FFE40D60000-0x00007FFE40D70000-memory.dmp

Download

memory/1964-324-0x000002ADEEAE0000-0x000002ADEEB02000-memory.dmp

Download

memory/1964-320-0x000002ADEECD0000-0x000002ADEED82000-memory.dmp

Download

memory/2288-415-0x00007FF6268C0000-0x00007FF626D68000-memory.dmp

Download

memory/2288-424-0x00007FF6268C0000-0x00007FF626D68000-memory.dmp

Download

memory/2540-96-0x00000152A1AE0000-0x00000152A1B8A000-memory.dmp

Download

memory/2540-94-0x00000152899E0000-0x0000015289A14000-memory.dmp

Download

memory/3336-179-0x000001A836970000-0x000001A83697A000-memory.dmp

Download

memory/3336-172-0x000001A836AE0000-0x000001A836AE8000-memory.dmp

Download

memory/3336-170-0x000001A836960000-0x000001A83696A000-memory.dmp

Download

memory/3336-163-0x000001A8368D0000-0x000001A8368DA000-memory.dmp

Download

memory/3336-161-0x000001A8368C0000-0x000001A8368C8000-memory.dmp

Download

memory/3336-160-0x000001A8369A0000-0x000001A8369EE000-memory.dmp

Download

memory/3336-177-0x000001A836AB0000-0x000001A836AD6000-memory.dmp

Download

memory/3336-158-0x000001A8368A0000-0x000001A8368BA000-memory.dmp

Download

memory/3336-157-0x000001A8359B0000-0x000001A8359B8000-memory.dmp

Download

memory/3336-154-0x000001A8368F0000-0x000001A836928000-memory.dmp

Download

memory/3336-152-0x000001A8359C0000-0x000001A8359DA000-memory.dmp

Download

memory/3600-62-0x0000000009A90000-0x0000000009ABC000-memory.dmp

Download

memory/3600-49-0x0000000004E20000-0x0000000004EB2000-memory.dmp

Download

memory/3600-29-0x00000000028F0000-0x0000000002924000-memory.dmp

Download

memory/3600-58-0x0000000009820000-0x000000000982E000-memory.dmp

Download

memory/3600-57-0x0000000009840000-0x000000000987E000-memory.dmp

Download

memory/3600-56-0x0000000007560000-0x0000000007568000-memory.dmp

Download

memory/3600-55-0x0000000007550000-0x0000000007558000-memory.dmp

Download

memory/3600-53-0x0000000007530000-0x000000000754C000-memory.dmp

Download

memory/3600-51-0x0000000004BB0000-0x0000000004BBA000-memory.dmp

Download

memory/3600-33-0x0000000004A80000-0x0000000004B2E000-memory.dmp

Download

memory/3600-48-0x0000000005240000-0x00000000057FA000-memory.dmp

Download

memory/3600-37-0x0000000004BD0000-0x0000000004C7A000-memory.dmp

Download

memory/3600-45-0x0000000002980000-0x000000000299A000-memory.dmp

Download

memory/3600-41-0x0000000002960000-0x000000000297A000-memory.dmp

Download

memory/4448-729-0x00007FF6268C0000-0x00007FF626D68000-memory.dmp

Download

memory/4448-697-0x00007FF6268C0000-0x00007FF626D68000-memory.dmp

Download

memory/4932-244-0x000001CC79750000-0x000001CC7976A000-memory.dmp

Download

memory/5472-217-0x00000248B65A0000-0x00000248B6F44000-memory.dmp

Download