Overview

overview

9

Static

static

3

2026-08-09...lc.exe

windows10-2004-x64

9

2026-08-09...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 21:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_b624d0e60a0b78eb72656d853db46a2d_amadey_darkgate_hijackloader_icedid_luca-stealer_njrat_remcos_stealc.exe
  • Size 8.9MB
  • Sample260809-1ldpyscf36
  • SHA256 25c0d6ff06cfaf77641154902a23acd97e5f8f9b7bf9bebbe4ec4d29c7d4092a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 14 IoCs
  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 3 IoCs

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 11 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 33 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 36 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 13 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 51 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_b624d0e60a0b78eb72656d853db46a2d_amadey_darkgate_hijackloader_icedid_luca-stealer_njrat_remcos_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_b624d0e60a0b78eb72656d853db46a2d_amadey_darkgate_hijackloader_icedid_luca-stealer_njrat_remcos_stealc.exe"
    1⤵
    • Downloads MZ/PE file
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config w32time start= auto
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4932
      • C:\Windows\system32\sc.exe
        sc config w32time start= auto
        3⤵
        • Launches sc.exe
        PID:4460
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net start w32time
      2⤵
      • Executes a command shell one-liner
      • System Time Discovery
      • Suspicious use of WriteProcessMemory
      PID:1068
      • C:\Windows\system32\net.exe
        net start w32time
        3⤵
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:3876
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 start w32time
          4⤵
          • System Time Discovery
          PID:1308
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c w32tm /config /manualpeerlist:"time.cloudflare.com time.google.com time.windows.com" /syncfromflags:manual /reliable:yes /update
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Windows\system32\w32tm.exe
        w32tm /config /manualpeerlist:"time.cloudflare.com time.google.com time.windows.com" /syncfromflags:manual /reliable:yes /update
        3⤵
          PID:2396
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c w32tm /resync /force
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5072
        • C:\Windows\system32\w32tm.exe
          w32tm /resync /force
          3⤵
            PID:2132
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          2⤵
          • Executes a command shell one-liner
          PID:3576
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4936
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
            3⤵
              PID:868
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\\'
            2⤵
            • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
            • Suspicious use of WriteProcessMemory
            PID:2360
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe Add-MpPreference -ExclusionPath 'C:\\'
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3816
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "$env:USERPROFILE\Downloads"
            2⤵
            • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
            • Suspicious use of WriteProcessMemory
            PID:3184
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe Add-MpPreference -ExclusionPath "$env:USERPROFILE\Downloads"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5076
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v HwSchMode /t REG_DWORD /d 1 /f
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5080
            • C:\Windows\system32\reg.exe
              reg add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v HwSchMode /t REG_DWORD /d 1 /f
              3⤵
                PID:4740
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "$env:USERPROFILE\Downloads"
              2⤵
              • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
              • Suspicious use of WriteProcessMemory
              PID:3484
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe Add-MpPreference -ExclusionPath "$env:USERPROFILE\Downloads"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3180
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c reg add "HKCU\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 0 /f
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2332
              • C:\Windows\system32\reg.exe
                reg add "HKCU\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 0 /f
                3⤵
                  PID:4040
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c reg add "HKCU\Control Panel\Mouse" /v MouseThreshold1 /t REG_SZ /d 0 /f
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:2300
                • C:\Windows\system32\reg.exe
                  reg add "HKCU\Control Panel\Mouse" /v MouseThreshold1 /t REG_SZ /d 0 /f
                  3⤵
                    PID:3572
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c reg add "HKCU\Control Panel\Mouse" /v MouseThreshold2 /t REG_SZ /d 0 /f
                  2⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3920
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Control Panel\Mouse" /v MouseThreshold2 /t REG_SZ /d 0 /f
                    3⤵
                      PID:1788
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
                    2⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3796
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -setactive scheme_current
                    2⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1872
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
                    2⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3972
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMAX 100
                    2⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3336
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -setacvalueindex scheme_current sub_usb USBSELECTIVE SUSPEND 0
                    2⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3568
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -setacvalueindex scheme_current sub_pcie ASPM 0
                    2⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3512
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -change -monitor-timeout-ac 0
                    2⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:752
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -change -disk-timeout-ac 0
                    2⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4000
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -change -standby-timeout-ac 0
                    2⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3140
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -change -hibernate-timeout-ac 0
                    2⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5036
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -setactive scheme_current
                    2⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3960
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c cls
                    2⤵
                    • Executes a command shell one-liner
                    PID:3532
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c msiexec /i "C:\ViGEm.msi" /quiet /norestart
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:940
                    • C:\Windows\system32\msiexec.exe
                      msiexec /i "C:\ViGEm.msi" /quiet /norestart
                      3⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2196
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\HidHide.exe /quiet /norestart
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:4456
                    • C:\HidHide.exe
                      C:\HidHide.exe /quiet /norestart
                      3⤵
                      • Executes dropped EXE
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:1260
                      • C:\Windows\SysWOW64\msiexec.exe
                        "C:\Windows\system32\msiexec.exe" /i "C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\HidHide.msi" /quiet /norestart AI_SETUPEXEPATH=C:\HidHide.exe SETUPEXEDIR=C:\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1786071159 /quiet /norestart " REBOOT="ReallySuppress"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:1796
                  • C:\Detector.exe
                    "C:\Detector.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:4536
                • C:\Windows\system32\msiexec.exe
                  C:\Windows\system32\msiexec.exe /V
                  1⤵
                  • Badlisted process makes network request
                  • Enumerates connected drives
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1900
                  • C:\Windows\syswow64\MsiExec.exe
                    C:\Windows\syswow64\MsiExec.exe -Embedding 433F035E4B762A6CD153AF2706410E03 E Global\MSI0000
                    2⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3408
                    • C:\Program Files\Nefarius Software Solutions\Virtual Gamepad Emulation Bus Driver\devcon.exe
                      "C:\Program Files\Nefarius Software Solutions\Virtual Gamepad Emulation Bus Driver\devcon.exe" install "C:\Program Files\Nefarius Software Solutions\Virtual Gamepad Emulation Bus Driver\ViGEmBus.inf" Nefarius\ViGEmBus\Gen1
                      3⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      • Checks SCSI registry key(s)
                      • Modifies data under HKEY_USERS
                      PID:3304
                  • C:\Windows\syswow64\MsiExec.exe
                    C:\Windows\syswow64\MsiExec.exe -Embedding 736E21D1D83F2720C537877D59F200FC C
                    2⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:672
                  • C:\Windows\syswow64\MsiExec.exe
                    C:\Windows\syswow64\MsiExec.exe -Embedding C59C662B550B82D9A80F6949AD81AE33
                    2⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:4052
                  • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
                    "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --create-device-node --hardware-id root\HidHide --class-name System --class-guid 4D36E97D-E325-11CE-BFC1-08002BE10318
                    2⤵
                    • Executes dropped EXE
                    PID:2120
                  • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
                    "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --install-driver --inf-path "C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHide\HidHide.inf"
                    2⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    PID:1904
                  • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
                    "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --add-class-filter --position upper --service-name HidHide --class-guid 745a17a0-74d3-11d0-b6fe-00a0c90f57da
                    2⤵
                    • Executes dropped EXE
                    PID:3340
                  • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
                    "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --add-class-filter --position upper --service-name HidHide --class-guid d61ca365-5af4-4486-998b-9db4734c6ca3
                    2⤵
                    • Executes dropped EXE
                    PID:1552
                  • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
                    "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --add-class-filter --position upper --service-name HidHide --class-guid 05f5cfe2-4733-4950-a6bb-07aad01a3a84
                    2⤵
                    • Executes dropped EXE
                    PID:1712
                  • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe
                    "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe" --install --override-success-code 0
                    2⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in Program Files directory
                    • NTFS ADS
                    PID:1380
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                  1⤵
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Suspicious use of WriteProcessMemory
                  PID:5036
                  • C:\Windows\system32\DrvInst.exe
                    DrvInst.exe "4" "1" "c:\program files\nefarius software solutions\virtual gamepad emulation bus driver\vigembus.inf" "9" "429a86e87" "0000000000000140" "WinSta0\Default" "00000000000000E8" "208" "c:\program files\nefarius software solutions\virtual gamepad emulation bus driver"
                    2⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    • Modifies data under HKEY_USERS
                    PID:2504
                  • C:\Windows\system32\DrvInst.exe
                    DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce88408607219:ViGEmBus_Device:1.17.333.0:nefarius\vigembus\gen1," "429a86e87" "0000000000000170"
                    2⤵
                    • Drops file in Drivers directory
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    PID:2992
                  • C:\Windows\system32\DrvInst.exe
                    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8bb5799b-25ee-724b-ac73-817f6a95677f}\HidHide.inf" "9" "49f2aa4cb" "000000000000015C" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHide"
                    2⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    • Modifies data under HKEY_USERS
                    PID:3804
                  • C:\Windows\system32\DrvInst.exe
                    DrvInst.exe "2" "201" "ROOT\SYSTEM\0002" "C:\Windows\System32\DriverStore\FileRepository\hidhide.inf_amd64_7c068d69bd48dffd\hidhide.inf" "oem4.inf:*:*:1.4.181.0:root\HidHide," "49f2aa4cb" "0000000000000130"
                    2⤵
                    • Drops file in Drivers directory
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    PID:2452
                • C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHideWatchdog.exe
                  "C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHideWatchdog.exe"
                  1⤵
                  • Executes dropped EXE
                  PID:3344
                • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe
                  "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe" --autostart
                  1⤵
                  • Executes dropped EXE
                  PID:3244
                • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe
                  "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe"
                  1⤵
                  • Executes dropped EXE
                  PID:3216

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      2
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Windows Command Shell

                      1
                      T1059.003

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Power Settings

                      1
                      T1653

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      File/Path Exclusions

                      1
                      T1564.012

                      Impair Defenses

                      1
                      T1562

                      Disable or Modify Tools

                      1
                      T1562.001

                      Modify Registry

                      1
                      T1112

                      Credential Access

                      Discovery

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      3
                      T1012

                      System Information Discovery

                      3
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Time Discovery

                      1
                      T1124

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      e590401.rbs
                      • Path C:\Config.Msi\e590401.rbs
                      • Size 8KB
                      • SHA256 6b416bf41df82d8f619ebac49e889b417944d04c47b3d1fa349b5cdec43d42a5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e590406.rbs
                      • Path C:\Config.Msi\e590406.rbs
                      • Size 14KB
                      • SHA256 1770966d69fa74b8acab7935f15d0c5ebc0093b5e28af384172ab0d12c7d0303
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHide.exe
                      • Path C:\HidHide.exe
                      • Size 7.7MB
                      • SHA256 f4bbbcb82e6258641b887c74bc81c4c5f66e4aa811808dfc304347687b7605f6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ViGEmBus.inf
                      • Path C:\Program Files\Nefarius Software Solutions\Virtual Gamepad Emulation Bus Driver\ViGEmBus.inf
                      • Size 3KB
                      • SHA256 634b032a33cecbf2e43c46c5896a3c359cdda452c632da6396452419ffa301d6
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      devcon.exe
                      • Path C:\Program Files\Nefarius Software Solutions\Virtual Gamepad Emulation Bus Driver\devcon.exe
                      • Size 494KB
                      • SHA256 6591ea75bd60ab2e094b078ffe3de9011694a975c5c84ae8103aa18a73093dc3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHide.man
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\HidHide.man
                      • Size 7KB
                      • SHA256 b31b1a14cc5812492556b0ce84a2872c76d93ab0dd0778dffa60ffb04a86b8d7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHide.msi
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\HidHide.msi
                      • Size 3.8MB
                      • SHA256 974f2f56bb9d87e760ffdc757bbaa1ad94cefb57431d73b1e5e209f262b8c9f7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHide.pdb
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHide.pdb
                      • Size 820KB
                      • SHA256 456760f76b3c5b0ec71007b33529f77e0251fae03a87335359dac61b1f99688d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHideCLI.exe
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHideCLI.exe
                      • Size 217KB
                      • SHA256 9dd283fedfbd301e1a574a3d4b8663f6274ccb5c896f468ed55a6239f9ade270
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHideClient.exe
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHideClient.exe
                      • Size 323KB
                      • SHA256 4af4752f0564e9c2a2b139b05da4bbfcc4ab111a03033319eb38b7ec9b070a45
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHideWatchdog.exe
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHideWatchdog.exe
                      • Size 1.4MB
                      • SHA256 8b41058f5bbcdf85af44489402b808f4e3a2b44b81afc1c89169ac29501aab93
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHide.inf
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHide\HidHide.inf
                      • Size 6KB
                      • SHA256 38bf0541d798991a893e5ddac37430d097361726a00cd714c287da7a774722df
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHide.sys
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHide\HidHide.sys
                      • Size 57KB
                      • SHA256 e3bb8b6a4e4ff90290b34e710edbef88cf71cec6ba0cadcb8e1685d5dd65ddb2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      LICENSE.rtf
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHide\LICENSE.rtf
                      • Size 5KB
                      • SHA256 62356ad799305776ddd2fdf7b178ec9755e17ed980da560e3887b883465825e0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      hidhide.cat
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHide\hidhide.cat
                      • Size 11KB
                      • SHA256 0e4209963524163b3b75302c60f7b8a965fc349ada5752b74452ad59d417e877
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      install.cmd
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\install.cmd
                      • Size 534B
                      • SHA256 e67286e3a77fef32f0b9500a68ef06737e40352167b74d8bf3e876cc70f84f48
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      nefarius_HidHide_Updater.exe
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\nefarius_HidHide_Updater.exe
                      • Size 2.2MB
                      • SHA256 128ceb8c6b5e9f32261b55ba904234ed52e26d03c9b92422cd2cf8b101bc1a88
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      nefconw.exe
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\nefconw.exe
                      • Size 543KB
                      • SHA256 1482fa240cad984e02206427f1eb211e62c9a44b058484fc3e83ccb5b1a1fbca
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uninstall.cmd
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\uninstall.cmd
                      • Size 540B
                      • SHA256 41c117393b0c82625a4b05a7ae647e5bbcc350c791b2849fc25bf0bacd6f2d3b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                      • Size 471B
                      • SHA256 f24819377506cffbbc34f9fd055fb8991378eb55d87e7b7fd81e4fd511b3272f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      8EC9B1D0ABBD7F98B401D425828828CE_35E9AC8BDBFF76B8DAD6DDAFD42E3BC2
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_35E9AC8BDBFF76B8DAD6DDAFD42E3BC2
                      • Size 727B
                      • SHA256 f67a371774de29cea69ac5ebbda62be78cb39e233ba423aab6c517f84783fc8d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                      • Size 727B
                      • SHA256 5eb0b2fdc40aca70fd0464567e5fddc6b6594feb30d170fed0695ce22a4e77b0
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                      • Size 400B
                      • SHA256 80c89aeb2b8109a7d153bd9dabee6dcc1fdd2cb8a343c3864ae7e6620ad0aed9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      8EC9B1D0ABBD7F98B401D425828828CE_35E9AC8BDBFF76B8DAD6DDAFD42E3BC2
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_35E9AC8BDBFF76B8DAD6DDAFD42E3BC2
                      • Size 408B
                      • SHA256 50e77f983edac8099933566456c758d8be907ce1070081873b7df9f7193eb4a4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                      • Size 412B
                      • SHA256 f5716586d5d59a35684b8d67a96c671e69073bf8813d39c592612ebbb3bfd796
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      powershell.exe.log
                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                      • Size 2KB
                      • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 9d031d7193142f7120476fe181006807652ca4a8caec8fbab3f4e4f86e451049
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      MSI7C8A.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\MSI7C8A.tmp
                      • Size 738KB
                      • SHA256 8d3e94c47af3da706a9fe9e4428b2fefd5e9e6c7145e96927fffdf3dd5e472b8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSI7D1A.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\MSI7D1A.tmp
                      • Size 870KB
                      • SHA256 80c5e769470bb98c5b1ec3be0a9a51f0821c67e9adc7e3e254bbc41183ceb76f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      __PSScriptPolicyTest_ocb0rcxh.jxi.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ocb0rcxh.jxi.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      ViGEm.msi
                      • Path C:\ViGEm.msi
                      • Size 856KB
                      • SHA256 5abbba8a4a07aaaeb50b4666183b2f243e0e5ad288026d2a9f3595ed237c4b28
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSI69EC.tmp
                      • Path C:\Windows\Installer\MSI69EC.tmp
                      • Size 211KB
                      • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ViGEmBus.sys
                      • Path \??\c:\PROGRA~1\NEFARI~1\VIRTUA~1\ViGEmBus.sys
                      • Size 161KB
                      • SHA256 8fb8402b7266fa9b9ea8841708317c8c25367b2947eeda9b6462c0e4801f05a4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ViGEmBus.cat
                      • Path \??\c:\program files\nefarius software solutions\virtual gamepad emulation bus driver\ViGEmBus.cat
                      • Size 10KB
                      • SHA256 58b8a1bf9160fd4310a183b3431580eda2bc0a5ecaac2e0fbd6399184ff02404
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/1380-332-0x00007FF7FEB30000-0x00007FF7FEFC8000-memory.dmp
                      Download

                      memory/1380-329-0x00007FF7FEB30000-0x00007FF7FEFC8000-memory.dmp
                      Download

                      memory/3180-31-0x000001AECB890000-0x000001AECB9DE000-memory.dmp
                      Download

                      memory/3216-345-0x00007FF7FEB30000-0x00007FF7FEFC8000-memory.dmp
                      Download

                      memory/3216-352-0x00007FF7FEB30000-0x00007FF7FEFC8000-memory.dmp
                      Download

                      memory/3216-356-0x00007FF7FEB30000-0x00007FF7FEFC8000-memory.dmp
                      Download

                      memory/3244-344-0x00007FF7FEB30000-0x00007FF7FEFC8000-memory.dmp
                      Download

                      memory/3244-349-0x00007FF7FEB30000-0x00007FF7FEFC8000-memory.dmp
                      Download

                      memory/3244-354-0x00007FF7FEB30000-0x00007FF7FEFC8000-memory.dmp
                      Download

                      memory/3816-10-0x0000026444E60000-0x0000026444FAE000-memory.dmp
                      Download

                      memory/3816-6-0x0000026444C30000-0x0000026444C52000-memory.dmp
                      Download

                      memory/5076-21-0x00000226A4950000-0x00000226A4A9E000-memory.dmp
                      Download