Overview

overview

9

Static

static

3

2026-08-09...lc.exe

windows10-2004-x64

9

2026-08-09...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 21:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_b624d0e60a0b78eb72656d853db46a2d_amadey_darkgate_hijackloader_icedid_luca-stealer_njrat_remcos_stealc.exe
  • Size 8.9MB
  • Sample260809-1ldpyscf36
  • SHA256 25c0d6ff06cfaf77641154902a23acd97e5f8f9b7bf9bebbe4ec4d29c7d4092a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 14 IoCs
  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 3 IoCs

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 11 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 35 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 43 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 13 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 51 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_b624d0e60a0b78eb72656d853db46a2d_amadey_darkgate_hijackloader_icedid_luca-stealer_njrat_remcos_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_b624d0e60a0b78eb72656d853db46a2d_amadey_darkgate_hijackloader_icedid_luca-stealer_njrat_remcos_stealc.exe"
    1⤵
    • Downloads MZ/PE file
    • Suspicious use of WriteProcessMemory
    PID:5192
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config w32time start= auto
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4796
      • C:\Windows\system32\sc.exe
        sc config w32time start= auto
        3⤵
        • Launches sc.exe
        PID:5448
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net start w32time
      2⤵
      • Executes a command shell one-liner
      • System Time Discovery
      • Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Windows\system32\net.exe
        net start w32time
        3⤵
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 start w32time
          4⤵
          • System Time Discovery
          PID:824
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c w32tm /config /manualpeerlist:"time.cloudflare.com time.google.com time.windows.com" /syncfromflags:manual /reliable:yes /update
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5076
      • C:\Windows\system32\w32tm.exe
        w32tm /config /manualpeerlist:"time.cloudflare.com time.google.com time.windows.com" /syncfromflags:manual /reliable:yes /update
        3⤵
          PID:2764
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c w32tm /resync /force
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3332
        • C:\Windows\system32\w32tm.exe
          w32tm /resync /force
          3⤵
            PID:4308
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          2⤵
          • Executes a command shell one-liner
          PID:2940
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
            3⤵
              PID:3812
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\\'
            2⤵
            • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
            • Suspicious use of WriteProcessMemory
            PID:2324
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe Add-MpPreference -ExclusionPath 'C:\\'
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5092
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "$env:USERPROFILE\Downloads"
            2⤵
            • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
            • Suspicious use of WriteProcessMemory
            PID:876
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe Add-MpPreference -ExclusionPath "$env:USERPROFILE\Downloads"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1400
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v HwSchMode /t REG_DWORD /d 1 /f
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1548
            • C:\Windows\system32\reg.exe
              reg add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v HwSchMode /t REG_DWORD /d 1 /f
              3⤵
                PID:5388
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "$env:USERPROFILE\Downloads"
              2⤵
              • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
              • Suspicious use of WriteProcessMemory
              PID:1068
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe Add-MpPreference -ExclusionPath "$env:USERPROFILE\Downloads"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3348
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c reg add "HKCU\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 0 /f
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5700
              • C:\Windows\system32\reg.exe
                reg add "HKCU\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 0 /f
                3⤵
                  PID:4648
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c reg add "HKCU\Control Panel\Mouse" /v MouseThreshold1 /t REG_SZ /d 0 /f
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4080
                • C:\Windows\system32\reg.exe
                  reg add "HKCU\Control Panel\Mouse" /v MouseThreshold1 /t REG_SZ /d 0 /f
                  3⤵
                    PID:6020
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c reg add "HKCU\Control Panel\Mouse" /v MouseThreshold2 /t REG_SZ /d 0 /f
                  2⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4516
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Control Panel\Mouse" /v MouseThreshold2 /t REG_SZ /d 0 /f
                    3⤵
                      PID:4816
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
                    2⤵
                    • Power Settings
                    PID:5552
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -setactive scheme_current
                    2⤵
                    • Power Settings
                    PID:2732
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
                    2⤵
                    • Power Settings
                    PID:2400
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMAX 100
                    2⤵
                    • Power Settings
                    PID:3368
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -setacvalueindex scheme_current sub_usb USBSELECTIVE SUSPEND 0
                    2⤵
                    • Power Settings
                    PID:1888
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -setacvalueindex scheme_current sub_pcie ASPM 0
                    2⤵
                    • Power Settings
                    PID:2360
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -change -monitor-timeout-ac 0
                    2⤵
                    • Power Settings
                    PID:1432
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -change -disk-timeout-ac 0
                    2⤵
                    • Power Settings
                    PID:3840
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -change -standby-timeout-ac 0
                    2⤵
                    • Power Settings
                    PID:2620
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -change -hibernate-timeout-ac 0
                    2⤵
                    • Power Settings
                    PID:548
                  • C:\Windows\SYSTEM32\powercfg.exe
                    powercfg -setactive scheme_current
                    2⤵
                    • Power Settings
                    PID:6052
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c cls
                    2⤵
                    • Executes a command shell one-liner
                    PID:3076
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c msiexec /i "C:\ViGEm.msi" /quiet /norestart
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:4132
                    • C:\Windows\system32\msiexec.exe
                      msiexec /i "C:\ViGEm.msi" /quiet /norestart
                      3⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:4360
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\HidHide.exe /quiet /norestart
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:4844
                    • C:\HidHide.exe
                      C:\HidHide.exe /quiet /norestart
                      3⤵
                      • Executes dropped EXE
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:1976
                      • C:\Windows\SysWOW64\msiexec.exe
                        "C:\Windows\system32\msiexec.exe" /i "C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\HidHide.msi" /quiet /norestart AI_SETUPEXEPATH=C:\HidHide.exe SETUPEXEDIR=C:\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1786071110 /quiet /norestart " REBOOT="ReallySuppress"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:556
                  • C:\Detector.exe
                    "C:\Detector.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:4552
                • C:\Windows\system32\msiexec.exe
                  C:\Windows\system32\msiexec.exe /V
                  1⤵
                  • Enumerates connected drives
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1492
                  • C:\Windows\syswow64\MsiExec.exe
                    C:\Windows\syswow64\MsiExec.exe -Embedding D3C8C0E44B97FC2270FBD70593041F58 E Global\MSI0000
                    2⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4528
                    • C:\Program Files\Nefarius Software Solutions\Virtual Gamepad Emulation Bus Driver\devcon.exe
                      "C:\Program Files\Nefarius Software Solutions\Virtual Gamepad Emulation Bus Driver\devcon.exe" install "C:\Program Files\Nefarius Software Solutions\Virtual Gamepad Emulation Bus Driver\ViGEmBus.inf" Nefarius\ViGEmBus\Gen1
                      3⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      • Checks SCSI registry key(s)
                      • Modifies data under HKEY_USERS
                      PID:2624
                  • C:\Windows\syswow64\MsiExec.exe
                    C:\Windows\syswow64\MsiExec.exe -Embedding 9E3A637F98F71D53F149BD967C899FC9 C
                    2⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:5084
                  • C:\Windows\syswow64\MsiExec.exe
                    C:\Windows\syswow64\MsiExec.exe -Embedding 31B06DD38E8BEF45C60911D57E0D2162
                    2⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3736
                  • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
                    "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --create-device-node --hardware-id root\HidHide --class-name System --class-guid 4D36E97D-E325-11CE-BFC1-08002BE10318
                    2⤵
                    • Executes dropped EXE
                    PID:2204
                  • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
                    "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --install-driver --inf-path "C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHide\HidHide.inf"
                    2⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    PID:1080
                  • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
                    "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --add-class-filter --position upper --service-name HidHide --class-guid 745a17a0-74d3-11d0-b6fe-00a0c90f57da
                    2⤵
                    • Executes dropped EXE
                    PID:4076
                  • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
                    "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --add-class-filter --position upper --service-name HidHide --class-guid d61ca365-5af4-4486-998b-9db4734c6ca3
                    2⤵
                    • Executes dropped EXE
                    PID:1308
                  • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
                    "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --add-class-filter --position upper --service-name HidHide --class-guid 05f5cfe2-4733-4950-a6bb-07aad01a3a84
                    2⤵
                    • Executes dropped EXE
                    PID:2476
                  • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe
                    "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe" --install --override-success-code 0
                    2⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in Program Files directory
                    • NTFS ADS
                    PID:5492
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "1" "c:\program files\nefarius software solutions\virtual gamepad emulation bus driver\vigembus.inf" "9" "429a86e87" "0000000000000190" "WinSta0\Default" "00000000000000E0" "208" "c:\program files\nefarius software solutions\virtual gamepad emulation bus driver"
                  1⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies data under HKEY_USERS
                  PID:2828
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\System32\DriverStore\FileRepository\vigembus.inf_amd64_f92aab85c34952aa\vigembus.inf" "oem1.inf:c14ce88408607219:ViGEmBus_Device:1.17.333.0:nefarius\vigembus\gen1," "429a86e87" "0000000000000190" "5e0"
                  1⤵
                  • Drops file in Drivers directory
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  PID:2572
                • C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHideWatchdog.exe
                  "C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHideWatchdog.exe"
                  1⤵
                  • Executes dropped EXE
                  PID:2816
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6a009f2e-f4d8-bd47-abd5-734770396e1f}\HidHide.inf" "9" "49f2aa4cb" "0000000000000190" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHide"
                  1⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies data under HKEY_USERS
                  PID:3412
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "201" "ROOT\SYSTEM\0002" "C:\Windows\System32\DriverStore\FileRepository\hidhide.inf_amd64_7c068d69bd48dffd\hidhide.inf" "oem2.inf:*:*:1.4.181.0:root\HidHide," "49f2aa4cb" "0000000000000190" "5e0"
                  1⤵
                  • Drops file in Drivers directory
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  PID:2464
                • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe
                  "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe" --autostart
                  1⤵
                  • Executes dropped EXE
                  PID:2696
                • C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe
                  "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe"
                  1⤵
                  • Executes dropped EXE
                  PID:3028

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      2
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Windows Command Shell

                      1
                      T1059.003

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Power Settings

                      1
                      T1653

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      File/Path Exclusions

                      1
                      T1564.012

                      Impair Defenses

                      1
                      T1562

                      Disable or Modify Tools

                      1
                      T1562.001

                      Modify Registry

                      1
                      T1112

                      Credential Access

                      Discovery

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      3
                      T1012

                      System Information Discovery

                      3
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Time Discovery

                      1
                      T1124

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      e59a08f.rbs
                      • Path C:\Config.Msi\e59a08f.rbs
                      • Size 8KB
                      • SHA256 5bb3957446fac0d57eadfef250062ceb6cac9aa484ef7c40046a9c40309b265f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e59a094.rbs
                      • Path C:\Config.Msi\e59a094.rbs
                      • Size 14KB
                      • SHA256 380fb6b281cebbc0e4ad88778249dc4e793349144a93f55fa07f8689d05ba7a4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHide.exe
                      • Path C:\HidHide.exe
                      • Size 7.7MB
                      • SHA256 f4bbbcb82e6258641b887c74bc81c4c5f66e4aa811808dfc304347687b7605f6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ViGEmBus.inf
                      • Path C:\Program Files\Nefarius Software Solutions\Virtual Gamepad Emulation Bus Driver\ViGEmBus.inf
                      • Size 3KB
                      • SHA256 634b032a33cecbf2e43c46c5896a3c359cdda452c632da6396452419ffa301d6
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      devcon.exe
                      • Path C:\Program Files\Nefarius Software Solutions\Virtual Gamepad Emulation Bus Driver\devcon.exe
                      • Size 494KB
                      • SHA256 6591ea75bd60ab2e094b078ffe3de9011694a975c5c84ae8103aa18a73093dc3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHide.man
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\HidHide.man
                      • Size 7KB
                      • SHA256 b31b1a14cc5812492556b0ce84a2872c76d93ab0dd0778dffa60ffb04a86b8d7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHide.msi
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\HidHide.msi
                      • Size 3.8MB
                      • SHA256 974f2f56bb9d87e760ffdc757bbaa1ad94cefb57431d73b1e5e209f262b8c9f7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHide.pdb
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHide.pdb
                      • Size 820KB
                      • SHA256 456760f76b3c5b0ec71007b33529f77e0251fae03a87335359dac61b1f99688d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHideCLI.exe
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHideCLI.exe
                      • Size 217KB
                      • SHA256 9dd283fedfbd301e1a574a3d4b8663f6274ccb5c896f468ed55a6239f9ade270
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHideClient.exe
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHideClient.exe
                      • Size 323KB
                      • SHA256 4af4752f0564e9c2a2b139b05da4bbfcc4ab111a03033319eb38b7ec9b070a45
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHideWatchdog.exe
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHideWatchdog.exe
                      • Size 1.4MB
                      • SHA256 8b41058f5bbcdf85af44489402b808f4e3a2b44b81afc1c89169ac29501aab93
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHide.inf
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHide\HidHide.inf
                      • Size 6KB
                      • SHA256 38bf0541d798991a893e5ddac37430d097361726a00cd714c287da7a774722df
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HidHide.sys
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHide\HidHide.sys
                      • Size 57KB
                      • SHA256 e3bb8b6a4e4ff90290b34e710edbef88cf71cec6ba0cadcb8e1685d5dd65ddb2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      LICENSE.rtf
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHide\LICENSE.rtf
                      • Size 5KB
                      • SHA256 62356ad799305776ddd2fdf7b178ec9755e17ed980da560e3887b883465825e0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      hidhide.cat
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\HidHide\hidhide.cat
                      • Size 11KB
                      • SHA256 0e4209963524163b3b75302c60f7b8a965fc349ada5752b74452ad59d417e877
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      install.cmd
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\install.cmd
                      • Size 534B
                      • SHA256 e67286e3a77fef32f0b9500a68ef06737e40352167b74d8bf3e876cc70f84f48
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      nefarius_HidHide_Updater.exe
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\nefarius_HidHide_Updater.exe
                      • Size 2.2MB
                      • SHA256 128ceb8c6b5e9f32261b55ba904234ed52e26d03c9b92422cd2cf8b101bc1a88
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      nefconw.exe
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\nefconw.exe
                      • Size 543KB
                      • SHA256 1482fa240cad984e02206427f1eb211e62c9a44b058484fc3e83ccb5b1a1fbca
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uninstall.cmd
                      • Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\x64\uninstall.cmd
                      • Size 540B
                      • SHA256 41c117393b0c82625a4b05a7ae647e5bbcc350c791b2849fc25bf0bacd6f2d3b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 5c65d63e52757415f4ee5eee76c876f436ee2a282970067cc43a4eb0f7d2392d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      MSIAF90.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\MSIAF90.tmp
                      • Size 738KB
                      • SHA256 8d3e94c47af3da706a9fe9e4428b2fefd5e9e6c7145e96927fffdf3dd5e472b8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSIB187.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\MSIB187.tmp
                      • Size 870KB
                      • SHA256 80c5e769470bb98c5b1ec3be0a9a51f0821c67e9adc7e3e254bbc41183ceb76f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      __PSScriptPolicyTest_lykgk4zi.cnl.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lykgk4zi.cnl.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      ViGEm.msi
                      • Path C:\ViGEm.msi
                      • Size 856KB
                      • SHA256 5abbba8a4a07aaaeb50b4666183b2f243e0e5ad288026d2a9f3595ed237c4b28
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSIA38A.tmp
                      • Path C:\Windows\Installer\MSIA38A.tmp
                      • Size 211KB
                      • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dberr.txt
                      • Path C:\Windows\System32\CatRoot2\dberr.txt
                      • Size 64KB
                      • SHA256 c0f1da4719b22f2cfa2472e1a39910ba64656a17455c9a7abcd6f2844f079ad8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      hidhide.inf_amd64_7c068d69bd48dffd.ini
                      • Path C:\Windows\System32\DriverStore\FileRepository\hidhide.inf_amd64_7c068d69bd48dffd.ini
                      • Size 416B
                      • SHA256 f1045594b406be499b807fb0c9463d067ad61ab2954f498cb5a013f9902cfe0b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      vigembus.inf_amd64_f92aab85c34952aa.ini
                      • Path C:\Windows\System32\DriverStore\FileRepository\vigembus.inf_amd64_f92aab85c34952aa.ini
                      • Size 421B
                      • SHA256 23c6ffe5e53f18e7fd4ca33009856a7b735322ab61c6298b33a3ac132d1f54ec
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      ViGEmBus.sys
                      • Path \??\c:\PROGRA~1\NEFARI~1\VIRTUA~1\ViGEmBus.sys
                      • Size 161KB
                      • SHA256 8fb8402b7266fa9b9ea8841708317c8c25367b2947eeda9b6462c0e4801f05a4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ViGEmBus.cat
                      • Path \??\c:\program files\nefarius software solutions\virtual gamepad emulation bus driver\ViGEmBus.cat
                      • Size 10KB
                      • SHA256 58b8a1bf9160fd4310a183b3431580eda2bc0a5ecaac2e0fbd6399184ff02404
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/1400-14-0x000001A26B2A0000-0x000001A26B352000-memory.dmp
                      Download

                      memory/2696-234-0x00007FF66CE80000-0x00007FF66D318000-memory.dmp
                      Download

                      memory/2696-237-0x00007FF66CE80000-0x00007FF66D318000-memory.dmp
                      Download

                      memory/3028-235-0x00007FF66CE80000-0x00007FF66D318000-memory.dmp
                      Download

                      memory/5092-2-0x00000248F50F0000-0x00000248F5112000-memory.dmp
                      Download

                      memory/5092-7-0x00000248F5690000-0x00000248F569A000-memory.dmp
                      Download

                      memory/5092-6-0x00000248F5720000-0x00000248F57D2000-memory.dmp
                      Download

                      memory/5092-5-0x00000248F5700000-0x00000248F571E000-memory.dmp
                      Download

                      memory/5492-214-0x00007FF66CE80000-0x00007FF66D318000-memory.dmp
                      Download

                      memory/5492-217-0x00007FF66CE80000-0x00007FF66D318000-memory.dmp
                      Download