4cd01d04c48a1634a763486df5fc318a6d587090111f9065cd481490e7a3adc9

Analysis

user interaction
yes
max time kernel
97s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Throwback_patched.exe
Size 62.9MB
Sample261113-fffl5sfx2s
SHA256 4cd01d04c48a1634a763486df5fc318a6d587090111f9065cd481490e7a3adc9
MD5 5788e83af56235fc7ed312e50132c5dc
SHA1 6f46ec972ce100d081268180a03649e2d028a7be
SHA512 cea7cbf80232b154ec65c0faf3b3505fb2b98e08c79bf1b0cf97c52c4735de46ff379f1cd6f2bf05634a987c5301064635c47981dd03c1e18091166285fb0295
SSDEEP 1572864:R9X43ghcuCiG6RiBEFyWC9rpiyNjiAsblFmKEypv3fAwZLlFIe:Rh4whYiGl6yTr/cb/mKEK3ZD
TLSH
T153E733C4F76148B6FD71683496B22D0477A339D91B3AD5E709F647A22F0F0C4A6307AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence ransomware upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\HidHide.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\ViGEmBus.sys	DrvInst.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	ViGEmBus.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	HidHide.exe

Executes dropped EXE 15 IoCs

pid	Process
1312	ViGEmBus.exe
700	ViGEmBus.exe
628	nefconw.exe
4136	nefconw.exe
4016	HidHide.exe
2672	HidHide.exe
4536	HidHideWatchdog.exe
4156	nefconw.exe
2984	nefconw.exe
556	nefconw.exe
1620	nefconw.exe
4480	nefconw.exe
4476	nefarius_HidHide_Updater.exe
4348	nefarius_HidHide_Updater.exe
4452	nefarius_HidHide_Updater.exe

Loads dropped DLL 64 IoCs

pid	Process
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
1588	Throwback_patched.exe
5972	MsiExec.exe
5972	MsiExec.exe
5972	MsiExec.exe
5972	MsiExec.exe
5972	MsiExec.exe
5972	MsiExec.exe
5972	MsiExec.exe
5972	MsiExec.exe
5972	MsiExec.exe
5972	MsiExec.exe
2328	MsiExec.exe
2328	MsiExec.exe
2328	MsiExec.exe
2328	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe
2872	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nefarius_HidHide_Updater = "\"C:\\Program Files\\Nefarius Software Solutions\\HidHide\\x64\\nefarius_HidHide_Updater.exe\" --autostart"	nefarius_HidHide_Updater.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	ViGEmBus.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	ViGEmBus.exe
File opened (read-only)	\??\Z:	ViGEmBus.exe
File opened (read-only)	\??\T:	HidHide.exe
File opened (read-only)	\??\Z:	HidHide.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	HidHide.exe
File opened (read-only)	\??\Z:	ViGEmBus.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	HidHide.exe
File opened (read-only)	\??\N:	HidHide.exe
File opened (read-only)	\??\V:	HidHide.exe
File opened (read-only)	\??\P:	HidHide.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	ViGEmBus.exe
File opened (read-only)	\??\V:	ViGEmBus.exe
File opened (read-only)	\??\B:	HidHide.exe
File opened (read-only)	\??\S:	HidHide.exe
File opened (read-only)	\??\Y:	HidHide.exe
File opened (read-only)	\??\B:	ViGEmBus.exe
File opened (read-only)	\??\Y:	ViGEmBus.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	HidHide.exe
File opened (read-only)	\??\Q:	ViGEmBus.exe
File opened (read-only)	\??\A:	HidHide.exe
File opened (read-only)	\??\E:	HidHide.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	ViGEmBus.exe
File opened (read-only)	\??\W:	ViGEmBus.exe
File opened (read-only)	\??\M:	ViGEmBus.exe
File opened (read-only)	\??\J:	ViGEmBus.exe
File opened (read-only)	\??\H:	HidHide.exe
File opened (read-only)	\??\U:	HidHide.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	HidHide.exe
File opened (read-only)	\??\J:	HidHide.exe
File opened (read-only)	\??\L:	HidHide.exe
File opened (read-only)	\??\P:	HidHide.exe
File opened (read-only)	\??\E:	ViGEmBus.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	HidHide.exe
File opened (read-only)	\??\J:	HidHide.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	ViGEmBus.exe
File opened (read-only)	\??\E:	HidHide.exe
File opened (read-only)	\??\W:	HidHide.exe
File opened (read-only)	\??\A:	ViGEmBus.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	HidHide.exe
File opened (read-only)	\??\X:	ViGEmBus.exe
File opened (read-only)	\??\B:	HidHide.exe
File opened (read-only)	\??\I:	HidHide.exe
File opened (read-only)	\??\I:	ViGEmBus.exe
File opened (read-only)	\??\M:	ViGEmBus.exe
File opened (read-only)	\??\G:	HidHide.exe
File opened (read-only)	\??\O:	HidHide.exe
File opened (read-only)	\??\W:	HidHide.exe
File opened (read-only)	\??\O:	HidHide.exe
File opened (read-only)	\??\H:	ViGEmBus.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
1180	powershell.exe
4608	powershell.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{75eb62f2-e099-0443-91d1-81df0f5f05d5}\SET4E71.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vigembus.inf_amd64_bde72e7428095b1a\ViGEmBus.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{05190b7b-c327-b94f-969d-9179eb0a3eb5}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hidhide.inf_amd64_7c068d69bd48dffd\HidHide.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{75eb62f2-e099-0443-91d1-81df0f5f05d5}\SET4E70.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{75eb62f2-e099-0443-91d1-81df0f5f05d5}\SET4E70.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{05190b7b-c327-b94f-969d-9179eb0a3eb5}\SET9EF7.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{75eb62f2-e099-0443-91d1-81df0f5f05d5}\SET4E60.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{05190b7b-c327-b94f-969d-9179eb0a3eb5}\ViGEmBus.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{05190b7b-c327-b94f-969d-9179eb0a3eb5}\ViGEmBus.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vigembus.inf_amd64_bde72e7428095b1a\ViGEmBus.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{75eb62f2-e099-0443-91d1-81df0f5f05d5}\SET4E60.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{75eb62f2-e099-0443-91d1-81df0f5f05d5}\HidHide.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hidhide.inf_amd64_7c068d69bd48dffd\HidHide.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{05190b7b-c327-b94f-969d-9179eb0a3eb5}\SET9EE6.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{05190b7b-c327-b94f-969d-9179eb0a3eb5}\SET9EE7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{75eb62f2-e099-0443-91d1-81df0f5f05d5}\HidHide.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vigembus.inf_amd64_bde72e7428095b1a\ViGEmBus.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{75eb62f2-e099-0443-91d1-81df0f5f05d5}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hidhide.inf_amd64_7c068d69bd48dffd\HidHide.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{05190b7b-c327-b94f-969d-9179eb0a3eb5}\ViGEmBus.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{05190b7b-c327-b94f-969d-9179eb0a3eb5}\SET9EE7.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{05190b7b-c327-b94f-969d-9179eb0a3eb5}\SET9EF7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{75eb62f2-e099-0443-91d1-81df0f5f05d5}\HidHide.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{75eb62f2-e099-0443-91d1-81df0f5f05d5}\SET4E71.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hidhide.inf_amd64_7c068d69bd48dffd\HidHide.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{05190b7b-c327-b94f-969d-9179eb0a3eb5}\SET9EE6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vigembus.inf_amd64_bde72e7428095b1a\ViGEmBus.inf	DrvInst.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4476-835-0x00007FF6F0920000-0x00007FF6F0DB8000-memory.dmp	upx
behavioral1/memory/4476-838-0x00007FF6F0920000-0x00007FF6F0DB8000-memory.dmp	upx
behavioral1/memory/4348-846-0x00007FF6F0920000-0x00007FF6F0DB8000-memory.dmp	upx
behavioral1/memory/4452-856-0x00007FF6F0920000-0x00007FF6F0DB8000-memory.dmp	upx
behavioral1/memory/4348-858-0x00007FF6F0920000-0x00007FF6F0DB8000-memory.dmp	upx
behavioral1/memory/4452-867-0x00007FF6F0920000-0x00007FF6F0DB8000-memory.dmp	upx

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\Nefarius Software Solutions\HidHide\HidHide.man	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\nefconw.exe	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\ViGEmBus.pdb	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\HidHide\x64\install.cmd	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHide\HidHide.inf	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHideWatchdog.exe	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHide.pdb	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHideCLI.exe	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHide\hidhide.cat	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\ViGEmBus.sys	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\LICENSE	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHide\LICENSE.rtf	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHide\HidHide.sys	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe:updater.dll	nefarius_HidHide_Updater.exe
File created	C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\vigembus.cat	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\ViGEmBus.inf	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHideClient.exe	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe	msiexec.exe
File created	C:\Program Files\Nefarius Software Solutions\HidHide\x64\uninstall.cmd	msiexec.exe

Drops file in Windows directory 38 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{01E0AB21-D1CC-42B4-9DFF-84FFE4F26DAF}	msiexec.exe
File created	C:\Windows\Installer\{01E0AB21-D1CC-42B4-9DFF-84FFE4F26DAF}\Application.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{01E0AB21-D1CC-42B4-9DFF-84FFE4F26DAF}\Application.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	nefconw.exe
File opened for modification	C:\Windows\Installer\MSI9796.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e599573.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A46.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{966606F3-2745-49E9-BF15-5C3EAA4E9077}\ViGEm.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI40FC.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\e599570.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9737.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3FE0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e599570.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9707.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{966606F3-2745-49E9-BF15-5C3EAA4E9077}	msiexec.exe
File created	C:\Windows\Installer\e599572.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\{966606F3-2745-49E9-BF15-5C3EAA4E9077}\ViGEm.exe	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI40BD.tmp	msiexec.exe
File created	C:\Windows\Installer\e599575.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	nefconw.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI964B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e599573.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F42.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3FC0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI440A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI401F.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ViGEmBus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	nefarius_HidHide_Updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Throwback_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Throwback_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ViGEmBus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	nefarius_HidHide_Updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	nefarius_HidHide_Updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	nefarius_HidHide_Updater.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ViGEmBus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HidHide.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ViGEmBus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HidHide.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	nefconw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	nefconw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	nefconw.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000069bf6088149b83f10000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000069bf60880000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090069bf6088000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a69bf6088000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d69bf6088000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	nefconw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	nefconw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	nefconw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	nefconw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	nefconw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	nefconw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	nefconw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	nefconw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	nefconw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	nefconw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	nefconw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	nefconw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	nefconw.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Modifies registry class 53 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C6F5717681AA7A34EA06F23CDF01FB97\3F60666954729E94FB51C5E3AAE40977	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\HidHide = "MainFeature"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\Version = "17105126"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3F60666954729E94FB51C5E3AAE40977	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\Language = "2057"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\SourceList\Net\1 = "C:\\ProgramData\\Nefarius Software Solutions\\HidHide 1.5.230\\install\\4F26DAF\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3F60666954729E94FB51C5E3AAE40977\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3F60666954729E94FB51C5E3AAE40977\AI64BitFiles	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\PackageCode = "92A54B817709BE343A2CC8F581972C19"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\ProductIcon = "C:\\Windows\\Installer\\{966606F3-2745-49E9-BF15-5C3EAA4E9077}\\ViGEm.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C6F5717681AA7A34EA06F23CDF01FB97	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Nefarius Software Solutions\\ViGEm Bus Driver 1.22.0\\install\\A4E9077\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\HidHide_HID = "MainFeature"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\Version = "18219008"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\SourceList\PackageName = "ViGEmBus.x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\ProductName = "HidHide"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\PackageCode = "520FA66DDA224944AA5118C5CE005439"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\ProductName = "ViGEm Bus Driver"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12BA0E10CC1D4B24D9FF48FF4E2FD6FA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\C4FE6FD5B7C4D07B3A313E754A9A6A8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\HidHide_1 = "HidHide"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\07CC22885A2E7BC4F8412E171051A0D1\12BA0E10CC1D4B24D9FF48FF4E2FD6FA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\SourceList\Net\1 = "C:\\ProgramData\\Nefarius Software Solutions\\ViGEm Bus Driver 1.22.0\\install\\A4E9077\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\SourceList\PackageName = "HidHide.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Nefarius Software Solutions\\HidHide 1.5.230\\install\\4F26DAF\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F60666954729E94FB51C5E3AAE40977\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12BA0E10CC1D4B24D9FF48FF4E2FD6FA\ProductIcon = "C:\\Windows\\Installer\\{01E0AB21-D1CC-42B4-9DFF-84FFE4F26DAF}\\Application.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\07CC22885A2E7BC4F8412E171051A0D1	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe:updater.dll	nefarius_HidHide_Updater.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1588	Throwback_patched.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1180	powershell.exe
1180	powershell.exe
5960	msiexec.exe
5960	msiexec.exe
4608	powershell.exe
4608	powershell.exe
4608	powershell.exe
5960	msiexec.exe
5960	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1588	Throwback_patched.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeSecurityPrivilege	5960	msiexec.exe
Token: SeCreateTokenPrivilege	1312	ViGEmBus.exe
Token: SeAssignPrimaryTokenPrivilege	1312	ViGEmBus.exe
Token: SeLockMemoryPrivilege	1312	ViGEmBus.exe
Token: SeIncreaseQuotaPrivilege	1312	ViGEmBus.exe
Token: SeMachineAccountPrivilege	1312	ViGEmBus.exe
Token: SeTcbPrivilege	1312	ViGEmBus.exe
Token: SeSecurityPrivilege	1312	ViGEmBus.exe
Token: SeTakeOwnershipPrivilege	1312	ViGEmBus.exe
Token: SeLoadDriverPrivilege	1312	ViGEmBus.exe
Token: SeSystemProfilePrivilege	1312	ViGEmBus.exe
Token: SeSystemtimePrivilege	1312	ViGEmBus.exe
Token: SeProfSingleProcessPrivilege	1312	ViGEmBus.exe
Token: SeIncBasePriorityPrivilege	1312	ViGEmBus.exe
Token: SeCreatePagefilePrivilege	1312	ViGEmBus.exe
Token: SeCreatePermanentPrivilege	1312	ViGEmBus.exe
Token: SeBackupPrivilege	1312	ViGEmBus.exe
Token: SeRestorePrivilege	1312	ViGEmBus.exe
Token: SeShutdownPrivilege	1312	ViGEmBus.exe
Token: SeDebugPrivilege	1312	ViGEmBus.exe
Token: SeAuditPrivilege	1312	ViGEmBus.exe
Token: SeSystemEnvironmentPrivilege	1312	ViGEmBus.exe
Token: SeChangeNotifyPrivilege	1312	ViGEmBus.exe
Token: SeRemoteShutdownPrivilege	1312	ViGEmBus.exe
Token: SeUndockPrivilege	1312	ViGEmBus.exe
Token: SeSyncAgentPrivilege	1312	ViGEmBus.exe
Token: SeEnableDelegationPrivilege	1312	ViGEmBus.exe
Token: SeManageVolumePrivilege	1312	ViGEmBus.exe
Token: SeImpersonatePrivilege	1312	ViGEmBus.exe
Token: SeCreateGlobalPrivilege	1312	ViGEmBus.exe
Token: SeCreateTokenPrivilege	1312	ViGEmBus.exe
Token: SeAssignPrimaryTokenPrivilege	1312	ViGEmBus.exe
Token: SeLockMemoryPrivilege	1312	ViGEmBus.exe
Token: SeIncreaseQuotaPrivilege	1312	ViGEmBus.exe
Token: SeMachineAccountPrivilege	1312	ViGEmBus.exe
Token: SeTcbPrivilege	1312	ViGEmBus.exe
Token: SeSecurityPrivilege	1312	ViGEmBus.exe
Token: SeTakeOwnershipPrivilege	1312	ViGEmBus.exe
Token: SeLoadDriverPrivilege	1312	ViGEmBus.exe
Token: SeSystemProfilePrivilege	1312	ViGEmBus.exe
Token: SeSystemtimePrivilege	1312	ViGEmBus.exe
Token: SeProfSingleProcessPrivilege	1312	ViGEmBus.exe
Token: SeIncBasePriorityPrivilege	1312	ViGEmBus.exe
Token: SeCreatePagefilePrivilege	1312	ViGEmBus.exe
Token: SeCreatePermanentPrivilege	1312	ViGEmBus.exe
Token: SeBackupPrivilege	1312	ViGEmBus.exe
Token: SeRestorePrivilege	1312	ViGEmBus.exe
Token: SeShutdownPrivilege	1312	ViGEmBus.exe
Token: SeDebugPrivilege	1312	ViGEmBus.exe
Token: SeAuditPrivilege	1312	ViGEmBus.exe
Token: SeSystemEnvironmentPrivilege	1312	ViGEmBus.exe
Token: SeChangeNotifyPrivilege	1312	ViGEmBus.exe
Token: SeRemoteShutdownPrivilege	1312	ViGEmBus.exe
Token: SeUndockPrivilege	1312	ViGEmBus.exe
Token: SeSyncAgentPrivilege	1312	ViGEmBus.exe
Token: SeEnableDelegationPrivilege	1312	ViGEmBus.exe
Token: SeManageVolumePrivilege	1312	ViGEmBus.exe
Token: SeImpersonatePrivilege	1312	ViGEmBus.exe
Token: SeCreateGlobalPrivilege	1312	ViGEmBus.exe
Token: SeCreateTokenPrivilege	1312	ViGEmBus.exe
Token: SeAssignPrimaryTokenPrivilege	1312	ViGEmBus.exe
Token: SeLockMemoryPrivilege	1312	ViGEmBus.exe
Token: SeIncreaseQuotaPrivilege	1312	ViGEmBus.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1312	ViGEmBus.exe
1312	ViGEmBus.exe
4016	HidHide.exe
4016	HidHide.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1588	2500	Throwback_patched.exe	86
PID 1588 wrote to memory of 1180	1588	Throwback_patched.exe	92
PID 1180 wrote to memory of 1312	1180	powershell.exe	94
PID 5960 wrote to memory of 5972	5960	msiexec.exe	99
PID 1312 wrote to memory of 700	1312	ViGEmBus.exe	103
PID 5960 wrote to memory of 5504	5960	msiexec.exe	110
PID 5960 wrote to memory of 2328	5960	msiexec.exe	112
PID 5960 wrote to memory of 628	5960	msiexec.exe	114
PID 5960 wrote to memory of 4136	5960	msiexec.exe	115
PID 2624 wrote to memory of 4236	2624	svchost.exe	117
PID 2624 wrote to memory of 5424	2624	svchost.exe	118
PID 1588 wrote to memory of 4608	1588	Throwback_patched.exe	120
PID 4608 wrote to memory of 4016	4608	powershell.exe	122
PID 5960 wrote to memory of 2872	5960	msiexec.exe	123
PID 4016 wrote to memory of 2672	4016	HidHide.exe	124
PID 5960 wrote to memory of 5916	5960	msiexec.exe	125
PID 5960 wrote to memory of 4156	5960	msiexec.exe	127
PID 5960 wrote to memory of 2984	5960	msiexec.exe	128
PID 2624 wrote to memory of 2652	2624	svchost.exe	129
PID 2624 wrote to memory of 4840	2624	svchost.exe	130
PID 5960 wrote to memory of 556	5960	msiexec.exe	131
PID 5960 wrote to memory of 1620	5960	msiexec.exe	132
PID 5960 wrote to memory of 4480	5960	msiexec.exe	133
PID 5960 wrote to memory of 4476	5960	msiexec.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Throwback_patched.exe
"C:\Users\Admin\AppData\Local\Temp\Throwback_patched.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\Throwback_patched.exe
  "C:\Users\Admin\AppData\Local\Temp\Throwback_patched.exe"
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "$ErrorActionPreference='Stop'; try { $p=Start-Process -FilePath $env:VIBRATION_DRIVER_INSTALLER -Verb RunAs -Wait -PassThru; exit $p.ExitCode } catch { Write-Error $_; exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\installers\ViGEmBus.exe
      "C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\installers\ViGEmBus.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Enumerates connected drives
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\installers\ViGEmBus.exe
        
        "C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\installers\ViGEmBus.exe" /i "C:\ProgramData\Nefarius Software Solutions\ViGEm Bus Driver 1.22.0\install\A4E9077\ViGEmBus.x64.msi" AI_EUIMSI=1 AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\installers\ViGEmBus.exe" IAgree="Yes" IAgreeInstall="Yes" APPDIR="C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\" AiLicenseAgreementLink="https://github.com/nefarius/ViGEmBus/blob/master/LICENSE" TARGETDIR="C:\" AppsShutdownOption="All" AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\installers\ViGEmBus.exe" AI_Bin32_Dir="C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\32-bit\" AI_ProgramFiles="C:\Program Files\" AI_INSTALL="1" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ViGEm Bus Driver" SECONDSEQUENCE="1" CLIENTPROCESSID="1312" AI_MORE_CMD_LINE=1
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        
        PID:700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "$ErrorActionPreference='Stop'; try { $p=Start-Process -FilePath $env:VIBRATION_DRIVER_INSTALLER -Verb RunAs -Wait -PassThru; exit $p.ExitCode } catch { Write-Error $_; exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\installers\HidHide.exe
      "C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\installers\HidHide.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\installers\HidHide.exe
        
        "C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\installers\HidHide.exe" /i "C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\HidHide.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\Nefarius Software Solutions\HidHide" SECONDSEQUENCE="1" CLIENTPROCESSID="4016" CHAINERUIPROCESSID="4016Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature,HidHide_1,C4FE6FD5B7C4D07B3A313E754A9A6A8,HidHide_HID,HidHide" PRIMARYFOLDER="APPDIR" ROOTDRIVE="F:\" AI_PREREQDIRS="C:\Users\Admin\AppData\Roaming" AI_FOUND_PREREQS="Visual C++ Redistributable for Visual Studio 2015-2022 x64" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\installers\HidHide.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\installers\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1794304625 " TARGETDIR="F:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\installers\HidHide.exe" AI_INSTALL="1"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        
        PID:2672

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x294 0x460
1⤵
PID:2432

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2D9A606D2DEEEE5B1FA3C6B4E8AA58AE C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5972
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5504
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 38870FB8871D9573D2AEEF45EA7A5A1D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2328
- C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\nefconw.exe
  "C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\nefconw.exe" --create-device-node --hardware-id Nefarius\ViGEmBus\Gen1 --class-name System --class-guid 4D36E97D-E325-11CE-BFC1-08002BE10318
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\nefconw.exe
  "C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\nefconw.exe" --install-driver --inf-path "C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\ViGEmBus.inf"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:4136
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BB1CFB64A5610A85F2461AC39414C047 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2872
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 72A2519117EA7F0B0FFD8247DDE3496C
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5916
- C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
  "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --create-device-node --hardware-id root\HidHide --class-name System --class-guid 4D36E97D-E325-11CE-BFC1-08002BE10318
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
  "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --install-driver --inf-path "C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHide\HidHide.inf"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:2984
- C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
  "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --add-class-filter --position upper --service-name HidHide --class-guid 745a17a0-74d3-11d0-b6fe-00a0c90f57da
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
  "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --add-class-filter --position upper --service-name HidHide --class-guid d61ca365-5af4-4486-998b-9db4734c6ca3
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe
  "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefconw.exe" --add-class-filter --position upper --service-name HidHide --class-guid 05f5cfe2-4733-4950-a6bb-07aad01a3a84
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe
  "C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe" --install --override-success-code 0
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - NTFS ADS
  PID:4476

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2c14bb94-4fd3-ee4a-8e51-3b3feb49ab5c}\ViGEmBus.inf" "9" "433776443" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4236
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "201" "ROOT\SYSTEM\0001" "C:\Windows\System32\DriverStore\FileRepository\vigembus.inf_amd64_bde72e7428095b1a\vigembus.inf" "oem3.inf:*:*:1.21.442.0:Nefarius\ViGEmBus\Gen1," "433776443" "0000000000000148"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:5424
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{beea5bf3-8613-f049-9eca-8786e48133c1}\HidHide.inf" "9" "49f2aa4cb" "0000000000000184" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHide"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2652
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "201" "ROOT\SYSTEM\0002" "C:\Windows\System32\DriverStore\FileRepository\hidhide.inf_amd64_7c068d69bd48dffd\hidhide.inf" "oem4.inf:*:*:1.4.181.0:root\HidHide," "49f2aa4cb" "0000000000000184"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:4840

C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHideWatchdog.exe
"C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHideWatchdog.exe"
1⤵
- Executes dropped EXE
PID:4536

C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe
"C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe" --autostart
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4348

C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe
"C:\Program Files\Nefarius Software Solutions\HidHide\x64\nefarius_HidHide_Updater.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599571.rbs

Path C:\Config.Msi\e599571.rbs
Size 10KB
SHA256 b6f163a1d578236cb805cedc1d0601c8d4a996fc2f235ea5c98c6f6febde4b87
MD5 11251c3efe980394d7ab813f6bf9953c
SHA1 3de0fc8205882079fa72c0c79dc53076f9cb9ae3
SHA512 0040a9242dbf867b8afdd252e91bfc034632ab09d5c03c6fe96d8510501a79e290335b6c5128941af40b03e4c5b707c5cadbb33229cc943d65314136502ab760
SSDEEP 96:0mm/KpPx+Bl+w+p+Mac+Mmg+rwZbxYohxwBD+evMxtxv9tUIHp0NCpTl9+TtUIHl:RzbaoWmFxeG9G60QJYG60Qc7kBLNpc2
TLSH
T141227452B21093D3F8A32770C70357143BF3C6FACB59575B06DD9628AF023A81E96567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e599574.rbs

Path C:\Config.Msi\e599574.rbs
Size 14KB
SHA256 c20c59edcf0382f1efe96e6c589b5aca594a40238282a0c2a8671d4242f44f7c
MD5 24f95d2f96a492e2f907940ed4f6314e
SHA1 8eceb17d2c0e447f0abe8535ba96ed81e091d855
SHA512 7fe6bf02e5924810fc93fc14bfac021eb0938d839e105bda5f05136961af4fbde1af1d64373d7bd213b34714ae396354b490ead304f5eb61dfd66513b019949b
SSDEEP 192:VCD4M66WgCyXCbqWZe3OxODGIOxODGbhkT/oW727pC2g:Vk4M66WgCyXCjODgODnV
TLSH
T17A5243167501C6C2FD434B34C7831B953772C7D482C4129B6DED3A28AFA5B984E6F2AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HidHideClient.exe

Path C:\Program Files\Nefarius Software Solutions\HidHide\x64\HidHideClient.exe
Size 323KB
SHA256 4af4752f0564e9c2a2b139b05da4bbfcc4ab111a03033319eb38b7ec9b070a45
MD5 a5120ac14f55d6adcd2652b5016ebdce
SHA1 c06387507a3625c159c3e9e8bd8c53d0ec4985a8
SHA512 1e90f4071802ebef8e38095f835e5df136a0b68a5ed5193748f124d82067a86940ef08c0463211e7b078e7aef7ca338315328ed68364e8508fdb0b2e597ae553
SSDEEP 6144:BtD8pGXoAYQ0imlT9Anv60n+G9HzZXQ9x:bIQY+bHz0x
TLSH
T187644B2FEA981CE8F867E2BC89725A01E3727C644720D6CB0761412E2F1BFD4DE79651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\LICENSE
Size 1KB
SHA256 3959f6ca50466675190590dfd024585744b6456ae7d39a3222e6550d62882586
MD5 9100d8af31ace7ef87077bbcc2fe3dfb
SHA1 05c00e9b1bacd30212a99fead3781a34ccc76405
SHA512 df4bbacf40d2e6fed9e897993caf04f2fd4ce05f51a1baa509a3e62b0ee5094e1634224467cea14bf300e610a0ca800928d4d74157816417d3d4ee4c974801de
TLSH
T1F031735721440BE60DE217916A6AB9C4B09CD03D3E276E012C6EF3886B7B52ED8F7095
MD5 SHA1 SHA512 TLSH

Submit Download

ViGEmBus.inf

Path C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\ViGEmBus.inf
Size 3KB
SHA256 4231781a6db9ccf89987839a7b1ea5eed590b70190ad43cb1c7e03a1fb280bf8
MD5 e1d9b7e33a0fc99fc48d3169d2a94474
SHA1 a1d358e3ac5618efcb70f6db3ea3a605a3fbf640
SHA512 140268dd3d98941535f459f7131f3cea149a54d08bbf3d98a066531c8b6797b0f59938ed2aa589b8fa2d2a20555c8a069620e733b5aec0ee92a5e0ed4d3a703e
TLSH
T1347142095A410FB42BB35F1ABB57DAC0F048A0487557480C38AEBE0C5B9EE2F826D276
MD5 SHA1 SHA512 TLSH

Submit Download

HidHide.msi

Path C:\ProgramData\Nefarius Software Solutions\HidHide 1.5.230\install\4F26DAF\HidHide.msi
Size 3.8MB
SHA256 974f2f56bb9d87e760ffdc757bbaa1ad94cefb57431d73b1e5e209f262b8c9f7
MD5 9e5dbbdee6cac280e53c684e2d540697
SHA1 0096e11462d29fa00f45bd49fffcc3b57d6d813b
SHA512 de8c2d7f87d39b354c2522b84d669e91dda77265d89eccea3cecc3fdae3b652db3f226d5ed05322ea375519bc4f2f0c2a6a1ab8557c8bbbafead28064ea496c4
SSDEEP 49152:28EleHBG5q7vaU4BPMPT58fGu9CKGQBrlpVYnaQhOSn2XQxnw5oDp/xHd3P9zmHk:Mlehb4BPBrk2gBDrpPr
TLSH
T16B068C217ACBC03AE56E0172667DEF6B903DBE370B3040D763E47A6A58788C25635B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ViGEmBus.x64.msi

Path C:\ProgramData\Nefarius Software Solutions\ViGEm Bus Driver 1.22.0\install\A4E9077\ViGEmBus.x64.msi
Size 2.1MB
SHA256 ac457244aa5d2cbebd05522c28fa8b483f06ee47c38ee3e701e7d16546dde19a
MD5 09f2bfb2532b4ffe0df8a82233ba6a00
SHA1 cae2265f65f3b8ad578d147de52129e1fb9073ee
SHA512 1ce6370f19f7f1cd15f269cf4355aa942dd51041d2e859a9a5271d92d3814ab32e3753260c919f1dde4b512676f9cbc60e1cd85d875d41d7b9d8ab41d6190465
SSDEEP 24576:6+mxAd5a6G6kth0lhSMXllYY5nrlprRQ+MtZwNSEK/kRh0lhSMXltw5J14s8rKS:6+DkEP5nrBM34SHc4W5J14s8rb
TLSH
T1C9A58D21B287C136D66D02B2B92CEF6E1578BF730B7100E777D8796E58B08C26275E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

banner.jpg

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1312\banner.jpg
Size 4KB
SHA256 be83c8592906fd9651634b0823a2f45abe96aae082674568944c639b5b4a95dc
MD5 d5a55a78cd38f45256807c7851619b7d
SHA1 9d8269120d1d096e9ab0192348f3b8f81f5f73d9
SHA512 959e7410e3006cfef9d14315e8741e34b6e81c4f9160c5d66f3abd77ce72f55f907ab3a0e500780b5c0e0e017e8639f135cc258976b4ab4b9d1aaed6242ce9f1
SSDEEP 96:gf2mCSVa8l5M3QXr1yFk1Erk/Sp3ErJE97KT6Avg+y5rls/Xx:I88oAXQk1Erk/Sp3ErcAvBy/wh
TLSH
T10D916E7FBAC02317E9C6CA6A3DAE8017561108F168F0E63508CFCDD3D93919B596A1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dialog.jpg

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1312\dialog.jpg
Size 12KB
SHA256 36d9bab35d1e4b50045bf902f5d42b6f865488c75f6e60fc00a6cd6f69034ab0
MD5 5f6253cff5a8b031bfb3b161079d0d86
SHA1 7645b13610583fb67247c74cf5af08ff848079e7
SHA512 d1fdc364bedf931512000fbf05e854d5aceccb48abb9ec49e68476a5dc2907267490290d92acbb267ffb7bdba9b7a1c88f1eb77830cf953443f4624995dabdc3
SSDEEP 192:zBi8rcWUMevBUahRXMHd0q3vkf6kx2DJIQ4EALOCwTx5D+CM96qdGi131:48IzMiBUaEHdp3vkCXuQ4pnH1dGiz
TLSH
T1E8429E6D0FAAF167D61123F061F3AFFF2F677E020A9000915DC6E593EB501A10D6C182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2212.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI2212.tmp
Size 738KB
SHA256 8d3e94c47af3da706a9fe9e4428b2fefd5e9e6c7145e96927fffdf3dd5e472b8
MD5 36cd2870d577ff917ba93c9f50f86374
SHA1 e51baf257f5a3c3cd7b68690e36945fa3284e710
SHA512 426fe493a25e99ca9630ad4706ca5ac062445391ab2087793637339f3742a5e1af2cedb4682babc0c4e7f9e06fed0b4ed543ddeb6f4e6f75c50349c0354aceda
SSDEEP 12288:z0WEPSjIw3my6hFWRZGdTph0lhSMXleaGv5PCcuvk:zxkuf3T6hFWXKh0lhSMXlxG5q7vk
TLSH
T15DF46D2139C9C02AD56D01B12AFDDA6B912EBD7A4B7144CBA3D8AD7B19F14C29334F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI23A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI23A1.tmp
Size 870KB
SHA256 80c5e769470bb98c5b1ec3be0a9a51f0821c67e9adc7e3e254bbc41183ceb76f
MD5 65b853552e16654c53ab4d16920a9182
SHA1 9f8182ef1b58d0d52f4faf1688d4f4e9dd8af5c5
SHA512 b56c00e78ca901738a4a067709c772cfbdf10d3a049af4e7eb6bd7a0cb0629472d7798dabb0eb82958ae90cd71acc79e5cbc3d26b0f42d3cc7cc8ec2236aa54a
SSDEEP 24576:G5hLE6v9NAjxcOoBFNMxMh0lhSMXlD5P+5fGu9CKGS:GU4BPMPT58fGu9CKGS
TLSH
T134155B33259EC026F27D02B0363D8B7BA52D6A770FB154DB63E4AE2A65344D21631E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI42BE.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI42BE.tmp
Size 719KB
SHA256 a412b642de0e94db761ebd2834dde72eed86e65fc4a580670a300015b874ba24
MD5 c9c085c00bc24802f066e5412defcf50
SHA1 557f02469f3f236097d015327d7ca77260e2aecc
SHA512 a6fa1f34cd630a7509a6441be7ad060de7e039967d2ec015e27c2a643b04e0eecf53902b7173c4c2e92e3a890bd7acb6a3307d9923838f0bfc71496fb184b1de
SSDEEP 12288:/5rDyzf/qG8B/1S9xHph0lhSMXlek9OY5nrG:9a6G6kth0lhSMXllYY5nrG
TLSH
T1C7F46C203685C03AD66E45B029ACCBAB55697E764B7218CB73C86E3E19F18C39735F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\_ctypes.pyd
Size 124KB
SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
MD5 9314ab9707985aaf6e234b5c1fc3c3c6
SHA1 e8ba1f40f800397e3e6a7f95ffe2b9f63bf812ed
SHA512 a8436ccbc32dd31694d3a66072fa76933a2ecf0ef5eaa0b79380e6c53c8e8bd0bfaf7fe9341c17ced215792f3990f4ef220049da92dd4991ebc1d83ef3d41484
SSDEEP 3072:SxVJxKqXCjbqPzMM+kffELENy/Zq4e4lIWLPhG:UHxKsCbqbffELCya4c
TLSH
T197C35B0B739410A6EBA35178C5B36F07E7B1B42B171183CF02A4C6992F637A36E6E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-console-l1-1-0.dll
Size 22KB
SHA256 015bd08815c7b934a8952c3a7578e9ce59f21136e8a880d42bbd414bec2c6058
MD5 5b90d640caf3b0d30f15d055deeec95f
SHA1 94f0be1e732c671c553523a2bd7e936ceafcbbc3
SHA512 4d35b924d39b73f9d3dc20ed14f213267b2adb9d08884967e5e58dce58d8bc701d0f36e4598d0ef94b61a9db9d898d923a5e9316399401654d8fa5f08198ac85
SSDEEP 192:yLOGW8hWHca8LxydkeR+TqMUGVkQKgvkctX01k9z3AwlU/q6c3b+l:yLNW8hWHcaGAOqM1+tGkeR9zxUSdq
TLSH
T1D8A24BC34FB8A042F9AAADB05794EA533C3DBBC71960D95222D4F10C2CE33D19B1462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-datetime-l1-1-0.dll
Size 22KB
SHA256 5534812cdbdae94ba45cb216e5eb9af686b853948df54365103555abbbaf9d9a
MD5 947918e1693507991617c90a0021edc4
SHA1 70ed1dd9f7e1ee0371a3f21804396ca1089e6bb0
SHA512 6eafed6e94c65313692d899b3c81d39ef2cda98913d2ee982e5fafb49930653538ce788229d956bd16ca91e6b4a5057ca332e0a1c22d1ebbebf51fa0d5ac7a21
SSDEEP 192:iW8hWrca8LxydkeR++W6hnvM30LRLLX01k9z3AvmSfOc:iW8hWrcaGAvBhkELRPR9zWmSWc
TLSH
T167A24AC2577C9042FEAB6F7052A8EB437C3CABD71990D52215D5F04818E77C9EA10A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-debug-l1-1-0.dll
Size 22KB
SHA256 837d2b1b2cd03e03fc6ccb050698b6b5763af17c201304872342a5eae9e0a2d2
MD5 185aee5e17fc88d4d0e902586fa4a7b2
SHA1 15fe822b234db9867e6b20e2ec82c872f733d2b5
SHA512 8e933263a5d34e0d4121ffb9524128a46dc0a1f3b3448881a4590cfd205ec01958fce592fb3426b8343b073fb05b30bcecb64ea728ea020c3b6637848618eb20
SSDEEP 192:QW8hWnca8LxydkeR+EDPkyv8xYqD0cSX01k9z3AOcnIVD:QW8hWncaGAVzIvDyR9zLcoD
TLSH
T19AA23AC65B7C9042FE9FAE7042A8EA837C7D77C70D90D9511698F59818933C6EB20A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-errorhandling-l1-1-0.dll
Size 22KB
SHA256 de43b165f568c276c00e95acd454e3092f352a18e95874595f4f4658c06d2ec7
MD5 8c6d631ee09889816ed2183ab6277903
SHA1 60df613618dd33da088d2e3d9c57a57f00d4579c
SHA512 9ad2e7c30d2b0215c071242a67b41447740433987c819f23ae9c5518369ef0504ca045ee27bf53ca93d7a2fde3ba062f291a5c97196cb94c972539c378923170
SSDEEP 192:QLmxD3xeW8hWBca8LxydkeR+xvjr3u59xHLy2j/X01k9z3AP1NdL:QL+eW8hWBcaGAYvjSpOE/R9zM1j
TLSH
T122A22AC29BB89043FAEB6E705294DA837C3CA7C71860D56656A4F5542C933C5EF2063E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-fibers-l1-1-0.dll
Size 22KB
SHA256 3cebc45bf479ad74cfabf2c6bfd4994d7ad639ed1221025981d19cedf9ce0416
MD5 7d3bccee91add398a534ccf822482bb4
SHA1 911e23262b061fc7a1b94c699c16054f9eedf8ab
SHA512 4aa7e163c9bb68710cc89ab317a5a9e773a09bda3a25fb7bbb9a2054dec66f3ff7330d401d5d1ed7b75e9dcf141af0b64687263bf14cd86380208ced94b647bd
SSDEEP 192:FW8hWazca8LxydkeR+al/+TYeds/FqX01k9z3AqgDJPdb:FW8hWgcaGAjl2BR9z56X
TLSH
T10CA24AC2673C9042EDEB6EB052A8EA537C3DABC75D90D4561694F1041CE33C9DB15A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-fibers-l1-1-1.dll
Size 22KB
SHA256 5ef70308bcca628ce6b0e2856b15b1c7ae340c3f9bbbc4c1071d8c191a34a5c3
MD5 3a17e0366bff65ec11edc709e6048ea9
SHA1 54af2275679e8314f88211595a85e9be6d8a8c3d
SHA512 95310331a9376b628551f7a7bc0213f23a7220a50d4bc214cff8767576a1dc97cae00ef502ec21511315141c1926d5c1043993846a40c180cbb45d8e7e467927
SSDEEP 192:ut+bW8hWCbca8LxydkeR+eBGejgdxP3NGmVX01k9z3AAsH628:uuW8hWCbcaGA3BEP3U0R9znsHu
TLSH
T1BEA23AC25B7C9083F9EFAE7092A8EA933C3C6BC61980C5691590F5482CA37C5EF1063D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-file-l1-1-0.dll
Size 26KB
SHA256 250ac829f2617bcac1c6e5b8c4f630462e20765863ba573526a3e11bbfb94a9a
MD5 4db29c0bc345edb80b7a1001b6aae274
SHA1 32eb82d2eece0b427c1d4604c71820024da87b6f
SHA512 3f871f536ede01f87a8ccaa42303f4a082308f58ba6411d75eca5438627ad508807cbcd99462f709cf805feede1d1828c08b0ff16bc09ec2e782dab24780117e
SSDEEP 384:eJPvVr2W8hWrcaGAf7pofngO6HVIBHR9zvObcv:eJPvVrU6bdeglKf9z9v
TLSH
T1B6C21A87D6B4F24BFC8F9E7151A2C983683943C6482095C62BD4935C3CF738AE79859D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-file-l1-2-0.dll
Size 22KB
SHA256 ae14079a114733f60ce87b92cba42acd8083c2cd67594e53bc37dc0b97a4b465
MD5 a0cf8a203637f7eafadd899cb15c53e1
SHA1 abb3db8003bce66fdbddd2177eba39a4b9db5f8d
SHA512 f4fbf1280bc7275f1b4d1ccee7c46dc200510837ac1f67b1e45a9a59ced2ee15c8f070dd96a5cf823a8227b8279b78b7394251888a3d2041b414f6241d4d6f45
SSDEEP 192:Tt68iW8hWaca8Lxyf7LRroihrSeJM7i/FqX01k9z3AqgDJ3:TViW8hWacaGAf7pofeJMPR9z561
TLSH
T14CA24BD2573CE042F9AB5E7092B9EA637C3C2BC34990D15719D5F0581CA37C9EA2872C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-file-l2-1-0.dll
Size 22KB
SHA256 914bf26a298713119477ea0a8e7bd43171b91344ebe24fb47ad77c49686e3d87
MD5 7688ad91734b26a7b9b1787c7b1a73e2
SHA1 87d7e07f2c04a1a0fba9d213526430a538020a69
SHA512 e4be6696fa2a13b7943246786ad02ac03d45c35082eae5294516818ad83c8b6f88d1f9d4a7aae261c0054688165bd38fde2daaf514bd2533f3a776f9d5eb7948
SSDEEP 384:DAkW8hW74caGAf7pof2DvIpGR9zHUsh9x:Dnbde9Y9z0sh9x
TLSH
T1D8A24BC687B8E043FD9B6D7082E9DA433C3D6BC31E50951706D4F1582CA73C6EA2466D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-handle-l1-1-0.dll
Size 22KB
SHA256 ab5489955e371b15f77906c08ec3c7affe2c7a46a08c514ca628768b4478974b
MD5 37639166bc61b4996a030a844d5d23db
SHA1 bb5982f1d5e69f078a17600b9380c99f7d52a867
SHA512 818f9dc1b17ceed5549324eed4abf0c3927a6b308e2bd57527d36890f10468802318305fd280179f58d3974ba77baf882150338e22e46a0f213d493417a1d79b
SSDEEP 192:uUW8hWmca8LxydkeR+IkWCjYHnsTX01k9z3AH3w9fc:uUW8hWmcaGAtkWuYMTR9z43wW
TLSH
T1E8A21982977CA043F9AFAE7042A8DA437C3C63C71950D5AA1AD5F1441CE37D9EB2463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-heap-l1-1-0.dll
Size 22KB
SHA256 c70f9644d8377fa39c5b71f2e9734c1400d7598904fdeb772e8502099982dcb7
MD5 1112192cb29f90e6c3aee487bde56ce3
SHA1 57f646bd17c7108fe45fcfe9912129f06c6c6b09
SHA512 e41e6ff3f987c3979fff47540bc7ca1465f9600d4fa2d3f6a2b4f7c5f79246f3ac09bebec9fb05dbbaf07420174fe3739702bb76eb50d5465ed200183d49f578
SSDEEP 192:kexlFW8hWCYca8LxydkeR+nOlewZNU6nq9bFs0X01k9z3AfkWVcOG:kexlFW8hWCYcaGAqYA9bFs0R9zMkNOG
TLSH
T1E1A24BC587B89003FDAF9E7052A5EA933C3CA7CA09A0C45516D8F15818A37D6E73477E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-interlocked-l1-1-0.dll
Size 22KB
SHA256 f8129710188e407bb0e6f46d30aeba277d67b947ece5fe09e883fde2323f3ae6
MD5 c68104ee08b19d3af6a01cbedf5f16d3
SHA1 52b0b06cd944a48b3a73a6fcab7fd1fc8dccbbd6
SHA512 6a71b8beea61af64c8c5c1420b6f846271a53bf939a9518fd3bc020e7e9f9873626f0c5b0c3af835a84d79d05fc20f7271b429e9a2229c24973acaa157463269
SSDEEP 192:eqxBW8hWnca8Lxyf7LRroihrSyfgQdxP3NGmVX01k9z3AAaLPcOss:vW8hWncaGAf7pofyfLP3U0R9znaLPcOV
TLSH
T192A23AD74B7CA242FDAB6F7082A8EA537C3C5BC61D40952655D0F14828AB7C5EB2472C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-kernel32-legacy-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-kernel32-legacy-l1-1-1.dll
Size 22KB
SHA256 5200b16cb2ddc61cfc07373a9a84aa85a3ab50806ca96c879c883275832944c1
MD5 70e54d04b1859fea363dfc0f2f64aca5
SHA1 b68c4359e47fa8a4e46f8bc8b2e957aaf706ad80
SHA512 f9043ff0508d69e1c87c8a5b0390967e69765d765e30c4d682cebb206371b8e62b9fc7e11b01233d62551a72ca5e19ca2e8ff181a1ec84b28b4b7568b3689073
SSDEEP 192:eVBYlBg6W8hWBzca8Lxyf7LRroihrStI5IyCGZBX01k9z3AyXUpqD:CBWW8hWxcaGAf7poftF3GR9z/XND
TLSH
T1B9A25CD34378A143F89BAE3062D9E9437C3C67C71950962255E8F6582CE33C9EB2472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-libraryloader-l1-1-0.dll
Size 22KB
SHA256 48786fb88b001dcd1f63acea903d3ca9cc0b3060d5a325e3f2f3cbc3bfd53166
MD5 6a79ef3e364fa289c6565578ced06382
SHA1 73f8e01df7d335f185551d40b47f2e22fed050d2
SHA512 67a3ba303c66344587486e2a0eb5769887a8c0d20888ac73c0d3fac6b7fa184536da14d56b00f597a03e046e497d8e3ca8bf459a41925a5d04a7bdf56e6ff830
SSDEEP 384:KTvuBL3BKW8hWCGcaGAsL2wGOrjR9zEFQrQ:jBL3BgpSbC2wGOrF9zxE
TLSH
T109A22AC6966CA143F99E9E706294E9533C3C73CB9950D86A42E9F6481CF3381FB1063D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-localization-l1-2-0.dll
Size 22KB
SHA256 9ec3898f7eba91faa28b51616c211a2689e3a13aeef8de6e13cb674e49d689eb
MD5 578b57aeb312269b8c70125d38b37aa4
SHA1 a86adfe9c6d5762ea8ea35d1d8e0ac682891852f
SHA512 78d2be1d5278b9a4364a9e7250bf3579fd991f120a19558f47c35f7b62991aad4d7e3c7424dcdff8ed5bc425040772e839a2b5c8055c88c08a9f5aa99b36c6c8
SSDEEP 384:GnaOMw3zdp3bwjGzue9/0jCRrndb8W8hWCQcaGAYZRP3U0R9znrUs:LOMwBprwjGzue9/0jCRrndbSp8b549zb
TLSH
T1C0A228C2C7B4E247F84EDAB1B02AE9433C3CA7860851D99112E1EB1479F37C9EB5062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-memory-l1-1-0.dll
Size 22KB
SHA256 3a6cbc524c99e1cd80d5368f5601402a37ad602528b1ab628093573ef638eb3b
MD5 52c3287598c0c8083b2a73ec20caadb7
SHA1 19c5f2bf14fc440152c2ff2239ede343b351bef1
SHA512 053a3b3ef69ec3d6b7275a88a2e4ac343788a0847adde2324a06e23d5b4f5b554553791cae100aa4be1637345f6fbcc4ac00ce13807dac1fb2125cc24e271857
SSDEEP 192:RdW8hWgca8LxydkeR+8ySTjWXYz1X01k9z3AdTBjg+2:RdW8hWgcaGANymKoJR9zGTi+2
TLSH
T120A23A8987789403FA9A5DB05394DB937C3DA7C75CD0955526A4F2042CE33D9DB1063F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-namedpipe-l1-1-0.dll
Size 22KB
SHA256 97145ef89c44949fcf0f04ac834a8bc7d687ef49ee73ae9fc32f3c11136b7201
MD5 c4a7571034da1f1ea5bcd124bc096784
SHA1 2c8c9e667b9de34ed4e34cb2468eed4438e4e3b3
SHA512 f85864394f8c83240a2aba0d218f93be045e18e01078579b83a23612b881cc20e854c756692ef62684f18be52d55d7f30a389cc0e312582a78623a72542fff29
SSDEEP 192:IAW8hWrca8Lxyf7LRroihrSNVrp1f63TLeveIZX01k9z3AvGkC8R/RUk:zW8hWrcaGAf7pofNQ3jIZR9z9xvk
TLSH
T15CA24BD24B2CA142ED9F2EB042D4DA437C7EA7CB1D10D52256D5FC182C937E4E63462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-processenvironment-l1-1-0.dll
Size 22KB
SHA256 8bc7c10b1851aea644e9c9f381cdb935e091fee6b0be3d3aedc6fffaac96adb7
MD5 592a004bb268617f75e80d6757554e6f
SHA1 ef98bc11787802603f4591494ce71d81652ff6ce
SHA512 427d6a4a3ef45ccd811e23e0a21830bce53783e6e3fc1c4829ac0f80c68f3ca2d72d43981749381d68beeaa9a2084097d5030214e297bd7acefe3756a86b074b
SSDEEP 192:SoFaPW8hWjca8LxydkeR+vHU75kQKgvkctX01k9z3AwlU/q6cRC:JFuW8hWjcaGAS0WtGkeR9zxUSdRC
TLSH
T17FA24BC29A7CA046FE8E6E705299F9633C3C97971C90C56205D4E6182CE3792FB1463F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-processthreads-l1-1-0.dll
Size 22KB
SHA256 d8030b777617c71f0f94564607699dbf7561487d779db9756aed378c5675213f
MD5 3f52435125c48c765388f50cd2d7d65d
SHA1 6fe04234239366058c40836441e4e32f80aa5cd3
SHA512 ab198b13c3583a81b652770333cccc1e53060115c8cdba254db77ca663361017c101c7ab3d2c6422b42b5daa5a7d631f4fd024a7107d4d31a0b4bb84abf2ef4b
SSDEEP 384:Ick1JzNcKSIcW8hWRcaGAf7pof+Yuu0R9zaM2rwY:ucKSrkbde0u49zaLx
TLSH
T190A24CD6866CE283F98DAD706295EA633C7E83860D25893106D9F5983DFB3C5D13823D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-processthreads-l1-1-1.dll
Size 22KB
SHA256 f5e676713340f73a03a3d41a6ec9883b431da7d16c7f07bd0a920fb80e6c0753
MD5 a199a322a4d7d5574631619faba9b644
SHA1 1aef6b0f32616f4ccfe23dd8d171dafec8df5fea
SHA512 31d5e9058251da7b73ea882f7bd9555d518180cc5fd690b21b45b968696f69da09dbc3d0095d1c3f60d23475c06c30abe423882d3a04fb784677198c4fd287bf
SSDEEP 192:OmDfIeQjW8hW/ca8LxydkeR+dR2No+DF9X01k9z3Al6qTvUNdJG:OmDfIeQjW8hW/caGAERUp9R9zs6RJG
TLSH
T102A229829B7C9043F9EBAEB062E4EA937C3DA7C71920C4661194F21C2CD77C5A710A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-profile-l1-1-0.dll
Size 22KB
SHA256 f023d47e44d3eea6b0743580f57e8c6ba81e79d5ebfa7da26250076c647b980e
MD5 434f9a1c4deea7ad1f6a52e723d11cde
SHA1 e62b7348072b71d0c9ee7f191142d16cd0dfa34a
SHA512 d2e1772ff03d194472e274ace46a8f232ad95c7ff0cd3abb2982872f16e14f5960cda998f9a9884616d369e6fb891dfa3843f999165941c21d524536f1841900
SSDEEP 192:HpW8hWYca8LxydkeR+W6ARMOkQKgvkctX01k9z3AwlU/q6cfHu:HpW8hWYcaGAj6AKtGkeR9zxUSdfHu
TLSH
T1F0A22BC29B7C9083E8AAAE705394EE537C3CB7C71DA0D56605D5F0582CE37C5AB1462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 22KB
SHA256 9746d8930704153578a628c010638a5f818ffe5a927e25591b108e256dc6afca
MD5 9327efbe38d38ec2d58a1465a17544e2
SHA1 eed8a661eb3d2fb250b79d8bd6e193f5f631a7fa
SHA512 43885ea7931bc58841a7bd15482b25fd4fabc6696961a81c91a373a759f10aec77de4c397ca9904ac61c60e0671d4e59bd282b293ec1ae74ca9bf2504dbe31fd
SSDEEP 384:tGeVNW8hWKcaGAf7pofmA/zkhl8BR9zAsq81n:tGeVNBbderzkQ9zdn
TLSH
T133A23A96967C6002F9AB6E7092A9DF677C3D5BC75890963314E4F14818D33C8EF24A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-string-l1-1-0.dll
Size 22KB
SHA256 7c53ae24c982d16ffd1bf7f918d115b11b7f30e57bc7feaa18cb9781e4abb926
MD5 547df3af5484fd1794c510e1fa99b4f0
SHA1 4eb0a3133c19f02e30da9f21e8dc17fa6125246f
SHA512 4bcbe35fa2fe4ff40477ba0286ea039d95d2521840620bbf00c3df6cb1d5e4da9950031ff4a798c20d0a1468ff826119fc7af93ab0736e6c59b8ee113b7b80ef
SSDEEP 384:XgyMvB8yAW8hWYcaGAi71R7i1R9zd3WzN/s:XgyMvs/bG1R7in9zd4E
TLSH
T1ACA26D9257B89002FEAF5D701299EE937C3CA3C75C50C5A526D5F15828937D4EB1073E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-synch-l1-1-0.dll
Size 22KB
SHA256 56d9d62ca5dba79a6581b8d574a7d8b2a64a5ecb71e47dcf06ed0285708b1859
MD5 c3194117f3340002a905054a5ac98fad
SHA1 1f07425983e31e18497155efcf3ea94c9210be2e
SHA512 16e2ed6c2e38c65519c2c555071041d49a459f1c1e2c87e038f8034e182928278b010bfa2bccadffc5e4b8e1462dc230cbb9ca9988185cf8f0c6fb3e10cd4e4f
SSDEEP 384:Ewwidv3V0dfpkXc0vVaOeKW8hWCMcaGAgS8KER9zRJLc:rHdv3VqpkXc0vVaEobV8R9zDLc
TLSH
T170A24A86A3E4B643F95FDEB04295D6937C3867874D50D87221C4EA582CE33D9EB2423E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-synch-l1-2-0.dll
Size 22KB
SHA256 f6482bbec5612c39ecb4822787a333f2b7570f7a5f922a4059be41ba957bb372
MD5 5490ac6d21df874dbb1123685ae92a55
SHA1 f5bbb5b904e5889f3990716cc467768b9e63c98d
SHA512 7dfcac2e16d12dca42d4152bd0189fd05359946f82f08ca4d7ae72514c6398a0e4b1074b6b7132edc8eed5a9202b01afacddd3c68ac96418f23ccc15db757a0e
SSDEEP 384:0tZ3AW8hWNcaGAf7pofJI+3jIZR9z9xjFm:Dwbdeb3jIT9zvY
TLSH
T144A24BD79B68A103FCAAAE7053E6E9933C3D5BC70D60992216E5E1182CF33D5D610A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-sysinfo-l1-1-0.dll
Size 22KB
SHA256 272d02765fdd3582618236c2d309abba069642f9bc1062ede069d0c144e17007
MD5 c8a76ff764f2f0bd3c0d8348bf936864
SHA1 850a1c427f90af2348da61c5fe54a807b6960d9f
SHA512 a97bb5c9243b65acecd141e0c776e2d24dda8db0877054e838a64c2a67f9616e72cb7ad0d98792fef0a22b2bdf5b3c8a5b307ac76354ea7e2d0c129ca452424b
SSDEEP 192:LHgdKIMFMmawW8hWyca8LxydkeR+GuE541WXYz1X01k9z3AdTdM:L897wW8hWycaGA7/BoJR9zGTdM
TLSH
T1BEA219D2A7B8D102F99E5EB052D9E6433C7CABC75851D91A16D0E3186DE33C9D72023E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-sysinfo-l1-2-0.dll
Size 22KB
SHA256 8a0900788859d0eb51c2f48f50cc6ed376a120b518100fa20e11d7702ccde260
MD5 56cfb8dce76efcdc32d3a4714f0dbf97
SHA1 3af995686f33153aace4ad1afc27134df2f587fc
SHA512 4406e577cc93d3825072e225d115175eb03b465eedee65d015e59ee6d6e6c830852f229bddae95fb084b7c8a63044b4f4814375e25dc57c11addeab2fd704b83
SSDEEP 192:cvnW8hWMKca8Lxyf7LRroihrSKyPEWYj9BtaFFX01k9z3AaClzn0RS:cvnW8hW7caGAf7pofKu+9WR9zNcn0RS
TLSH
T139A24BC6977CA002EE5EAE7083A9DA437C3C67CB1910D55555E8E2582CE37C8F728A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-timezone-l1-1-0.dll
Size 22KB
SHA256 ff35de6c03812b332e140f17dade25c5dd4775156da9eeb1eaae3fddd27236ec
MD5 b98e21cded01089e7ebbc78e5dd742bc
SHA1 e7b5735059013d371e6319950c323b3fb3e9804a
SHA512 9f3c769f64c215f50d509e4571169d26cdc8fcb3b1ef789a3a0098dd3e8b509556324f0903a364d104e9688a5e2758e28ffa991dec4f2a235b88561b1dbaeff2
SSDEEP 192:HFjW8hWAKca8LxydkeR+tcwfrScqYHnsTX01k9z3AH35/3L4:HFjW8hWHcaGAecwjaYMTR9z43dk
TLSH
T120A228D39B789002FC9F6FB042A8E6437D3CB7D70950D56A16D6E10828E7789DB10A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-core-util-l1-1-0.dll
Size 22KB
SHA256 191ef3e98641a57296f19d572d8eb62489470ff1ef6030d136af170c2f835173
MD5 af7ba2b8ecdae3c22f93f9585015b689
SHA1 51ca6050c853d3d2efd849b7686b9d0deb12eb7b
SHA512 5d41888a423de899207c9426a9dd9fdff9a6b4829b02d815e4c02d85d4daed0657322d32ee9e3ddcc4e14115e454393a280c64711ecaaa00bd9a38d893f207d7
SSDEEP 192:0W8hWgca8LxydkeR+uC5sgDtagQ5X01k9z3A+X+nHVT6:0W8hWgcaGADVgDtdQ5R9z/X+H16
TLSH
T193A22BC287BCD003EA9FAE705294EE437C3C6BCB0D90D96556C9F15828A37D9EA1463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-crt-conio-l1-1-0.dll
Size 22KB
SHA256 54ee5ec719a051496ff60aa00dbeaa94b9a7d2cdac27fe9b7317f1a666b6a2aa
MD5 a3d51f66428295b5ada1ed1456f37bda
SHA1 776f8d351553676fc9628f4d24b60838fc14830b
SHA512 9f61989c04c6bbc4813d0eeff96bd7a8e17da02f393864313f4c9d19ef7871ac4a1e8d5393c637571c0488368f0087ac1bc989bf939f228e3fdd2726d633f581
SSDEEP 192:49LMW8hWCBca8LxydkeR+x2On/FqX01k9z3AqgDJLh:kYW8hWCBcaGAUfMR9z56P
TLSH
T151A219C366BCA543E56B9F30A6F8EAC37D3C67C76990A0650595F01028C37DAEB1563C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-crt-convert-l1-1-0.dll
Size 26KB
SHA256 8b94662429171019fcd63c70bbf2095a075170599704a5e7dcdbe3da13f3a429
MD5 49d3611680916ee1863f28c671f758e8
SHA1 b407845e082e1ebea1af83901b766fc7ad58b062
SHA512 52333f061330d0c8d115c544d44c93418b9c15b9a54b580378f2a39e2a7cf052b86974bf146661cbbf0b5328a714497177a98e2fe0e23011bf75435ed5b45674
SSDEEP 192:j9cyhW8hW6ca8LxydkeR+amzVvDtagQ5X01k9z3A+XenHX5:2yhW8hW6caGAXAZDtdQ5R9z/XeHX5
TLSH
T1DCC2F94366E87F15EA9F177221FADBD36A381B86199092B0C247D10C3483796BD67C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-crt-environment-l1-1-0.dll
Size 22KB
SHA256 39e5929593709e8af3bc9e0a75ec1155778d6f4a247f4cdfc58928ad6db88434
MD5 74f2b0ce08d1dd7771340fa784287638
SHA1 3173ba35ec916bff41687f0e2629142cfb9be677
SHA512 abd182ec2ec86eeefa5a614de601529534a6bcce3c48edf8b508afc5ae8d036ed7bc2ec2462967a41246a417e0fd5858cf24b9dad537e243965598b8b0ddbb29
SSDEEP 192:PW8hWM2ca8Lxyf7LRroihrSRd6581BHX01k9z3AYA8km:PW8hW3caGAf7pofRqIBHR9zvAS
TLSH
T1B6A25C8247B89142FA5A6E7082F1CB933C3D6BC71C40916666A5F5483CE3799FB2132E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-crt-filesystem-l1-1-0.dll
Size 22KB
SHA256 5a8ecebac32edf4e1f3c5c6c1c8ea1a1add6cda4f9c9cb26f752fb295bea6865
MD5 064068dc283c555c930d5fc71c1b4a20
SHA1 e3c9ca57946fc9cc3f2ef6b2bb739c6d84e7a93d
SHA512 8749f92e6e7d82d18c19e2b2ce2b0bba34660db0e5a9e344ead3b85bc0c4dde8e89993bbdb6e272d2779775171420457d546c57b86ecd754836c8737c47c887a
SSDEEP 384:+nWm5CpW8hWccaGAfpQtYtGkeR9zxUSdZ8:+nWm5CBnby9kC9z2CZ8
TLSH
T122A21A8317A87E06EDDB1F7252F9DFD33E3D5786099296628086E50839E33807F1246E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-crt-heap-l1-1-0.dll
Size 22KB
SHA256 c71080cbcb43bf1f8f3e391deb12a582eb0abefc80946f340675a2c616e4feb4
MD5 fa562643819a41137c0ff3199abc8ed1
SHA1 e85e257cec500f6172f8e9b5b2de88ed570b2eee
SHA512 515e6b059d99ca01effcb7e487565208e375da060497c2247015141a8a38e635f7fb8f1b22797a59164391a4ea8d574c668c9c6de8c34957c372767a68a2ca41
SSDEEP 192:/6h8Y17aFBRsW8hWCdhca8LxydkeR+W1TE8aQC1f63TLeveIZX01k9z3AvGkC8B1:yLhW8hWCXcaGA3WW3jIZR9z9x//i
TLSH
T173A23CC38BBC9142D9ABAF7062E4FAC73C7DA7C75DA089224196F5541C837C4AF1122E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-crt-locale-l1-1-0.dll
Size 22KB
SHA256 6c68648e524187e03c4ad9aaa4a99113c6ee9f29fb39cc0ed93f951975138e63
MD5 ae36aa7d04a870966ab9c6a794b9e68e
SHA1 0c983acee91d91e8e1c5c7b34237b3b39c3c8347
SHA512 09e17f71e915455974d85a8bb7ac5eb399a8c70d09a91cc452e8c6a7eabf504a2c2336129b82a7ae526925cf783b06e2e78a832e2b060616864a85c9bd9f6fe9
SSDEEP 192:jvW8hW/ca8LxydkeR+0+WTey81BHX01k9z3AYS8B:7W8hW/caGA5ZT5IBHR9zvS8B
TLSH
T18BA24A8787B89003EA9B6EB046F4E7877C3D37C71D41C9652286F4882C937DCAB1162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-crt-math-l1-1-0.dll
Size 30KB
SHA256 d4fbcccbe29371cbce431e43b2eb4f7ba9a6f04a3d740a071f02457a505e9dc8
MD5 b944ef737dfa3bc26ab894ff4a93d5f3
SHA1 db550689ffb1736b4990202329a4243f6248508d
SHA512 25f5e6daea36867a0cdad859e206bd77f28b40b33e2eda02542effc5ed20903122d9d3521b0f8e0a95722496e26fe693e998503c1d66d4d2e542f1f339521b2c
SSDEEP 384:X7yaFM4Oe59Ckb1hgmL9W8hWCucaGAIeDZ3jIZR9z9xx:LFMq59Bb1jdpab/V3jIT9z9
TLSH
T178D2F8474AECFF63D58F0BB311F08BCA69381AA254D1F674C84BA48834A37D47E53959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-crt-process-l1-1-0.dll
Size 22KB
SHA256 47c1935942e3ac0812e4dcf18c0e265e565f0194a3349111c299712f5565f7ac
MD5 6fb7375cef9c84f8ce8c7a8cf04173a6
SHA1 9b2d87e9e7b12c3c007bda01722cb4256169323a
SHA512 4c00ee0e6ffea697a10bc8b9cfb56fad2703d8813eade25a0ccfe6dc9a2b699770dc4ed20dfc4f32a4f2c5878c26fdf5702d43c2058703c64c206c65fc5a26aa
SSDEEP 192:heXrqjd7BW8hWJca8LxydkeR+DUqg5vpGX01k9z3AqtOjrW3M:h4rQW8hWJcaGAsUqgFpGR9zHUvW3M
TLSH
T1F0A23ACB97B85543E66B5F3182B8DB837F3E67C65D90C1768992F0483853389AB3112E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-crt-runtime-l1-1-0.dll
Size 26KB
SHA256 72adc1b3677e0814d9c4ebf0964000e84bb2acf67336c8963061665e44f78029
MD5 b8a19f5a4922ee28561f882c7c74578a
SHA1 0ad9738a8f2963a13f06ade04f9267b15fbded70
SHA512 2537ec9c56ef90a59b1958e5667387a542e6c92bf8f376ab0dc7719077718575b1b47662972e33e8cd7d1f418780cbca691082e9ccfb12a028edf10da2a7dece
SSDEEP 192:+mGqX8mPrpJhhf4AN5/KitW8hWKca8LxydkeR+MpY4Cr8xYqD0cSX01k9z3AOcni:+ysyr7DW8hWKcaGA9pY4bvDyR9zLci
TLSH
T1F1C2088747F87F17E98B2F7312F5D7C32A3A63821A409A75D493F0882593785BD1622A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-crt-stdio-l1-1-0.dll
Size 26KB
SHA256 900afc3989673c9bb1a687ed38c192f46db9e6ba6d11a668898a539e7fc23798
MD5 c1d9323cf65748c748ad04d7e4a73ca3
SHA1 4df3d12a511216f912d64c849d08a66f3fa854d4
SHA512 e04799565018b8d78411e200b7e6af31c9c929d7c0696fe5eec107180edbc6f4fa964c59adde4263316d0a4134ab9080ddeee4a9d724b7b8a4469c5773132069
SSDEEP 384:6V2oFVhnW8hWCTcaGARa3GP3U0R9znZ+4R:6ZBptbo3L49zZ+4R
TLSH
T12AC2E78782FC7F42E28B473359FAFBEA173547832840B579D143A9843ACA3997D13169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-crt-string-l1-1-0.dll
Size 26KB
SHA256 fcf12466cc12fd3b73611fc0763a5a1f9d44e90349513c34a0c83b0f36421793
MD5 cf73e53438a46d61b2f5b553a66d23fd
SHA1 9e582dfc4eae3d9134994f3d073dbb6ee73047ca
SHA512 8a74934ba28fde6f72239ef9f8da3affc37592a49915a30a957384bc7cd229db15a06ad541dcc6fd8fedf5302e17aa8ad8d1a63ca6a12e6f7f4ee3b502011a2b
SSDEEP 768:pCV5yguNvZ5VQgx3SbwA71IkFYyb8IkC9z2Cf:O5yguNvZ5VQgx3SbwA71IHyQpez7
TLSH
T192C2D78347F83F46C9CF5BB356FA9BC62A384B4625405371D063A48C38827A6BE6791D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-crt-time-l1-1-0.dll
Size 22KB
SHA256 886e57c4a6adb299b38f02945369f590a67da4e79a798359fc60aaa067212d7c
MD5 7caa875caf708da08a33b86e88813271
SHA1 55db4bdd7a8bd782b8c26409f85ba4e918a329ab
SHA512 11d83de5d9ff6483f27ce8b8ecd9d437352d982f34e8857e6a1f77912b51e95e85cb7881379e305399bdd13bb182f5595f7df741ff0a1529afbe3ca377aecc92
SSDEEP 192:QyhwDWW8hWMN4ca8Lxyf7LRroihrSF8VuxbpYl6d3RX01k9z3Ac1PdE7J:LW8hW24caGAf7pofF8VurYlORR9zNP+l
TLSH
T118A22B8386E8B70BEA9B4B7152FECBE73B3817C21AD0B1668192945435C7389FD1352D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\api-ms-win-crt-utility-l1-1-0.dll
Size 22KB
SHA256 5f8f26b216ade615b67a41f6fbbb910972fc6153315a65bb8f09912be50215b1
MD5 de2433f528e203fceed564b3269f493f
SHA1 c9045fc74631d1bf8eef534b9046eaa1aad71bb8
SHA512 7f979c814d5845842fd494a304bedb2c6535c1b221efe99e34fa365fa55da786605609a232ef28cd716315335bc7d08d13d723fee114b9ef99d5960b7be952fe
SSDEEP 384:f/f1W8hWEcaGAf7pofWiCR2Rv9bt5R9z43hu:f/f1Pbdet0Gx9zT
TLSH
T119A23B938AB86502EA5F2FB082F5DB837C3C2BC71D50D6624192F0482C67BC4EF2522D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\base_library.zip
Size 1.3MB
SHA256 dfa97c7fd689f4ab60580abc91056e6fde0337e8f13590e6bfc8b92d23c4c920
MD5 8c98ec26d3573f939bd8170ee95b83e1
SHA1 cd003d5de21d708e1c03dbbd6d6ae39ee5e7dc59
SHA512 7a9ee68c6f9b20c8c06236beeacb06e5139e7c7dd20a9faf33af8618f22af5f5fb1efbff3d401d518edce0e60b8c72e47571175cc2fcdb2a060f13942bfa6094
SSDEEP 12288:O2/HuF/sxNEC9WtRarmn9T8lJGUm0HbP1dm8ynVTVihlyixmpvQXMHYzG3:O2/HsPC9Wo69T8lJGUTbP1dmphR
TLSH
T1CE55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freetype.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\freetype.dll
Size 639KB
SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
MD5 236f879a5dd26dc7c118d43396444b1c
SHA1 5ed3e4e084471cf8600fb5e8c54e11a254914278
SHA512 cc9326bf1ae8bf574a4715158eba889d7f0d5e3818e6f57395740a4b593567204d6eef95b6e99d2717128c3bffa34a8031c213ff3f2a05741e1eaf3ca07f2254
SSDEEP 12288:9rVLid+Cjymyr99WvoHkeFP+MppfEWmHa:9x4+799HkPlZ
TLSH
T1BAD48D83F3A515A8C667C2388717832AE77670051310ABDB16E45B6B7F13FE66B3A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launchers.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\launchers.json
Size 123B
SHA256 c8e70db3758a88dd41c8d9823ec0453809a86d429dc824e7fcc6353c111c6348
MD5 e511cdd3b52402abca94f94e2003f385
SHA1 06b03aca97abf7b6a2daa12df256f475a274a036
SHA512 ee4efdf6f1e4940cf151ef81004b54ba165aea3e8c90f531a4fdb135417e48915f0cfac54cbc7f1bf7deaac2592880e8bd214740932198dbf428a3ba0896dcc3
TLSH
T1ADB092141C3E8F6603F2236964CC6945EF404CE651C8F84C342F3869C3CE0028330616
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\libcrypto-3-x64.dll
Size 7.1MB
SHA256 deabf96c676dd3652b32da2cb38a7dcc2f2daa8197ad19aba3c7a99454933c1e
MD5 bd2479e241f6b758a71039e4fd41b19a
SHA1 0dcbfc336c9f8b4a6dd9ef99ffc86fe0b5e109cb
SHA512 632e3b0acd3f0def64242f04e5246d1268ba97bcb9a6e3e466ef4412da353f74cf3a39576cbc794788a6f39eca8ff3a87f4625aa01b75478a8bd268dabad3a1d
SSDEEP 196608:A86vheUZN1ZpIQKY8rAe1CPwDvt3uFlxCC:A86vheyN1ZpIQKFMe1CPwDvt3uFrCC
TLSH
T1B5767BADA67C0149E8AA81BDC2875327D771B92957F013CF186196F90F23FD92B3A740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjpeg-9.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\libjpeg-9.dll
Size 238KB
SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
MD5 c540308d4a8e6289c40753fdd3e1c960
SHA1 1b84170212ca51970f794c967465ca7e84000d0e
SHA512 1dadc6b92de9af998f83faf216d2ab6483b2dea7cdea3387ac846e924adbf624f36f8093daf5cee6010fea7f3556a5e2fcac494dbc87b5a55ce564c9cd76f92b
SSDEEP 6144:I7wNZIYb0maLgCaqrWqg7EdP8J1dJHoFaeghCbBL:I7we7gCaqrWqg7EdP8jpY
TLSH
T1FC347E16EBE3ACECC927C1B4079BE732E860B4651215ED2F1694DA313E52DA05F4DF28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libmodplug-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\libmodplug-1.dll
Size 259KB
SHA256 0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
MD5 ead020db018b03e63a64ebff14c77909
SHA1 89bb59ae2b3b8ec56416440642076ae7b977080e
SHA512 c4742d657e5598c606ceff29c0abb19c588ba7976a7c4bff1df80a3109fe7df25e7d0dace962ec3962a94d2715a4848f2acc997a0552bf8d893ff6e7a78857e5
SSDEEP 6144:AT91DT7fIooHEx09YvFTAPMH3eqSy9eNdUAK0l:ATPDnIKxWm2MXeqD3
TLSH
T1BF447D16F7D35CBEC267C07482DBD773A97274220312AD3A42A0DA733D65D901B6AB2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libogg-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\libogg-0.dll
Size 25KB
SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
MD5 307ef797fc1af567101afba8f6ce6a8c
SHA1 0023f520f874a0c3eb3dc1fe8df73e71bde5f228
SHA512 5b0b6049844c6fef0cd2b6b1267130bb6e4c17b26afc898cfc17499ef05e79096cd705007a74578f11a218786119be37289290c5c47541090d7b9dea2908688e
SSDEEP 384:OJJhN0Zr3dtX7q96ZSd/Y7AulE5P1P/X7WCRsS7TP:Ork3dVnSW7AMEp1PPaCqS
TLSH
T1DCB2291A729299ECC64FD1F8C6E9977062FE7840C6963B7A07B0C3361D7198A1738E35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libopus-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\libopus-0.dll
Size 359KB
SHA256 771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
MD5 e1adac219ec78b7b2ac9999d8c2e1c94
SHA1 6910ec9351bee5c355587e42bbb2d75a65ffc0cf
SHA512 da1912243491227168e23fb92def056b229f9f1d8c35ae122e1a0474b0be84ceb7167b138f2ee5fffd812b80c6aca719250aca6b25931585e224e27384f4cc67
SSDEEP 6144:giqhiJwDR6q7f4jNOSO7lMv1EzSvwz4LhPqu7c6m1OOzzih22:5yDRpf4jXO72IcLNqHtzzi0
TLSH
T19F746C06E6A38CEDD167E470539AB733E831781412285C7B57E0CAB02F76E505A8E77B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\python3.dll
Size 68KB
SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
MD5 962428e9e68d43ecc16f3e33f2ea8667
SHA1 6d0f349ab2e795b138a64346b784fc7fcdb6d87f
SHA512 a925586bbc4cc9d2f58f5b6eeed82e429c23dd57d7b33609c0067fc14ed66ed165ac8121eeec1db3f993412f28ba527e961e3d6bcc201d4cda2037f85931ffc5
SSDEEP 768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/s:BDmF61JFn+/OulIWL0vytH/9ifITgj
TLSH
T125637042BB54F893DBFA66FC7AD199CE642B12CC572984ECA47593D30D1A310A2E334D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\python312.dll
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000009c42\ucrtbase.dll
Size 1.3MB
SHA256 3239227d27667ba20d10a880751924e5719de0078f9fce232d149d383f7681f6
MD5 b938a441aa9ab59182d0116961318531
SHA1 58f60f8da6cf66ab224f82d41105fdda433897a9
SHA512 8b3063e50b94d555bf73b2f6eda0bb38e71056d83de05eb0b4473b448fc0b3cb26617ff340a0c3ac69acb9ee2aacc9e5b503279c593b1b0b916204a6a7426b0c
SSDEEP 24576:X9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8JszifmxvSZX0ypapJDBW:X9KpUmTfFqSgdDPq3DjqI08vkpJD8
TLSH
T14E55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_lbmjq1r4.f3a.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lbmjq1r4.f3a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

shi5B74.tmp

Path C:\Users\Admin\AppData\Local\Temp\shi5B74.tmp
Size 4.8MB
SHA256 047e2df9ccf0ce298508ee7f0db0abcb2ff9cff9916b6e8a1fbd806b7a9d064b
MD5 77d6c08c6448071b47f02b41fa18ed37
SHA1 e7fdb62abdb6d4131c00398f92bc72a3b9b34668
SHA512 e1aeb8e8b441d755a119f45a465ca5660678f4131984322252bfb6d2cec52e7ee54d65a64b98429b23915eb5707b04b5cd62a85446c60de8842314130a926dbd
SSDEEP 49152:gMZsU3djtq3DqVK5jE4b2tQ4wjn0P7mEQKhzN8F+X9TqVAMPLfRyim8UBpn6Hy:3Z2jE4/j4o/VAbis
TLSH
T1E1367E5563FA1398F6F78A38A9BA55559D76BC22EB11DBCF011201190AB2EC08F74F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET9E69.tmp

Path C:\Users\Admin\AppData\Local\Temp\{2c14bb94-4fd3-ee4a-8e51-3b3feb49ab5c}\SET9E69.tmp
Size 11KB
SHA256 44f7eacb1fc7f61276d508890d9115fca12fe3424afef56d6f975849d7158ff6
MD5 386861369ce7141e56494acc26df811f
SHA1 fe7f7f8cb063687f48db9e72cf235144b7d5d285
SHA512 15089c5eef89f14464393cfbef98a3065b81e1834bda8da618a5ec26046942132438697fff39f1eeeecb2557a644d4503143283f73a63bcd257f3c4320af0e85
SSDEEP 192:147VDJCqs2XJEwiSpJhI1hYCqiW0YIN5vCX01k9z3AkMycKAXzyVT:opxXhI1h3GfUJCR9zhMyczQ
TLSH
T1B23219A389689082FDA3ACB093E4F8933C3A77C75840516A759FF6191C973C4FB2816D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET9E7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\{2c14bb94-4fd3-ee4a-8e51-3b3feb49ab5c}\SET9E7A.tmp
Size 243KB
SHA256 b6d6fa5ca8334368fc366a3e78552efb74eef657061371b2de407aa158b0a11c
MD5 01f63a8d71e3d6d5c8b0349e3c673e9f
SHA1 2d94139d47511b8ef90716ff37abdf605c81e949
SHA512 f4459412c00e54236eb3e83ae600f78c1769673136a8f33b53b44fea83af1537fbb8472c4786bd3d9f595877e693bc361bd4024713dc3827602b1f2807cfd9ee
SSDEEP 6144:0JlN6HZBznczy5IiHEQp7XfuSZBpvxxrncD:MG/z+jom8p5FA
TLSH
T1D234F758767E09A4C4FAD278AAA30027A7F671423F314ACF15A645920F67FF8A53D30D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET4E40.tmp

Path C:\Users\Admin\AppData\Local\Temp\{beea5bf3-8613-f049-9eca-8786e48133c1}\SET4E40.tmp
Size 11KB
SHA256 0e4209963524163b3b75302c60f7b8a965fc349ada5752b74452ad59d417e877
MD5 18440acbbf52aa37703c53ac01e7f5c9
SHA1 9320fa89cf1f404fe8f4c8da1c87091a510ec93e
SHA512 1e65eed71cc4eb3600420d495ea466295dc2118781a58acbedca9576c05a35895d44447509ebb2307158f44eac5b3b9377e3f1d3cf839deda600b943679bb2a9
SSDEEP 192:np0mhJCxy8XKEwV+zGh8phYCbEHH+BEg7X01k9z3AQ9v2IO:nZ8vzGh8ph3/R9zrJO
TLSH
T1DC3219A299684183FDA7BCA043ECE8833C3E67C75910416636AFF6190C673C9F7541AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET4E41.tmp

Path C:\Users\Admin\AppData\Local\Temp\{beea5bf3-8613-f049-9eca-8786e48133c1}\SET4E41.tmp
Size 6KB
SHA256 38bf0541d798991a893e5ddac37430d097361726a00cd714c287da7a774722df
MD5 baeadfec2d3050b5c4cbf0d51a4bb5e6
SHA1 332096a335898f85a956e15f0097102b80c3974d
SHA512 491ee3e344cd595cf705617ac8e73e5e8b0761ca6e22d75e8faad850a4d641d14adbead92cc6c20dddd4768645ac2344b2f6d5a3691c193764b2d3b9a64cadfe
SSDEEP 96:MTNBPAvyY6BSIsMSpM7z1v8c/HXPY/AZ8F0JjvGHW72HfXlHfRgQ8iFNNdL6r9ar:KTQ6B5iMH1Eiv7GFvdL6RBU9
TLSH
T1FDE1EEB9111B1670EC4312057E13F0C5B1BF700462D8E42679EE9AC0EBE8A685B797EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET4E42.tmp

Path C:\Users\Admin\AppData\Local\Temp\{beea5bf3-8613-f049-9eca-8786e48133c1}\SET4E42.tmp
Size 57KB
SHA256 e3bb8b6a4e4ff90290b34e710edbef88cf71cec6ba0cadcb8e1685d5dd65ddb2
MD5 35a94b016d0eed137aafebd9f82ffd5f
SHA1 dd1bc51c87d0b6ea0a337ac5efb952009fd8bb8d
SHA512 42af99572e51a23dc9b7163a1a3a36fc6f8d44ce203b131f8ae39d9aa85b7a6d0d030556341379d2afdc977db5ec3ca7617c4bd37c7116052b2d06978f148139
SSDEEP 768:+G+dtlwmPxozhyV4PucENYfN1TKd1MZrFlrNpk+QCWuGh8L3hN9z3Y:+RdAmPihyVxcrwdKFrNSYWs1zI
TLSH
T16443176A63E811D9E8B726B4D8779203BEB1B8061B3192DF0A2040581F77BD48E7D75E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1180-620-0x000002F18EBF0000-0x000002F18F6B1000-memory.dmp

Download

memory/1180-497-0x000002F18EBF0000-0x000002F18F6B1000-memory.dmp

Download

memory/1180-613-0x000002F18EBF0000-0x000002F18F6B1000-memory.dmp

Download

memory/1180-615-0x000002F18EBF0000-0x000002F18F6B1000-memory.dmp

Download

memory/1180-496-0x000002F18EBF0000-0x000002F18F6B1000-memory.dmp

Download

memory/1180-611-0x000002F18EBF0000-0x000002F18F6B1000-memory.dmp

Download

memory/1180-405-0x000002F1A79F0000-0x000002F1A7A12000-memory.dmp

Download

memory/1588-392-0x00007FF867700000-0x00007FF867A0C000-memory.dmp

Download

memory/1588-394-0x00007FF866280000-0x00007FF8668BD000-memory.dmp

Download

memory/1588-393-0x00007FF8668C0000-0x00007FF866D51000-memory.dmp

Download

memory/1588-395-0x00007FF865550000-0x00007FF865903000-memory.dmp

Download

memory/1588-396-0x00000213D9200000-0x00000213D9210000-memory.dmp

Download

memory/4348-858-0x00007FF6F0920000-0x00007FF6F0DB8000-memory.dmp

Download

memory/4348-846-0x00007FF6F0920000-0x00007FF6F0DB8000-memory.dmp

Download

memory/4452-867-0x00007FF6F0920000-0x00007FF6F0DB8000-memory.dmp

Download

memory/4452-856-0x00007FF6F0920000-0x00007FF6F0DB8000-memory.dmp

Download

memory/4476-835-0x00007FF6F0920000-0x00007FF6F0DB8000-memory.dmp

Download

memory/4476-838-0x00007FF6F0920000-0x00007FF6F0DB8000-memory.dmp

Download

memory/4608-748-0x000001ED2D6C0000-0x000001ED2E181000-memory.dmp

Download

memory/4608-863-0x000001ED2D6C0000-0x000001ED2E181000-memory.dmp

Download

memory/4608-865-0x000001ED2D6C0000-0x000001ED2E181000-memory.dmp

Download

memory/5960-845-0x000002C9F5790000-0x000002C9F6251000-memory.dmp

Download

memory/5960-612-0x000002C9F5790000-0x000002C9F6251000-memory.dmp

Download