Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/06/2024, 14:03

240612-rc7r1axfmg 5

12/06/2024, 13:49

240612-q4t5jsxcmc 8

Analysis

  • max time kernel
    204s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 13:49

General

  • Target

    7054 Series PCL 1.18.exe

  • Size

    8.9MB

  • MD5

    03277d35cffb0d44cc49aa7e2f59fd27

  • SHA1

    308a4d6d1d13b6fe2830285d73ed0d0f16328b6f

  • SHA256

    1c789bb7c7bf32bbc110ffb989e58d4f0fa213e59ef6a9e7e7594099b0811e7e

  • SHA512

    dfb2bb7c8eb582d975ca5dfd593f31e27d310c34b617c355f23fb634824e115215078f4ec5eaa27637645aa09d8ab2f14666acc8cdb4b0a23e55d9ed2c2ca1cd

  • SSDEEP

    196608:jF6lzroCsEtq1CgZq2swC4IjMmbfbHZyQIIAbVhG3nHiQ:jF6dc7YqJZdfCowfUQUTWnHX

Score
8/10

Malware Config

Signatures

  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 5 IoCs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 34 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7054 Series PCL 1.18.exe
    "C:\Users\Admin\AppData\Local\Temp\7054 Series PCL 1.18.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup.exe
      C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4716
      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInstall.exe
        KmInstall.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1172
        • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
          "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{0D9D89AA-057A-41AE-80D1-5D930C68FD12}
          4⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:2944
        • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
          "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{0E571B31-F17D-4CF4-9C97-9FB163EF5E44}
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:1040
        • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
          "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{D6A01AEC-287D-4189-81DD-4EFD5ED4AC9A}
          4⤵
          • Executes dropped EXE
          PID:724
        • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
          "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{CBB3B1E3-9AC5-46D6-9A75-3315721D2A8F}
          4⤵
          • Executes dropped EXE
          PID:1004
        • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
          "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{C8A376F9-F125-47F4-A7BA-FC8D21363A5D}
          4⤵
          • Executes dropped EXE
          PID:4536
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          4⤵
            PID:3540
          • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
            "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{48A60836-35B3-401B-A0AB-552054035DB9}
            4⤵
            • Drops file in Windows directory
            • Executes dropped EXE
            PID:1960
          • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
            "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{FD1EB757-9F08-4146-A83D-73901B47D01B}
            4⤵
            • Checks computer location settings
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4856
            • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup\KmCustom64.exe
              Setup/KmCustom64.exe RESTORE_LM -n ''
              5⤵
              • Executes dropped EXE
              PID:3588
          • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
            "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{BA0B43D7-7321-4849-A177-E816D8EAB042}
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            PID:2412
          • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
            "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{D87220C8-35A5-4B26-95D6-6A39CFA24CE5}
            4⤵
            • Executes dropped EXE
            PID:3932
          • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
            "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{ACA2A858-5314-4389-84ED-8C03C074557D}
            4⤵
            • Executes dropped EXE
            PID:2780
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f5f54bd8-044e-9a45-8d4a-676199278a25}\oemsetup.inf" "9" "4d2f16627" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\."
        2⤵
        • Manipulates Digital Signatures
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:4228
        • C:\Windows\system32\rundll32.exe
          rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{a7e2097b-c82f-6948-87ea-af9029dc7101} Global\{7e79469c-5a6b-9444-b94f-f50c709dc008} C:\Windows\System32\DriverStore\Temp\{56a0d687-15e0-094f-9ef1-4e8c3cd40f1c}\oemsetup.inf C:\Windows\System32\DriverStore\Temp\{56a0d687-15e0-094f-9ef1-4e8c3cd40f1c}\KYOCERA.CAT
          3⤵
            PID:5032
      • C:\Windows\system32\PrintIsolationHost.exe
        C:\Windows\system32\PrintIsolationHost.exe -Embedding
        1⤵
        • Drops file in System32 directory
        PID:1712

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\Kyocera\KmUninstall.exe

        Filesize

        1.2MB

        MD5

        1a5905cb582e980292780b2dccae45d0

        SHA1

        c092498b04e3060207839a0b4c6cf3f13b11e93e

        SHA256

        b8df71c17545f9f8a460f508b13bd4217bded29c2f9f648028026dfed500ed44

        SHA512

        348f5980a52df16dc0360bae79cf528da93f23a2de03c316dc29ec6ed195ad485f88ec602cd473f3f524dce2dd9c0279f05325744304b39cd44c89632fef260f

      • C:\Users\Admin\AppData\Local\Temp\KmSFX.pfw

        Filesize

        34KB

        MD5

        2f4012d5dc44c846b6d05e4c070fef8a

        SHA1

        26acacfd673eb311a51cda20469e6c8d7805d1da

        SHA256

        5130731418779086d71a3a51c4cf2a59ba2780dd410ed165713f4d0689d5dda5

        SHA512

        62d4e3c3ae655e646a5554c2574af0fcd6428ae33168cc6d7c9969d8d7fb0c0d911125ada8b211cbe70e637caf996e977b5e6dbcb3e95f7c8dcc457755f15a3f

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\DriverDll.dll

        Filesize

        416KB

        MD5

        d2f5e1935db02e7c9ff6c64a19653f21

        SHA1

        a3eae59d4e8ea1fdb5e8cd353c3217eca87b4128

        SHA256

        54fbbbcf45476945641279328caab16fc160ea4434cd82701424b8190a1d5bae

        SHA512

        d9ea34e5e0c891563e50ec1b1e7da487ec1f7c81725bf6a9384bc408e30299bd5f43c99050cc427a4d5f2831a545099de5bd2ef4c0a2c8db22a5c624e1d4dada

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Install.pnf

        Filesize

        3KB

        MD5

        cad31ccd1faf399d78968340b8aeff23

        SHA1

        b297caeb401ecf4355eb4e7c023664552a6a8372

        SHA256

        af50657774d0060e34bd34e473d5234aad8f337837cfa83fa669326d5496f7c0

        SHA512

        bc545b5a5c67f389a2fdcf29fbd4839152a66c2c0926cb0f0e8d3bb87ed6c7204f32f0199680a5f24f50fefe37d367f887b8db0ff35ed2c01080851dc03994a8

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmDiscover.dll

        Filesize

        223KB

        MD5

        faa31ba1cf1db7628d3b301b7d525653

        SHA1

        6271e3e55d58b9d91b348aa8ab76502d0534e467

        SHA256

        03b65281a10d49256e12a91d0bd60b5b5ff14d7e537b2578e0d1c30223f08847

        SHA512

        675872d35763dff54334fe9d3a7084afadd5ebb4ff8e5b28bdd53005fd3e965e58227a6f25bac3588df0ba6d1a273db625f09bae530873585909511f0567ed42

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst32.pnf

        Filesize

        2KB

        MD5

        e6d0c692d8288b537b0ae57d9876dcce

        SHA1

        01ead1bdd87f7893ebcf38053ed80b2f79b6438d

        SHA256

        0e8a913fc91a2c1f85dc85bdf3da4f1ffc73cfc9924b89c1c5680f72ef5a822d

        SHA512

        47aa740dfe7b8adc4cb9b5fb3e5dcde5804dcacc26eb13028d31b05d3a5dc6f168beda4d392b4dd69ac639c707e55ce45a3c62b5080ce24ba58140e54dd174c9

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst32.str

        Filesize

        8KB

        MD5

        cdc722995ba3062967e8b94a89a2661b

        SHA1

        9bce1704df5e825c44e21d9d9ec21789c95a70ed

        SHA256

        efcf0dd271acf9cd167750ec61b2f4295eeab2738fbe9fab35b2441757d50769

        SHA512

        1b1dc8019b3ec4f6f0355b41e42a2750e72feb7ce462e3ecc39fb3a45bca8a447f5c24707d3b6a56bd5f8e683f44eabad522540f15a0100433457aecbc0f8718

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe

        Filesize

        647KB

        MD5

        1c32a3085418ce615c4a2c2bddcaab28

        SHA1

        039365d06aeb90dba1e08f158417daf3984f9dcb

        SHA256

        0188d0198dce5f4c07bd30ec02203b89ab876ecbb6e9874027da53611082769f

        SHA512

        9d924eedf455022533b1d35cf76fa2bf5ae36ed96745651c81842e4c25d987ef3424b96ec28be0519e9da50cec5a843aacd6d78c3b62c51eca61bb1dd3fb7fa2

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInstall.exe

        Filesize

        2.2MB

        MD5

        4daf1b9cdd3b5505e233391827ed346c

        SHA1

        14fb49302612495c3f48e93ce269c0148e03a4b0

        SHA256

        c035f0fb74a7d6b00f9c1c1de4ad88c1b446992a056ad48b9ce065fba7937d46

        SHA512

        bb306fafa8e6d02280c12a144d523e497388e6fe79e4105bbceabcd43d8ffad9608dccd7963a2c6ba66f95ae047ab7252e32a1fa01a7d20b124575a66aeb4edf

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInstall.str

        Filesize

        71KB

        MD5

        0dee891777ec01ce2bee665bae91f46a

        SHA1

        878a7e20b1b3220ece5bfbe63a3822743e008a70

        SHA256

        a9248837400473e23dfe33724e72322735bec170133e3dd87e483c5d9cc78961

        SHA512

        ec2904cd70190b35ac25b99a5d6adfb312484cdd217d838a5be0ce15f8ed0ed2d1a1523170f89c110771b3d8846bd4816d06e807729eb7d29154b64ae25c6b4c

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInstall4.ini

        Filesize

        695KB

        MD5

        f3ed53862ae2241ac1e38f9b444ae9bb

        SHA1

        6bb9a33de59b4b904f8d35880ce8032051a5937c

        SHA256

        2c4758c5baccf6521837a399e1ec7963f1f1013d727f44b6ea17fbbbab7d26c6

        SHA512

        50c398bd42563e2e13e0998e314eb380835ea50297e6bca40deffd518aeaa2378b1e33596ebc37108bb956b70a385caa78b254b0486930d0a1e8b5f875731ead

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmUsb.dll

        Filesize

        83KB

        MD5

        8a6035559696452ee82f781bd786e839

        SHA1

        ca1010805c7fe942893a916eaa95e44fed12fed5

        SHA256

        92272a90af441fcf23f08ca07d4530804beb120c70882efc3a5409862410d817

        SHA512

        8177cc37085c0fc66a302d7e3cc2cd0f64743167b755fe0b21f0856d3f5ecccbec66e0620499603817fc536e6b25a172ff8b4b7474611818ab8537f09cdaec75

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KyoRm.ini

        Filesize

        5KB

        MD5

        2ee329f9efc575bd8d4bc45b481136fd

        SHA1

        e070728b2e212903794a8fc1c3f576ae23dee127

        SHA256

        fbfa7dac7c546bb46a6a3f6c5cad06df163fb1c316d104c22a30e9cbada054b7

        SHA512

        5a01bcdb10bab1e375090d89412328cf84cffe54aa806835bb950cbe5e128aff29b25908da14cad2a6cb643a22d36cff84c0e4e1fb72849b7405e892326a6321

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Lang4.dat

        Filesize

        133KB

        MD5

        1e123a85ff7806339e7851a22362de87

        SHA1

        8556266bc5c5f9fe9e73f66ccddd5a2845e124a1

        SHA256

        e4bdb6c7b97dac6a53bb10a215b90a116003d4f050ebe729db10befb51599184

        SHA512

        a97d554962dfba923af5b109c8b03604452e0e60fc0d8d3cde5fb5f3eadcd93e60eb9465bf8886ad73731f69db68f7b0f62b4de50c56cb0f6de342a3fbfaec69

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\PCL.pnf

        Filesize

        7KB

        MD5

        7bfbcc227aa8af935c973560f0c656ac

        SHA1

        f419f408b2ff845c5c0a36d7180eabf37ccee8e9

        SHA256

        87d171da1dd2eb2bb4b88c7f8f19d89e4139cec1581464446615201c8d4d5b18

        SHA512

        3d6837a084ae9b56477edc3a6790f44ce9ee8de2580569e9929f26fe7b357c5f16f11e65158897e29297c61c5a6af1b8054ec68ee1b3da8b3df23d9b658b0c59

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\kyauto18.ini

        Filesize

        328B

        MD5

        0f1cd28b569551ee7c994b901f6ead3b

        SHA1

        375c22b2809969bd9f8edf98fd4cdacd7a68cf1c

        SHA256

        7341e09da3f73b4184beaa19ff73f509238e76eb8ed944051abcebfccb961d64

        SHA512

        b7047c036f32cb5499ca2da82360994ded4d5b6a3ae7e4b6db0727db3b94282aebf428d14a01d30013210dadccc44db51387cfc1702fa67bef4a131dea7411b6

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\kyfont4.dll

        Filesize

        98KB

        MD5

        76050a707af73b8978468c8c2aac3cc1

        SHA1

        7c9618b2f575233dd78f4744016a306559f5046c

        SHA256

        098c2a994ccc3109af473ebbb0ae4b0e041053c5c7cb15ad1684bf2a0e65860c

        SHA512

        54cde12dbbbd998bfeacb1a1c5e360be0dbfc2edecca8df847f7553f8f187593461ec4d55869f490c9debcb4e7fbf5af170d6b68ad15ce4d5396591ba84afb4e

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\kyqury18.xml

        Filesize

        22KB

        MD5

        c8839c6d81459452e5a74a14b9d2abae

        SHA1

        bfddb2741744034d9a0154c05bd974a31ebd1d0d

        SHA256

        3f10aa1fbebec408887dc94baf798d78bd4e1b3694553328b16b1f3bf8fe60c2

        SHA512

        c8ec5ac472ccc113d3951266dabde08c96557ef25245004f9ee14a58220c650cdae418bfc824134ab0041bd7a2fa3917af08a2c9865e966d6baab7d42ef1902d

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\kyres16.dll

        Filesize

        176KB

        MD5

        e78aef1ea89ad14678494d2fcd378719

        SHA1

        11d3945a512df03c1719fa5683bef73c2a664e8e

        SHA256

        f0346f2f56a3ecbdf609e9ba696539581ad4acbf9bc691ed13c5340efe74f09e

        SHA512

        b360eaab61d021f7ceccf97c79414e5c936dbeebb79138160ac53665078ff2fa2a8056b29ce57deecf638daaf1d2ff40912bfc988c67f99731488a63e5950a44

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\kyta2554ci.gpd

        Filesize

        98KB

        MD5

        03a2d0d454995a9fce17633c6d73c095

        SHA1

        cff3e430370e08b2519f8ca6346ab4a21ded8a21

        SHA256

        309c2c9fbf2a7416b3130891fff6df127b4e37da5244a50e6e72e6e7da39b8f3

        SHA512

        c5145efc49421d8548ef1f5ed1f08a13e777cb4e70eb451cebacff10e433382f69d1b7d0166c703695aeef2319b9d3b9cb00fb09bd07fb40777318a7498c56e4

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\kyta4004.gdl

        Filesize

        9KB

        MD5

        3ac8e19c69344aaf0d2120d81027b36c

        SHA1

        c24771181eafc7cbb4a6d99d6266969a61c06ede

        SHA256

        945d4274b67f87aec89f34037d813ff9d22fe6ebc10518877ac0d8acd423afa7

        SHA512

        1ec2da2c846e99d02ac7cb6a39c741869350f556c6fcfd63a7bd033ff348f4a60cde961db1e6d8ed44aaac9e0ab8f4fdf9936ab39a341d18dbbf171af5e92026

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\kyta4054ci.gpd

        Filesize

        106KB

        MD5

        4da408de5f726073cfc69556e1294b1c

        SHA1

        ecd87062a32cfe28994d97ddd6b809ca767a82fc

        SHA256

        79f654440eee664d5c81dba450256bdebc6cc27299f5124db5cc7649b922eb17

        SHA512

        02b938e70c61e4c3ff678d64df1aa2ae6b55bb049356f9c45393a9491fb0373118f13b7a3c9209cfb2bad06ae13d74f85b6491c1376c26898e18ce2dc7625812

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\oemsetup.inf

        Filesize

        17KB

        MD5

        ccdf71ab0aade5222dac9d6496fc36b0

        SHA1

        929659b7c60bb65003895d7cabbe29ad01f775ed

        SHA256

        31a6a97c5185db6218538f1816b5492d70a0dbaee061d5bfa69c1655a3cac5de

        SHA512

        99872cb01158efe028b737c60ef4f435d189ec232b75e6a512a7bdf988a6b38eb3a1af8348e079d4dd071158dc14ccc3f35b11e54d1c8ba256b56f21c16ced38

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup.exe

        Filesize

        104KB

        MD5

        1abe99a66f93c1543a08ea0fddce0d25

        SHA1

        7394c7818f368eea331fa0f4be37e8e3ea426f66

        SHA256

        f98a08bf973aedeba9f5211e5798615bc094848c15aa532625f2d2728fc50c9d

        SHA512

        02fce03062702459018e6fd142352d4feee2f31e5525f938a4294384638b80335c241a5486dc96239067e61240207fe3a72fba73b8367f16d50b8297147b0c84

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup\Background_KM.png

        Filesize

        6KB

        MD5

        7aeca4e30ee1242c5e603d2fe8ac44d4

        SHA1

        25f1a2f7d5ab793a67bc23603cc9b6533074d3cb

        SHA256

        1d075ebcd156a3c9dbd9675d8fc50863067a7e0eef54df415cc809659750f4b3

        SHA512

        478ad0c1096cf5c8862ce8a8c24450bbcac58cee47a3ac091de585ee77a7b5e418971c05d3d83b45312e9dac3ce797a73f255c8a2e837643eddf18539abe67d4

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup\Background_KM_RTL.png

        Filesize

        6KB

        MD5

        d3a1b550674f109c3e1ea05191dd3935

        SHA1

        386416e26da0b72c0f7e7cc3a557c12399e3445c

        SHA256

        20cb1115cad659298099c69e519e67737bf535f0b98221bbf2eb29f61df78053

        SHA512

        59b449cb1c4adfafd8faed4f3f526864de6e6040d68bce7a7c9aced81e94a1737a4d58b15ead81eb8881e3983af305c7098a9ae8bd4365feb3580c086b0742cf

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup\Background_Page.png

        Filesize

        2KB

        MD5

        e5ebd7a606766d99e8ee0253d0388cdc

        SHA1

        7986b8a4d98e0ec2abcad9f4b8a4db24fcebbd36

        SHA256

        c40cc5b279d6f1f45cdd268b8cdc8016fe9bbb5c9ff8a169197a24a51e1414e6

        SHA512

        f4d3b4dc8be69f11a0e18eea06becf6cb696b0458dd114b2ed15368d740188552c05d61bd0c43143ee113cb7037de322de9715d722fcce30aaff98da0565202d

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup\MenuBitmap.png

        Filesize

        127KB

        MD5

        2e6f0f71e4f8274abbd8dffb72ebbf48

        SHA1

        337cad784ba4f30bf3b6cfa48d1673d1d0f9a9d6

        SHA256

        154c12b84b7fb185566ef8a39ffebed21f7305ab8ba32af38160775ff4eb19e4

        SHA512

        271aaab6a06b18c793e794a5e78da9c67ba195e7c29d38956fa3f8540eb438b9b6539eade64f45cd26e97e186bac09938b2f66cd3846810258dc38e80aa0af4a

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup\Splash.png

        Filesize

        11KB

        MD5

        e8440edfa2734b01930a77edc5bc760b

        SHA1

        ca1446e441cff54a53158f73f5b1aed25c4baab4

        SHA256

        dcb64064061a1dad996bcd6b5abe67e02556b67ad1dfcad9a36231278d27e317

        SHA512

        4de9ad7c1defecdaf2ba62d83f1c404fe3147c3adfbc371012432018ed3e3dc111874cf96d5fc2cef718808652f702dea76d8ca35595978ed1e0b081e8c28aeb

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup\kxLogo.png

        Filesize

        845B

        MD5

        7f8d1d94b47bc94e9bbf42c896884491

        SHA1

        a24c6aae592a89ed10b87aac8d75f1603e3d9e23

        SHA256

        5ccc3a5e582a563ced23a9dc9d1b17b76c0fd1cb7f338afc946f04f2351daa4d

        SHA512

        fbdfcf4fd23f6b0b4f8e1e82682fe1866e3b2570f3f221170eb2623d23f653ef4ab595fa518ffb5d0f8e7377672b45f0077f64d63095308c4dbd9424792e89a2

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Utility\WinUSB\KmWinUSb1.pnf

        Filesize

        1KB

        MD5

        79611224ceeab07fcc2b6884676dd17a

        SHA1

        6c5e08af73a55f0fcb38d51e8bc0def68f0fea8e

        SHA256

        0729b405348d05fae91445085ea866e8ba64e0d95527169bca4a4be8fca86321

        SHA512

        3ef7ee70a4b9c1c2b5148529bbddb36618c0ed28b5d9a791c4c2ee27100737e853a6fab1f1b6e8c7990001482b9c8ff98fd0ac86bea529545719a6e49a6a8875

      • C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\setup.ini

        Filesize

        93B

        MD5

        3ceb84b24522510f4b3af9b05a6ef9ef

        SHA1

        db2ece6a539f7f9da87d99b828a3fc58dbf41c9e

        SHA256

        47b38b938f276ad1562b143e21edc199aa1b1da78c3c2c1ca67829e5a0363d19

        SHA512

        1df7e67f1ceaa35030bee6caca0e671ff572165042bc6607e4a35b5bfb9cbdcd1a24451dd05ffcbdbe75e553955e7b35d920eb08687c214d9a30acf3fca1c609

      • C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\KYOCERA.CAT

        Filesize

        21KB

        MD5

        2f0696d24d81d185a5b99b2b16381087

        SHA1

        0ed6e6d1fd0c64ecb17d45fd320d85cf711ce991

        SHA256

        876dcbb68cba0b7069a5214433c696a6158fa52c0627ab5d674ae43813dad2d2

        SHA512

        4b5ad8efc1135b75f3b9a57344ee007e8c703c806cdc514de63bb5eadebe03504ce1428ec9964297b0cae4db19e3e575a775542d871c4f8e2fcf138e544d7d05

      • C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta3554ci.gpd

        Filesize

        98KB

        MD5

        7f7ff7499311bdee89443400f4862fa6

        SHA1

        0fa52b767dd115508bd6902d6e97d06ab20a5d20

        SHA256

        cfa9e3d29b146960b7d733606d7d87c03cd802ca24faa224a984c70c31dd8577

        SHA512

        d253c12e865504c3beb46130d88443a103b32566c6dd4bd383a097d8653097aaf533494eb78c0909dc5f2e931144c5cda9d6aa38a64beef8b4474c9c90f8124a

      • C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta4004i.gpd

        Filesize

        99KB

        MD5

        c05c4b161c29ae994b2bbc05df08c7fd

        SHA1

        64657ef272cff3f3cd2a12dbb49d1d948259d9de

        SHA256

        03785daac47b9d394c73c0fa18d32cf5ba71cb7384d1f238250d5ee388f32e31

        SHA512

        92d84fbe5297a550cdcaa6e33222dacd9fd390a9617de5a78b9c62fe54167a25a72f81ee8511b1d21236c1d440f643e1c862c0c50242564502a48a7bb532f852

      • C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta5004i.gpd

        Filesize

        99KB

        MD5

        58b95662c38261be47a2f3ae60cb03f2

        SHA1

        2e6725fca3f38f903ac8d31af462e73f71a0a65c

        SHA256

        b77b27fe521d0dc7adc4406b914ae63ab4e6e4e1fd0862d8418ffe596c49e27b

        SHA512

        9e79ed1167f3878c77cb13c60c4a62ef18a35341bd484a52dde97333e20658b3e6e549ca56a4cac8af4fcf7158f583ae33c01dfe2a7c77428fb6717a8d882c61

      • C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta5054ci.gpd

        Filesize

        106KB

        MD5

        0b92ebf6bcc83d834a9c005d11f14140

        SHA1

        e067338f643b0d8c4bde1aaf5580f54ba2e8ec20

        SHA256

        5dad066b0014ea7cb369f7ef7be31db802c1a326f3360305128f8914d23925d9

        SHA512

        f968b07960b5a5863a97af46eab85e9eca5b5de841829a47e6aa73a2430412917c77ec7794f5bf9fc36cf461e68ff73458fb166a56eadf427c95d049d7cd08ac

      • C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta6004i.gpd

        Filesize

        113KB

        MD5

        e7418b2ef136f279b539f5b343ef7930

        SHA1

        08ba8a325e3c5e587f1c7d184285e43621b524b9

        SHA256

        a530bfbe031dc6d683f18efd91137e3f30ea4f821670e306de501a9dcc8c054b

        SHA512

        adc08b737388fae9df7fb7d11d6923e438eba1cabb626db326863aed6d02fbd845acc84b943c056ec40d23f372a3004cc86ee980462f2fa4a15ecddffa943288

      • C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta6054ci.gpd

        Filesize

        120KB

        MD5

        266fffbcd71827c700422a8096b657bb

        SHA1

        d7cf5f8c49a81cb6717c86360a7c651928b0e7d3

        SHA256

        f94894b651f19b572c9f71fb1c9dc86e550fa1da2c53259fdc9d7e07b393ad46

        SHA512

        d844aeae2d84e8a53748cd6d94627c7d9b28429563d79edced942b332c7b537327c51ac28627d7ede29c940af842b14a680d890e073353a8e361ac29550a8676

      • C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta7004i.gpd

        Filesize

        111KB

        MD5

        b555fc0454e9e62e08e54a6ed4da0844

        SHA1

        398585049ee8e275e8ce66bbc45fb3d3506f21ac

        SHA256

        5619d40c6bcb1d47c116f2ae21ddc7af2e4c0945fa5ff8f816addd31c2a7338d

        SHA512

        7389220f5e9b48f5872fc646c673fba9272072b826bd22d9472f61e7876070750a69046848a274221b56e22fe58e648bba99c884fefe829ec822247fddfe283b

      • C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta7054ci.gpd

        Filesize

        119KB

        MD5

        c21b9195279eb4417a7cbf9358cefb6f

        SHA1

        9438bcd4f86d8cd932f86a46ffc3aee6a934952c

        SHA256

        65dc148719e933fa650adf5702667ed1d8f3b3b495d9fabb6e3a7671cb0d41db

        SHA512

        647ce3ed33bcec5e94e1d8932d7b9248a7d99e7921d55e373e6f04b82ae190355ec581f3eac7285c0eddadd019dd95141d7a22a6b6313e31571b671b4490c8be

      • memory/1172-159-0x0000000009850000-0x000000000986B000-memory.dmp

        Filesize

        108KB