1c789bb7c7bf32bbc110ffb989e58d4f0fa213e59ef6a9e7e7594099b0811e7e

Resubmissions

12/06/2024, 14:03

240612-rc7r1axfmg 5

12/06/2024, 13:49

240612-q4t5jsxcmc 8

Analysis

max time kernel
40s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7054 Series PCL 1.18.exe
Size

8.9MB
MD5

03277d35cffb0d44cc49aa7e2f59fd27
SHA1

308a4d6d1d13b6fe2830285d73ed0d0f16328b6f
SHA256

1c789bb7c7bf32bbc110ffb989e58d4f0fa213e59ef6a9e7e7594099b0811e7e
SHA512

dfb2bb7c8eb582d975ca5dfd593f31e27d310c34b617c355f23fb634824e115215078f4ec5eaa27637645aa09d8ab2f14666acc8cdb4b0a23e55d9ed2c2ca1cd
SSDEEP

196608:jF6lzroCsEtq1CgZq2swC4IjMmbfbHZyQIIAbVhG3nHiQ:jF6dc7YqJZdfCowfUQUTWnHX

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	KmInst64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	KmInst64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	KmInst64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	7054 Series PCL 1.18.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	KmInstall.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemsetup.inf_amd64_34b0df00d8a33045\kyres16.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemsetup.inf_amd64_34b0df00d8a33045\oemsetup.inf	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\stdschem.ser	PrintIsolationHost.exe
File created	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA8C4.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA8E6.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA908.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA919.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\kyta3554ci.gpd	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\kyta4004.ser	PrintIsolationHost.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\kyta4004i.gpd	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\kyta7004i.gpd	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\kyauto18.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA92E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemsetup.inf_amd64_34b0df00d8a33045\kyta7054ci.gpd	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA919.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\kyqury18.xml	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA91D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemsetup.inf_amd64_34b0df00d8a33045\kyta7004i.gpd	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemsetup.inf_amd64_34b0df00d8a33045\kyta3554ci.gpd	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA8E6.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA91C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\kyta6054ci.gpd	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\oemsetup.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\kyta4004.gdl	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA8D5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA908.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\kyta4054ci.gpd	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA91B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA8E5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\kyta5004i.gpd	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\kyta6004i.gpd	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemsetup.inf_amd64_34b0df00d8a33045\kyqury18.xml	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\KYOCERA.CAT	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\stddtype.ser	PrintIsolationHost.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemsetup.inf_amd64_34b0df00d8a33045\kyfont4.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA8B3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA8F7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA91D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA92F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA931.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\kyta5054ci.gpd	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA92E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\kyta2554ci.gpd	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemsetup.inf_amd64_34b0df00d8a33045\KYOCERA.CAT	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA8B3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA91A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA91B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA930.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemsetup.inf_amd64_34b0df00d8a33045\kyta6004i.gpd	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA8C4.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA8D5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA907.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\kyta7054ci.gpd	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA92F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\SETA8E5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemsetup.inf_amd64_34b0df00d8a33045\kyta5054ci.gpd	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\kyfont4.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemsetup.inf_amd64_34b0df00d8a33045\kyta4004i.gpd	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemsetup.inf_amd64_34b0df00d8a33045\kyauto18.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemsetup.inf_amd64_34b0df00d8a33045\kyta4054ci.gpd	DrvInst.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\kyta4054ci.BUD	PrintIsolationHost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\Kyocera\KmInst32.pnf	KmInst64.exe
File created	C:\Program Files\Kyocera\KmUninstall.exe	KmInst64.exe
File created	C:\Program Files\Kyocera\KyoRm.ini	KmInst64.exe
File created	C:\Program Files\Kyocera\KmInstall.str	KmInst64.exe
File created	C:\Program Files\Kyocera\KmInst32.str	KmInst64.exe
File opened for modification	C:\Program Files\Kyocera\Lang.dat	KmInst64.exe
File created	C:\Program Files\Kyocera\Setup\KxLogo.png	KmInst64.exe
File opened for modification	C:\Program Files\Kyocera\KmUninstall.exe	KmInst64.exe
File created	C:\Program Files\Kyocera\KmInst32.exe	KmInst64.exe
File opened for modification	C:\Program Files\Kyocera\KmInst64.exe	KmInst64.exe
File opened for modification	C:\Program Files\Kyocera\KmInstall.str	KmInst64.exe
File opened for modification	C:\Program Files\Kyocera\KmInst32.pnf	KmInst64.exe
File opened for modification	C:\Program Files\Kyocera\KmInst32.exe	KmInst64.exe
File opened for modification	C:\Program Files\Kyocera\Setup\KxLogo.png	KmInst64.exe
File created	C:\Program Files\Kyocera\KmInst64.exe	KmInst64.exe
File opened for modification	C:\Program Files\Kyocera\KyoRm.ini	KmInst64.exe
File opened for modification	C:\Program Files\Kyocera\KmInstall.ini	KmInst64.exe
File opened for modification	C:\Program Files\Kyocera\KmInst32.str	KmInst64.exe
File created	C:\Program Files\Kyocera\Lang.dat	KmInst64.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	KmInst64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe

Executes dropped EXE 12 IoCs

pid	Process
4704	Setup.exe
4740	KmInstall.exe
1340	KmInst64.exe
3864	KmInst64.exe
1236	KmInst64.exe
2416	KmInst64.exe
3624	KmInst64.exe
4324	KmInst64.exe
4564	KmCustom64.exe
716	KmInst64.exe
3616	KmInst64.exe
4656	KmInst64.exe

Loads dropped DLL 4 IoCs

pid	Process
4740	KmInstall.exe
4740	KmInstall.exe
4740	KmInstall.exe
4740	KmInstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 34 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	KmInst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	KmInst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	KmInst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	KmInst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	KmInst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	KmInst64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	KmInst64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	KmInst64.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	KmInstall.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	KmInstall.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4740	KmInstall.exe
4740	KmInstall.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4740	KmInstall.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeAuditPrivilege	4252	svchost.exe
Token: SeSecurityPrivilege	4252	svchost.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4704	4660	7054 Series PCL 1.18.exe	87
PID 4660 wrote to memory of 4704	4660	7054 Series PCL 1.18.exe	87
PID 4660 wrote to memory of 4704	4660	7054 Series PCL 1.18.exe	87
PID 4704 wrote to memory of 4740	4704	Setup.exe	88
PID 4704 wrote to memory of 4740	4704	Setup.exe	88
PID 4704 wrote to memory of 4740	4704	Setup.exe	88
PID 4740 wrote to memory of 1340	4740	KmInstall.exe	89
PID 4740 wrote to memory of 1340	4740	KmInstall.exe	89
PID 4740 wrote to memory of 3864	4740	KmInstall.exe	90
PID 4740 wrote to memory of 3864	4740	KmInstall.exe	90
PID 4740 wrote to memory of 1236	4740	KmInstall.exe	91
PID 4740 wrote to memory of 1236	4740	KmInstall.exe	91
PID 4740 wrote to memory of 2416	4740	KmInstall.exe	92
PID 4740 wrote to memory of 2416	4740	KmInstall.exe	92
PID 4740 wrote to memory of 3624	4740	KmInstall.exe	93
PID 4740 wrote to memory of 3624	4740	KmInstall.exe	93
PID 4252 wrote to memory of 768	4252	svchost.exe	95
PID 4252 wrote to memory of 768	4252	svchost.exe	95
PID 768 wrote to memory of 2404	768	DrvInst.exe	96
PID 768 wrote to memory of 2404	768	DrvInst.exe	96
PID 4740 wrote to memory of 4324	4740	KmInstall.exe	100
PID 4740 wrote to memory of 4324	4740	KmInstall.exe	100
PID 4324 wrote to memory of 4564	4324	KmInst64.exe	101
PID 4324 wrote to memory of 4564	4324	KmInst64.exe	101
PID 4740 wrote to memory of 716	4740	KmInstall.exe	103
PID 4740 wrote to memory of 716	4740	KmInstall.exe	103
PID 4740 wrote to memory of 3616	4740	KmInstall.exe	104
PID 4740 wrote to memory of 3616	4740	KmInstall.exe	104
PID 4740 wrote to memory of 4656	4740	KmInstall.exe	105
PID 4740 wrote to memory of 4656	4740	KmInstall.exe	105

C:\Users\Admin\AppData\Local\Temp\7054 Series PCL 1.18.exe
"C:\Users\Admin\AppData\Local\Temp\7054 Series PCL 1.18.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup.exe
  C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInstall.exe
    KmInstall.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
      "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{E61F4A90-2107-4469-AFF9-CB1C534F27D0}
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
      "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{B4AF9EB0-4692-4F9F-9DF1-F896AB7B0B83}
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
      "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{4D8D8F5A-5FC7-4BFF-A923-874282A5499B}
      4⤵
      Executes dropped EXE
      PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
      "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{0EC56467-4BB3-4F34-BF13-773BE0589766}
      4⤵
      Executes dropped EXE
      PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
      "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{31388C64-DB19-4D90-AE6E-80646465CEF2}
      4⤵
      Drops file in Windows directory
      Executes dropped EXE
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
      "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{E3477375-293E-4253-B5E1-8F4F028CE519}
      4⤵
      Checks computer location settings
      Drops file in Program Files directory
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup\KmCustom64.exe
        
        Setup/KmCustom64.exe RESTORE_LM -n ''
        5⤵
        Executes dropped EXE
        
        PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
      "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{343C7D18-50B7-4845-94A7-FD142856ACB9}
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:716
  - - C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
      "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{F8B29C8C-CF33-45AB-A7A7-EF3950486BE0}
      4⤵
      Executes dropped EXE
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe
      "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe" API 0 KmInst32{AFD9C41A-12F7-48C8-B3C0-5B8DE1D52C7D}
      4⤵
      Executes dropped EXE
      PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{a474dae8-b4b9-c04c-88a7-9df43af7c9f4}\oemsetup.inf" "9" "4d2f16627" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\."
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{472698e7-03d7-074d-8ce7-8f8ee7570dad} Global\{ec5bed45-4b58-1d4d-9413-712b13404eb3} C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\oemsetup.inf C:\Windows\System32\DriverStore\Temp\{abe0899a-912c-7844-9ae9-21440dd18cbe}\KYOCERA.CAT
    3⤵
    PID:2404

C:\Windows\system32\PrintIsolationHost.exe
C:\Windows\system32\PrintIsolationHost.exe -Embedding
1⤵
- Drops file in System32 directory
PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Kyocera\KmUninstall.exe

Filesize
1.2MB

MD5
1a5905cb582e980292780b2dccae45d0

SHA1
c092498b04e3060207839a0b4c6cf3f13b11e93e

SHA256
b8df71c17545f9f8a460f508b13bd4217bded29c2f9f648028026dfed500ed44

SHA512
348f5980a52df16dc0360bae79cf528da93f23a2de03c316dc29ec6ed195ad485f88ec602cd473f3f524dce2dd9c0279f05325744304b39cd44c89632fef260f

Download Submit
C:\Users\Admin\AppData\Local\Temp\KmSFX.pfw

Filesize
34KB

MD5
2f4012d5dc44c846b6d05e4c070fef8a

SHA1
26acacfd673eb311a51cda20469e6c8d7805d1da

SHA256
5130731418779086d71a3a51c4cf2a59ba2780dd410ed165713f4d0689d5dda5

SHA512
62d4e3c3ae655e646a5554c2574af0fcd6428ae33168cc6d7c9969d8d7fb0c0d911125ada8b211cbe70e637caf996e977b5e6dbcb3e95f7c8dcc457755f15a3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\DriverDll.dll

Filesize
416KB

MD5
d2f5e1935db02e7c9ff6c64a19653f21

SHA1
a3eae59d4e8ea1fdb5e8cd353c3217eca87b4128

SHA256
54fbbbcf45476945641279328caab16fc160ea4434cd82701424b8190a1d5bae

SHA512
d9ea34e5e0c891563e50ec1b1e7da487ec1f7c81725bf6a9384bc408e30299bd5f43c99050cc427a4d5f2831a545099de5bd2ef4c0a2c8db22a5c624e1d4dada

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Install.pnf

Filesize
3KB

MD5
cad31ccd1faf399d78968340b8aeff23

SHA1
b297caeb401ecf4355eb4e7c023664552a6a8372

SHA256
af50657774d0060e34bd34e473d5234aad8f337837cfa83fa669326d5496f7c0

SHA512
bc545b5a5c67f389a2fdcf29fbd4839152a66c2c0926cb0f0e8d3bb87ed6c7204f32f0199680a5f24f50fefe37d367f887b8db0ff35ed2c01080851dc03994a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmDiscover.dll

Filesize
223KB

MD5
faa31ba1cf1db7628d3b301b7d525653

SHA1
6271e3e55d58b9d91b348aa8ab76502d0534e467

SHA256
03b65281a10d49256e12a91d0bd60b5b5ff14d7e537b2578e0d1c30223f08847

SHA512
675872d35763dff54334fe9d3a7084afadd5ebb4ff8e5b28bdd53005fd3e965e58227a6f25bac3588df0ba6d1a273db625f09bae530873585909511f0567ed42

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst32.pnf

Filesize
2KB

MD5
e6d0c692d8288b537b0ae57d9876dcce

SHA1
01ead1bdd87f7893ebcf38053ed80b2f79b6438d

SHA256
0e8a913fc91a2c1f85dc85bdf3da4f1ffc73cfc9924b89c1c5680f72ef5a822d

SHA512
47aa740dfe7b8adc4cb9b5fb3e5dcde5804dcacc26eb13028d31b05d3a5dc6f168beda4d392b4dd69ac639c707e55ce45a3c62b5080ce24ba58140e54dd174c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst32.str

Filesize
8KB

MD5
cdc722995ba3062967e8b94a89a2661b

SHA1
9bce1704df5e825c44e21d9d9ec21789c95a70ed

SHA256
efcf0dd271acf9cd167750ec61b2f4295eeab2738fbe9fab35b2441757d50769

SHA512
1b1dc8019b3ec4f6f0355b41e42a2750e72feb7ce462e3ecc39fb3a45bca8a447f5c24707d3b6a56bd5f8e683f44eabad522540f15a0100433457aecbc0f8718

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInst64.exe

Filesize
647KB

MD5
1c32a3085418ce615c4a2c2bddcaab28

SHA1
039365d06aeb90dba1e08f158417daf3984f9dcb

SHA256
0188d0198dce5f4c07bd30ec02203b89ab876ecbb6e9874027da53611082769f

SHA512
9d924eedf455022533b1d35cf76fa2bf5ae36ed96745651c81842e4c25d987ef3424b96ec28be0519e9da50cec5a843aacd6d78c3b62c51eca61bb1dd3fb7fa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInstall.exe

Filesize
2.2MB

MD5
4daf1b9cdd3b5505e233391827ed346c

SHA1
14fb49302612495c3f48e93ce269c0148e03a4b0

SHA256
c035f0fb74a7d6b00f9c1c1de4ad88c1b446992a056ad48b9ce065fba7937d46

SHA512
bb306fafa8e6d02280c12a144d523e497388e6fe79e4105bbceabcd43d8ffad9608dccd7963a2c6ba66f95ae047ab7252e32a1fa01a7d20b124575a66aeb4edf

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInstall.str

Filesize
71KB

MD5
0dee891777ec01ce2bee665bae91f46a

SHA1
878a7e20b1b3220ece5bfbe63a3822743e008a70

SHA256
a9248837400473e23dfe33724e72322735bec170133e3dd87e483c5d9cc78961

SHA512
ec2904cd70190b35ac25b99a5d6adfb312484cdd217d838a5be0ce15f8ed0ed2d1a1523170f89c110771b3d8846bd4816d06e807729eb7d29154b64ae25c6b4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmInstall4.ini

Filesize
695KB

MD5
f3ed53862ae2241ac1e38f9b444ae9bb

SHA1
6bb9a33de59b4b904f8d35880ce8032051a5937c

SHA256
2c4758c5baccf6521837a399e1ec7963f1f1013d727f44b6ea17fbbbab7d26c6

SHA512
50c398bd42563e2e13e0998e314eb380835ea50297e6bca40deffd518aeaa2378b1e33596ebc37108bb956b70a385caa78b254b0486930d0a1e8b5f875731ead

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KmUsb.dll

Filesize
83KB

MD5
8a6035559696452ee82f781bd786e839

SHA1
ca1010805c7fe942893a916eaa95e44fed12fed5

SHA256
92272a90af441fcf23f08ca07d4530804beb120c70882efc3a5409862410d817

SHA512
8177cc37085c0fc66a302d7e3cc2cd0f64743167b755fe0b21f0856d3f5ecccbec66e0620499603817fc536e6b25a172ff8b4b7474611818ab8537f09cdaec75

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\KyoRm.ini

Filesize
5KB

MD5
2ee329f9efc575bd8d4bc45b481136fd

SHA1
e070728b2e212903794a8fc1c3f576ae23dee127

SHA256
fbfa7dac7c546bb46a6a3f6c5cad06df163fb1c316d104c22a30e9cbada054b7

SHA512
5a01bcdb10bab1e375090d89412328cf84cffe54aa806835bb950cbe5e128aff29b25908da14cad2a6cb643a22d36cff84c0e4e1fb72849b7405e892326a6321

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Lang4.dat

Filesize
133KB

MD5
1e123a85ff7806339e7851a22362de87

SHA1
8556266bc5c5f9fe9e73f66ccddd5a2845e124a1

SHA256
e4bdb6c7b97dac6a53bb10a215b90a116003d4f050ebe729db10befb51599184

SHA512
a97d554962dfba923af5b109c8b03604452e0e60fc0d8d3cde5fb5f3eadcd93e60eb9465bf8886ad73731f69db68f7b0f62b4de50c56cb0f6de342a3fbfaec69

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\PCL.pnf

Filesize
7KB

MD5
7bfbcc227aa8af935c973560f0c656ac

SHA1
f419f408b2ff845c5c0a36d7180eabf37ccee8e9

SHA256
87d171da1dd2eb2bb4b88c7f8f19d89e4139cec1581464446615201c8d4d5b18

SHA512
3d6837a084ae9b56477edc3a6790f44ce9ee8de2580569e9929f26fe7b357c5f16f11e65158897e29297c61c5a6af1b8054ec68ee1b3da8b3df23d9b658b0c59

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\kyauto18.ini

Filesize
328B

MD5
0f1cd28b569551ee7c994b901f6ead3b

SHA1
375c22b2809969bd9f8edf98fd4cdacd7a68cf1c

SHA256
7341e09da3f73b4184beaa19ff73f509238e76eb8ed944051abcebfccb961d64

SHA512
b7047c036f32cb5499ca2da82360994ded4d5b6a3ae7e4b6db0727db3b94282aebf428d14a01d30013210dadccc44db51387cfc1702fa67bef4a131dea7411b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\kyfont4.dll

Filesize
98KB

MD5
76050a707af73b8978468c8c2aac3cc1

SHA1
7c9618b2f575233dd78f4744016a306559f5046c

SHA256
098c2a994ccc3109af473ebbb0ae4b0e041053c5c7cb15ad1684bf2a0e65860c

SHA512
54cde12dbbbd998bfeacb1a1c5e360be0dbfc2edecca8df847f7553f8f187593461ec4d55869f490c9debcb4e7fbf5af170d6b68ad15ce4d5396591ba84afb4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\kyqury18.xml

Filesize
22KB

MD5
c8839c6d81459452e5a74a14b9d2abae

SHA1
bfddb2741744034d9a0154c05bd974a31ebd1d0d

SHA256
3f10aa1fbebec408887dc94baf798d78bd4e1b3694553328b16b1f3bf8fe60c2

SHA512
c8ec5ac472ccc113d3951266dabde08c96557ef25245004f9ee14a58220c650cdae418bfc824134ab0041bd7a2fa3917af08a2c9865e966d6baab7d42ef1902d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\kyres16.dll

Filesize
176KB

MD5
e78aef1ea89ad14678494d2fcd378719

SHA1
11d3945a512df03c1719fa5683bef73c2a664e8e

SHA256
f0346f2f56a3ecbdf609e9ba696539581ad4acbf9bc691ed13c5340efe74f09e

SHA512
b360eaab61d021f7ceccf97c79414e5c936dbeebb79138160ac53665078ff2fa2a8056b29ce57deecf638daaf1d2ff40912bfc988c67f99731488a63e5950a44

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\kyta2554ci.gpd

Filesize
98KB

MD5
03a2d0d454995a9fce17633c6d73c095

SHA1
cff3e430370e08b2519f8ca6346ab4a21ded8a21

SHA256
309c2c9fbf2a7416b3130891fff6df127b4e37da5244a50e6e72e6e7da39b8f3

SHA512
c5145efc49421d8548ef1f5ed1f08a13e777cb4e70eb451cebacff10e433382f69d1b7d0166c703695aeef2319b9d3b9cb00fb09bd07fb40777318a7498c56e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\kyta4004.gdl

Filesize
9KB

MD5
3ac8e19c69344aaf0d2120d81027b36c

SHA1
c24771181eafc7cbb4a6d99d6266969a61c06ede

SHA256
945d4274b67f87aec89f34037d813ff9d22fe6ebc10518877ac0d8acd423afa7

SHA512
1ec2da2c846e99d02ac7cb6a39c741869350f556c6fcfd63a7bd033ff348f4a60cde961db1e6d8ed44aaac9e0ab8f4fdf9936ab39a341d18dbbf171af5e92026

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\kyta4054ci.gpd

Filesize
106KB

MD5
4da408de5f726073cfc69556e1294b1c

SHA1
ecd87062a32cfe28994d97ddd6b809ca767a82fc

SHA256
79f654440eee664d5c81dba450256bdebc6cc27299f5124db5cc7649b922eb17

SHA512
02b938e70c61e4c3ff678d64df1aa2ae6b55bb049356f9c45393a9491fb0373118f13b7a3c9209cfb2bad06ae13d74f85b6491c1376c26898e18ce2dc7625812

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\PrnDrv\PCLDriver\oemsetup.inf

Filesize
17KB

MD5
ccdf71ab0aade5222dac9d6496fc36b0

SHA1
929659b7c60bb65003895d7cabbe29ad01f775ed

SHA256
31a6a97c5185db6218538f1816b5492d70a0dbaee061d5bfa69c1655a3cac5de

SHA512
99872cb01158efe028b737c60ef4f435d189ec232b75e6a512a7bdf988a6b38eb3a1af8348e079d4dd071158dc14ccc3f35b11e54d1c8ba256b56f21c16ced38

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup.exe

Filesize
104KB

MD5
1abe99a66f93c1543a08ea0fddce0d25

SHA1
7394c7818f368eea331fa0f4be37e8e3ea426f66

SHA256
f98a08bf973aedeba9f5211e5798615bc094848c15aa532625f2d2728fc50c9d

SHA512
02fce03062702459018e6fd142352d4feee2f31e5525f938a4294384638b80335c241a5486dc96239067e61240207fe3a72fba73b8367f16d50b8297147b0c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup\Background_KM.png

Filesize
6KB

MD5
7aeca4e30ee1242c5e603d2fe8ac44d4

SHA1
25f1a2f7d5ab793a67bc23603cc9b6533074d3cb

SHA256
1d075ebcd156a3c9dbd9675d8fc50863067a7e0eef54df415cc809659750f4b3

SHA512
478ad0c1096cf5c8862ce8a8c24450bbcac58cee47a3ac091de585ee77a7b5e418971c05d3d83b45312e9dac3ce797a73f255c8a2e837643eddf18539abe67d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup\Background_KM_RTL.png

Filesize
6KB

MD5
d3a1b550674f109c3e1ea05191dd3935

SHA1
386416e26da0b72c0f7e7cc3a557c12399e3445c

SHA256
20cb1115cad659298099c69e519e67737bf535f0b98221bbf2eb29f61df78053

SHA512
59b449cb1c4adfafd8faed4f3f526864de6e6040d68bce7a7c9aced81e94a1737a4d58b15ead81eb8881e3983af305c7098a9ae8bd4365feb3580c086b0742cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup\Background_Page.png

Filesize
2KB

MD5
e5ebd7a606766d99e8ee0253d0388cdc

SHA1
7986b8a4d98e0ec2abcad9f4b8a4db24fcebbd36

SHA256
c40cc5b279d6f1f45cdd268b8cdc8016fe9bbb5c9ff8a169197a24a51e1414e6

SHA512
f4d3b4dc8be69f11a0e18eea06becf6cb696b0458dd114b2ed15368d740188552c05d61bd0c43143ee113cb7037de322de9715d722fcce30aaff98da0565202d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup\MenuBitmap.png

Filesize
127KB

MD5
2e6f0f71e4f8274abbd8dffb72ebbf48

SHA1
337cad784ba4f30bf3b6cfa48d1673d1d0f9a9d6

SHA256
154c12b84b7fb185566ef8a39ffebed21f7305ab8ba32af38160775ff4eb19e4

SHA512
271aaab6a06b18c793e794a5e78da9c67ba195e7c29d38956fa3f8540eb438b9b6539eade64f45cd26e97e186bac09938b2f66cd3846810258dc38e80aa0af4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup\Splash.png

Filesize
11KB

MD5
e8440edfa2734b01930a77edc5bc760b

SHA1
ca1446e441cff54a53158f73f5b1aed25c4baab4

SHA256
dcb64064061a1dad996bcd6b5abe67e02556b67ad1dfcad9a36231278d27e317

SHA512
4de9ad7c1defecdaf2ba62d83f1c404fe3147c3adfbc371012432018ed3e3dc111874cf96d5fc2cef718808652f702dea76d8ca35595978ed1e0b081e8c28aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Setup\kxLogo.png

Filesize
845B

MD5
7f8d1d94b47bc94e9bbf42c896884491

SHA1
a24c6aae592a89ed10b87aac8d75f1603e3d9e23

SHA256
5ccc3a5e582a563ced23a9dc9d1b17b76c0fd1cb7f338afc946f04f2351daa4d

SHA512
fbdfcf4fd23f6b0b4f8e1e82682fe1866e3b2570f3f221170eb2623d23f653ef4ab595fa518ffb5d0f8e7377672b45f0077f64d63095308c4dbd9424792e89a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\Utility\WinUSB\KmWinUSb1.pnf

Filesize
1KB

MD5
79611224ceeab07fcc2b6884676dd17a

SHA1
6c5e08af73a55f0fcb38d51e8bc0def68f0fea8e

SHA256
0729b405348d05fae91445085ea866e8ba64e0d95527169bca4a4be8fca86321

SHA512
3ef7ee70a4b9c1c2b5148529bbddb36618c0ed28b5d9a791c4c2ee27100737e853a6fab1f1b6e8c7990001482b9c8ff98fd0ac86bea529545719a6e49a6a8875

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB071-89F0-46D5-9B3B-933E38942F09}\setup.ini

Filesize
93B

MD5
3ceb84b24522510f4b3af9b05a6ef9ef

SHA1
db2ece6a539f7f9da87d99b828a3fc58dbf41c9e

SHA256
47b38b938f276ad1562b143e21edc199aa1b1da78c3c2c1ca67829e5a0363d19

SHA512
1df7e67f1ceaa35030bee6caca0e671ff572165042bc6607e4a35b5bfb9cbdcd1a24451dd05ffcbdbe75e553955e7b35d920eb08687c214d9a30acf3fca1c609

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\KYOCERA.CAT

Filesize
21KB

MD5
2f0696d24d81d185a5b99b2b16381087

SHA1
0ed6e6d1fd0c64ecb17d45fd320d85cf711ce991

SHA256
876dcbb68cba0b7069a5214433c696a6158fa52c0627ab5d674ae43813dad2d2

SHA512
4b5ad8efc1135b75f3b9a57344ee007e8c703c806cdc514de63bb5eadebe03504ce1428ec9964297b0cae4db19e3e575a775542d871c4f8e2fcf138e544d7d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta3554ci.gpd

Filesize
98KB

MD5
7f7ff7499311bdee89443400f4862fa6

SHA1
0fa52b767dd115508bd6902d6e97d06ab20a5d20

SHA256
cfa9e3d29b146960b7d733606d7d87c03cd802ca24faa224a984c70c31dd8577

SHA512
d253c12e865504c3beb46130d88443a103b32566c6dd4bd383a097d8653097aaf533494eb78c0909dc5f2e931144c5cda9d6aa38a64beef8b4474c9c90f8124a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta4004i.gpd

Filesize
99KB

MD5
c05c4b161c29ae994b2bbc05df08c7fd

SHA1
64657ef272cff3f3cd2a12dbb49d1d948259d9de

SHA256
03785daac47b9d394c73c0fa18d32cf5ba71cb7384d1f238250d5ee388f32e31

SHA512
92d84fbe5297a550cdcaa6e33222dacd9fd390a9617de5a78b9c62fe54167a25a72f81ee8511b1d21236c1d440f643e1c862c0c50242564502a48a7bb532f852

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta5004i.gpd

Filesize
99KB

MD5
58b95662c38261be47a2f3ae60cb03f2

SHA1
2e6725fca3f38f903ac8d31af462e73f71a0a65c

SHA256
b77b27fe521d0dc7adc4406b914ae63ab4e6e4e1fd0862d8418ffe596c49e27b

SHA512
9e79ed1167f3878c77cb13c60c4a62ef18a35341bd484a52dde97333e20658b3e6e549ca56a4cac8af4fcf7158f583ae33c01dfe2a7c77428fb6717a8d882c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta5054ci.gpd

Filesize
106KB

MD5
0b92ebf6bcc83d834a9c005d11f14140

SHA1
e067338f643b0d8c4bde1aaf5580f54ba2e8ec20

SHA256
5dad066b0014ea7cb369f7ef7be31db802c1a326f3360305128f8914d23925d9

SHA512
f968b07960b5a5863a97af46eab85e9eca5b5de841829a47e6aa73a2430412917c77ec7794f5bf9fc36cf461e68ff73458fb166a56eadf427c95d049d7cd08ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta6004i.gpd

Filesize
113KB

MD5
e7418b2ef136f279b539f5b343ef7930

SHA1
08ba8a325e3c5e587f1c7d184285e43621b524b9

SHA256
a530bfbe031dc6d683f18efd91137e3f30ea4f821670e306de501a9dcc8c054b

SHA512
adc08b737388fae9df7fb7d11d6923e438eba1cabb626db326863aed6d02fbd845acc84b943c056ec40d23f372a3004cc86ee980462f2fa4a15ecddffa943288

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta6054ci.gpd

Filesize
120KB

MD5
266fffbcd71827c700422a8096b657bb

SHA1
d7cf5f8c49a81cb6717c86360a7c651928b0e7d3

SHA256
f94894b651f19b572c9f71fb1c9dc86e550fa1da2c53259fdc9d7e07b393ad46

SHA512
d844aeae2d84e8a53748cd6d94627c7d9b28429563d79edced942b332c7b537327c51ac28627d7ede29c940af842b14a680d890e073353a8e361ac29550a8676

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta7004i.gpd

Filesize
111KB

MD5
b555fc0454e9e62e08e54a6ed4da0844

SHA1
398585049ee8e275e8ce66bbc45fb3d3506f21ac

SHA256
5619d40c6bcb1d47c116f2ae21ddc7af2e4c0945fa5ff8f816addd31c2a7338d

SHA512
7389220f5e9b48f5872fc646c673fba9272072b826bd22d9472f61e7876070750a69046848a274221b56e22fe58e648bba99c884fefe829ec822247fddfe283b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{310AB~1\PrnDrv\PCLDRI~1\kyta7054ci.gpd

Filesize
119KB

MD5
c21b9195279eb4417a7cbf9358cefb6f

SHA1
9438bcd4f86d8cd932f86a46ffc3aee6a934952c

SHA256
65dc148719e933fa650adf5702667ed1d8f3b3b495d9fabb6e3a7671cb0d41db

SHA512
647ce3ed33bcec5e94e1d8932d7b9248a7d99e7921d55e373e6f04b82ae190355ec581f3eac7285c0eddadd019dd95141d7a22a6b6313e31571b671b4490c8be

Download Submit
memory/4740-159-0x0000000007000000-0x000000000701B000-memory.dmp

Filesize
108KB

Download