8060e56dcdba7bf0147003c99d1fd51e7188585042c47bc285b8d0fa6c5bbdb6

Analysis

user interaction
yes
max time kernel
15s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8060e56dcdba7bf0147003c99d1fd51e7188585042c47bc285b8d0fa6c5bbdb6.exe
Size 809KB
Sample260507-pbvpyads4s
SHA256 8060e56dcdba7bf0147003c99d1fd51e7188585042c47bc285b8d0fa6c5bbdb6
MD5 8427b56c1823adcbbe77f4e4abe483c5
SHA1 df3913c2c7be39c620640d06da90e90d04bc25d4
SHA512 bb6b73d4796436478daadd967f00f27bcd8e0b442f4488baf2db9eb462c840834b6c019ccbba0e9cdc254f62a5d7cb2dd3468026a69061d6af95637001696d4c
SSDEEP 12288:UjT5yt8j4oq/RxgZuNGxNnSGpIt9TXb/5Nf6IogoJUFBekmlaCkah+4:UJyt8j4oq/RxgaGpI/r6xgoJUFwsah
TLSH
T161055965E78386F2ED1316F00447F7BBA630AF094425CD2BD2C8DE57FBB2E12285A255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	8060e56dcdba7bf0147003c99d1fd51e7188585042c47bc285b8d0fa6c5bbdb6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8060e56dcdba7bf0147003c99d1fd51e7188585042c47bc285b8d0fa6c5bbdb6.exe

Runs regedit.exe 37 IoCs

pid	Process
5464	regedit.exe
6172	regedit.exe
4460	regedit.exe
5584	regedit.exe
5176	regedit.exe
6704	regedit.exe
6176	regedit.exe
2080	regedit.exe
5236	regedit.exe
6292	regedit.exe
6912	regedit.exe
6284	regedit.exe
5580	regedit.exe
5600	regedit.exe
5504	regedit.exe
6804	regedit.exe
7132	regedit.exe
7164	regedit.exe
5972	regedit.exe
5688	regedit.exe
1824	regedit.exe
6376	regedit.exe
6188	regedit.exe
6280	regedit.exe
6408	regedit.exe
1980	regedit.exe
6904	regedit.exe
6300	regedit.exe
6280	regedit.exe
1144	regedit.exe
5216	regedit.exe
6104	regedit.exe
5968	regedit.exe
6104	regedit.exe
5980	regedit.exe
6176	regedit.exe
7384	regedit.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	8060e56dcdba7bf0147003c99d1fd51e7188585042c47bc285b8d0fa6c5bbdb6.exe
Token: 33	4092	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4092	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\8060e56dcdba7bf0147003c99d1fd51e7188585042c47bc285b8d0fa6c5bbdb6.exe
"C:\Users\Admin\AppData\Local\Temp\8060e56dcdba7bf0147003c99d1fd51e7188585042c47bc285b8d0fa6c5bbdb6.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2040
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:3156
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:4212
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:2344
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:4460
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:1752
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:3084
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:1980
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:2080
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:3824
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:2880
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:4216
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:1144
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  PID:464
- - C:\Windows\system32\mmc.exe
    "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
    3⤵
    PID:1160
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4236
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5108
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  PID:408
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:1824
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:3176
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:5204
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:5236
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:5260
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:5288
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:5552
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:5580
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:5596
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:5632
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:5672
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:5688
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  PID:5704
- - C:\Windows\system32\mmc.exe
    "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
    3⤵
    PID:5732
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5812
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  PID:5920
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:5236
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:5300
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:5340
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:1824
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:5364
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:5420
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:5440
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:5464
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:5480
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:5520
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:5544
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:5584
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  PID:5604
- - C:\Windows\system32\mmc.exe
    "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
    3⤵
    PID:5304
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5692
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  PID:5620
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:5968
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6020
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:5248
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:5216
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6044
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:4868
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6140
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6104
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6108
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:5240
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6048
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:5176
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  PID:4216
- - C:\Windows\system32\mmc.exe
    "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
    3⤵
    PID:5920
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5276
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:5440
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  PID:5412
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:5528
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:5584
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:5480
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:5600
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:5928
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:3568
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:5212
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:5968
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:2492
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:4448
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:3292
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6104
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  PID:4532
- - C:\Windows\system32\mmc.exe
    "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
    3⤵
    PID:5164
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:444
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6072
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  PID:5668
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:5600
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6124
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:4768
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:5980
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:5208
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:5152
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:4520
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:1980
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:3824
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:5412
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6100
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:5504
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  PID:5980
- - C:\Windows\system32\mmc.exe
    "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
    3⤵
    PID:5656
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6120
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  PID:4972
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:5572
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6084
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6152
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6172
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6208
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6248
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6276
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6292
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6308
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6332
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6364
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6376
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  PID:6404
- - C:\Windows\system32\mmc.exe
    "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
    3⤵
    PID:6440
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:6432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6504
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  PID:6556
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6584
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6648
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6680
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6704
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6724
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6764
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6788
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6804
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6820
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6852
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6888
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6904
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  PID:6920
- - C:\Windows\system32\mmc.exe
    "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
    3⤵
    PID:6944
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:6952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:7016
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  PID:7068
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:7104
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:7124
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6028
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6176
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6192
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6108
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6260
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6300
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6292
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6208
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6392
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6408
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  PID:6312
- - C:\Windows\system32\mmc.exe
    "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
    3⤵
    PID:6400
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:6308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6696
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  PID:6608
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6772
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6736
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6888
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6912
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6924
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:7032
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:7148
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:7132
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:7144
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:5516
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6156
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6280
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  PID:6300
- - C:\Windows\system32\mmc.exe
    "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
    3⤵
    PID:6180
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:6172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6328
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  PID:6324
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6816
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6808
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6608
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6188
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:5504
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6936
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6960
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6284
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6304
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:7080
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6260
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:7164
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  PID:6860
- - C:\Windows\system32\mmc.exe
    "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
    3⤵
    PID:7092
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:6160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6804
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  PID:7084
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6272
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6304
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6848
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6280
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:1316
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:5512
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:6232
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:5972
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:6272
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:6840
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:7088
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:6176
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  PID:4052
- - C:\Windows\system32\mmc.exe
    "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
    3⤵
    PID:6752
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:6924
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  PID:7188
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:7280
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:7332
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:7360
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:7384

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000478 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
PID:1808

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PerceptionSimulationSixDof.PNF

Path C:\Windows\INF\PerceptionSimulationSixDof.PNF
Size 10KB
SHA256 5f318decf713c076d69f05c245b57bd9007c9f0a41472a985ed831617382e2d8
MD5 6b4123ed026c01dd469c2665eca14670
SHA1 9ceb18baa1fb6d68731d945f64dfaaf30fff114c
SHA512 391cbb402b96327376c1acc489187574b18578c88622c9d72b71b04bfb6453f49719700c2c91a88374422aa039c45dfcd338b3ffe86387c361a02cd142bb3230
SSDEEP 96:hSDhok/wkM/cUzQ32XPScs4jFRr6C1VbmGSECJkK1rGHq9ZcG0bp3QbWxK7HI7aj:caMpMEHUJkQUkK1ruq9AJMn/31j
TLSH
T11E22035677FD8A14F2F25A30ACBA51E55436BD965C21CA2F2214330E1C32BC4DBF1B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_apo.PNF

Path C:\Windows\INF\c_apo.PNF
Size 6KB
SHA256 03efecfef913e611b6b84afce57fd7777d7ad59b7302a7cf9a57b59274b91d20
MD5 a06c4e877a6c9e611c055546ea447e67
SHA1 b699d6be10234cdcce03ca58227e26a1795f4743
SHA512 e3e80318f6e412d15e4aafc86f6d7e40dfed993094f3ccf0858fa582426bc8eccdeb359e3c2f60dad7238d147fcf6ed08eb347113c1fc3a260608f23570f2e9a
SSDEEP 96:BnKz502juqX2xjDUw91snNpPB1kJRSqbtoDyHbzfXBi3Pn0880v:Iz2xjDUK1iNegqb2DyHbzfxicm
TLSH
T175E13465B7E48B25F1B65E34ACF468E64966BC421C02DA5F3168730E2C72F94CFB0726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_barcodescanner.PNF

Path C:\Windows\INF\c_barcodescanner.PNF
Size 3KB
SHA256 dbd8267a230391fd7e0c2f61dac5553d236b7646794992826d6a5fdf7d97761f
MD5 d5179dc8cbec8211b7ba5ae844376400
SHA1 ccb4fa896ffc7a9a7410d5032683f1b420aea928
SHA512 d8fd2accdb43e749ab6aed5de226620820285315b6d217d135a4692d414fa2f30e55eeed88c9c0f6946872477d78490505125ec15143479b40e77ea02329e85d
TLSH
T1A681971A77D58E19F0BA8A300DF021FA9531FC810C26DA2F7248730D4C72B94EBE172A
MD5 SHA1 SHA512 TLSH

Submit Download

c_camera.PNF

Path C:\Windows\INF\c_camera.PNF
Size 8KB
SHA256 50a46d0bd769090377236142e000de8eecc8cf4c7aeb90d046f1851d2a1b0307
MD5 5cd1a5340034ae8a28d9966c6b34b65c
SHA1 d9e4df318d383034aaa2f39242c4b0eee3f27383
SHA512 c0b8d1515590b89360793a5c5de2d6117449b22c97db9023fa9c0352febef84cbfc6f5a7f72faf55f5d39a802716858d5cef2da50cd31ddb57680fe045943036
SSDEEP 96:XjCi8KeUCBxWhFfsy7QcvRRRftGbU0Vby4E6hBq9eOtV3TMG5qyxJw5W/39rdeTe:MxmfsMQcKRhO1q5WxZ
TLSH
T1F4029B6EB7D98A55F1B38970EDF0A1F685727C811D01CE1F3128734E28B3A94D7A163A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_cashdrawer.PNF

Path C:\Windows\INF\c_cashdrawer.PNF
Size 3KB
SHA256 1635a0e6272eb6cc2dba62b084c263e9170fba9eb10de18aeac12b7f3ab9b465
MD5 4bbd2d6d2044b3dd4b5e67a0f6d2144f
SHA1 0df052e0421b7c127f2bceb948d5df953bf5186e
SHA512 3d05ac87b4c61c19eaa3dccd5f23143294f26a8ff34c128280b7feae2ba78dce81b2571cbd9982e5fe57bf90a04171980b57418ee937d15b004d05a719168f41
TLSH
T1D9817E1A77D88D19F4BBDD709DF090FA5122BC914C16CA5F3184330C18B3744E7B1A2A
MD5 SHA1 SHA512 TLSH

Submit Download

c_computeaccelerator.PNF

Path C:\Windows\INF\c_computeaccelerator.PNF
Size 4KB
SHA256 99923bb199301b71fbf4f717b8b389653f26d037c0e5e72e0be9edc350cf81bc
MD5 cb686f7405a2b0f1b21659361ec3c75b
SHA1 c20c4ad0e7461f2d23eab124188f553641dfdb12
SHA512 864a7963cf8c301dd0a2757095b71ceb5cdb533395e48e4e3f03e0e4a102b3abd36da3baa379b1b650e4ee6cef95519553086421983e4056afd3feb585c87b7c
SSDEEP 96:wizMiofROKMfWWuvEFbMxOEt2N/f4U3uh:cXO5fWvhWN/fM
TLSH
T137A18B55B7D99E24F5BE9D30AEF0A0E785227C815C15CB4F3258770E2C32A91D770A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 60c7b400a04dd8f1f038f2b25389aa5d8b5386027ccdff29ebe1013c2751be10
MD5 3dde1308a0f1435dc1a8fe9ea637b194
SHA1 6a6df3918cd3a0a6f0cca86d4a3301b45e409fd6
SHA512 8049c00c128837f115fecaac604c7f8ccea2685c041037579fe301f572ac606be3247777f4dac71ecbaaa3e42d3bcac35f3eef916634bf4c09288b3c2ee35730
SSDEEP 48:04sh0z6p/BTPlA/Weqn774QE5iqz2YDEwEFeaIDbsRbXkMx86xQ4SVtBEBxGnxPT:0Lho6ZBTPi/WeqXYgDusNXeBjc4
TLSH
T122D1BD21B7E88B68F1B64934BEF5A1EA4561BC824C01CE9F351C330D2872E84D7F162A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 21e47723e0b51c49f7a20899575fd0f3ce29f0f12bc989d841274dee6ed67ada
MD5 7fa3734bc719e289f22b7259c8004600
SHA1 f2b9d23239c82a0e20c97ef106791caef6327685
SHA512 0eaa59876e15451292609ade0b006d13c4f6f51bc85865c5bafbb3755d541528e7033cae2b8dd72b67cf17a3f284c8bbfc410691e37eccea3adfc9dee9db6671
SSDEEP 96:7/cw3dCMNyLE2lu/HkCohOROrt4rRCJyetQZGpuZH6UYBq8ITb/7VGpR2b8jN:4wEMYHMHlrszCQaadq06i
TLSH
T12B026736B7D5AAA4F1BF59B0EDF860D946367D815C01CE4F3128734E1C72A84D6A0327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_extension.PNF

Path C:\Windows\INF\c_extension.PNF
Size 4KB
SHA256 a609d7ad70b03ef59aee3f7fc40b9da4fd424e1b065652fac2c72549c701df38
MD5 f744707692c267c4f905d85afdfd76e3
SHA1 47a267933d322dfda073208f831ce4e382052919
SHA512 fbe078143aa694e1d6c9fb9425a9ecebcaa4dffef5b3430f28b4e6bf8cc68a480253da99e075355fcb1b031be01a7d05ada7fa2b38d44ef4530564b43bedecc4
SSDEEP 48:JAeta45bM6MfWtqwc5ilqoh0lceaIDbVRbjuqefop7iMfD:JRta76MfWt68uVNGfopJ
TLSH
T177915B557BE59E29F27E5D307CF0A0E685A67C515C05CB1F3248731D0873694D7F0A19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_firmware.PNF

Path C:\Windows\INF\c_firmware.PNF
Size 7KB
SHA256 dea77f8b8293be3ffbab844d34932117e384753d4892b0f25465d6702342aaae
MD5 2a8e4482af5862815d473184b7568334
SHA1 b5b2021f897128d8fc2a70ff3a6da73547852585
SHA512 5a72d6384721e480760c380a62c213f6d0606ab593120ff9b8a428127d3b2a4d3519bc98574c3c50ad4f33ccca21485bef0a9fd2ce9fe3d1dc457245a3d1045e
SSDEEP 96:nfGbZuE3kUJVu3Nq58Rdq5xaMyKdB3Ry/T:aL9iqxyKdDE
TLSH
T1AAF144D5B3E88A14F1BB9DB0AFF0A1EA48697C511C11CA8F6118731E1973EC4DBB171A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fsactivitymonitor.PNF

Path C:\Windows\INF\c_fsactivitymonitor.PNF
Size 4KB
SHA256 e155562ed1f6396262d2a12d1d5fe8816cdd79cc3f0cc82b9657007da05d13dc
MD5 1df603462306497c538fde1cbbd6f5ad
SHA1 c548ce295e073f9a1899ea704beaf26c0f86afca
SHA512 c26a9fe1205945ba2c9fd0ba42f515e95913c4f7029147b93d9fdbe451b9c48524a0965580d2f1eea68a5a20ecf376da35966a09a1fd586f81e4ee5dbc58f95d
SSDEEP 48:k1oPdpH84VgfW1Cc5CQoZRlDbFR23eaIrn9KZRlmwp7fSg8fMT:WoFV84VgfW1ncxMk9KKwp7G4
TLSH
T124A18815B7D88A14F1BE9D35BCF050E695667C815D11CB6F3248334D1C72B85EBF2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fsantivirus.PNF

Path C:\Windows\INF\c_fsantivirus.PNF
Size 4KB
SHA256 18681a2bedb1a3615d052323e6d48007c07d82fc9d428f0851fad08d331b40dc
MD5 ad910f847bb448aa246d57af225e2d8c
SHA1 294373cab5c41a86a1f3e49a58b1ce8d55525b9f
SHA512 82b1cd775b91b73be550c0faf47b056e872fdbc1c864c585ed773e7a13af07ac6f60a3ecfdee30baa2cdfb30fec9ff638dbe7a8157b3208178c7372aa563f5f4
SSDEEP 48:4lIi2aT5SVfW/f5ecnR+HoIn9KpQp7fg0PlaChB:qIihQfW3Fovp7g0tJhB
TLSH
T1D6A16719B7D88E28F5BE8D35BCB060EA9161BC421C02CB5F6244770D2C727C4EBF1A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fscfsmetadataserver.PNF

Path C:\Windows\INF\c_fscfsmetadataserver.PNF
Size 4KB
SHA256 fa6d1928f63dd6102afb0b0b86d09674cef0d226aee29dc5e3423ebf2ea810d8
MD5 e4f65288c4bd4564ce6b97ca260b91b3
SHA1 eaaf7a03e67333d826c1df75ce6dcababc1ea92c
SHA512 1d36208f65436e21a348b127eb8748b2d4ce8eae18b2d638f102e546128a890b1b3790b177438b5ebaa202af1aaa7cfd16160f1a2a81d9bc0c6b95fc64562f6f
SSDEEP 48:gqmfkr5jZWUc5q65ygHyR/wddrbIGOCtGg7ap7fMUHn6h:xmfkr5lWaYHyyap7MUHnE
TLSH
T1A3A12556B7D88E18F5BA8D35ACF0A0EA9262BC925C16DA5F3248330C1C72780DBF1709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fscompression.PNF

Path C:\Windows\INF\c_fscompression.PNF
Size 4KB
SHA256 ae94f52b54f7c8db08e6a092580dbbd9832a1cf7c08b6ee694c49d69a67bf6ea
MD5 0b169ea3544e56945e9f6aa193397526
SHA1 99097f528893079e422676167c10e297218fd708
SHA512 8658b224c828e892aa0e0892ac582a5fdc2ff239a15ea1858a581b64b06f81ba328c363422afbbd4c0d6b92ffbccb04df7762522cb80fdb7326b783849028153
SSDEEP 48:0wrVBbjhTGsIfWV8Lo56SzBjLYZueaI6HF8RCp7fl4G51LF:hVPTOfWhLAMVDp79
TLSH
T120A16A49B6E88A18F5BA4D35BCF060E7A262BC925C16DA5F3248331C1C73690D7B0719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fscontentscreener.PNF

Path C:\Windows\INF\c_fscontentscreener.PNF
Size 4KB
SHA256 c7c26b06110dd17bd5bf9431d470f6ea9457672c9bfd0f833be840113ecddd97
MD5 3dd1fafc67698fcf0853aac5d7cfbdd3
SHA1 0c41cbdb5054256536b2639ffef7654b13003e91
SHA512 980ce615400e362c329621280cf90b6b75b93afc2d30815fc385e49dbddc00a40abaf120fb31ebdb1787700d454fc4612806aabc2c1915e11a19aa42a17e2161
SSDEEP 48:k1oPFspxzVgOgz3r5CejCOLDFRpZOaIQFBwj9L+wp7fSg8fMT:Woy/zVgOgzVjCOLppDJFyj9L+wp7G4
TLSH
T1A1A18714B3E48E24F57E8D31BCF090E795667C522C02CB2F3258735D1872A85EBB261A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fscontinuousbackup.PNF

Path C:\Windows\INF\c_fscontinuousbackup.PNF
Size 4KB
SHA256 53e76ba43650643db459e3d517425097a8a0652d24d5230edf6524359d0fea17
MD5 248a64ea976580b850f1435604852bb6
SHA1 8cbe92fc9699d72aaa8372616bf2886d89d84958
SHA512 93fc3ce048eaf2fcf4cd75ca6998b66b537940219a57ba7b3432bfd459b30c25b040aefc87afc04f8857ecfae2d12afbd7afe45657b49541311e0c49c6b2fb16
SSDEEP 48:y1oG4ogbxIfWgQmzy35OmRQerSlHW4IDbBRbwwQeup7f5FSSnLGCDNpzdr:soGCbxIfWgHwR3mruBNf3up750Shfr
TLSH
T191A16625B7E48E14F2BFAD34ADF0A2E755B6BC824C02DA1F3248331D1C36685D7B1A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fscopyprotection.PNF

Path C:\Windows\INF\c_fscopyprotection.PNF
Size 4KB
SHA256 53b342267a4fe84f3ce916edeb3334ff3246da6959b62260f79d04688cf59128
MD5 bc05f81bf7b2cd05951b4aaef6049c3a
SHA1 ef87f70b0f7c5ac7254708fcda87217d94f49376
SHA512 948dfbd619a1e485edb4ccd754bb2494d20259b84add461b79e64c9240e91fef39fd1204a948e3ec2e0b3d36c48989e5357b59c85ca9f83cfbd7bfd2286f124a
SSDEEP 48:e1o33hRjs9PfWrW5C60myPid0BIKNTJk0Qwp7fSg8fMT:4onHjs9PfWQzcxFNTW5wp7G4
TLSH
T116A18755B7E48A28F1BE5D32BCF060E695767C524D11CA2F3248335D1C72681EBF1B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fsencryption.PNF

Path C:\Windows\INF\c_fsencryption.PNF
Size 4KB
SHA256 db3af8112adeda181fe2687aca53471b59b94e9d8378e303baec27d562fa38a0
MD5 b73400bf9a27a89e6c9dd9dd9977f7fc
SHA1 8018998cfcbe80c12d98f657d327fabe21a220fe
SHA512 330513f884ecbe57c063827f8bf46068a220edc9c4e063fb07cec03052ce9bb2c129f175c585fbf607f1066fa82011145bf4559420fc9cdbb5fa1ac071df069b
SSDEEP 48:GhYF00HkbJhfWif5epcew6pCddA3I50UDZrc5p7f/3V:XVHYhfW3xsotUh2p7/F
TLSH
T16CA14619BBE98E18F2BE9D35ACF460E755627C520C06CA5F3244331D9C72684D7F1B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fshsm.PNF

Path C:\Windows\INF\c_fshsm.PNF
Size 4KB
SHA256 fa01b1f9cbe64252fa74067a01604eb73fe463fc85fe0109c1386cede3cfb432
MD5 f1f10d85d03792ab1856535a0946e6e5
SHA1 6486f89d65d421ea575e50836c6076e711015867
SHA512 6827c6de3f9be1999f5a760d96b7dd91ee440151819e4e034361209af20f64f49396311a50df839e233df98ea5ee081a3c48460ab0ca51ffb482d7e3f339fca9
SSDEEP 48:zQ416mgPAdkbkVsc5Ke+q1rrbIVqy4Yp7fqrL:zMJPASbc6y76sYp7S
TLSH
T183914515B7D88E24F2BADD35ACF061EB4966BC524C06CA1F3648731D4CB2781D7F1A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fsinfrastructure.PNF

Path C:\Windows\INF\c_fsinfrastructure.PNF
Size 4KB
SHA256 41217d2ca37c551ccae747b35ea0bf86a11bfc3d517ed2448aeb9aa6c3eda633
MD5 57bd825b923b6e0deccfb3a5ef125caf
SHA1 e24693542fb25a160b98ce3f8b58aad35c604291
SHA512 777cd61421ce06a79d3fad45a582cf4d828317acc1413368390bdc359ad2d9d6c833e38feb794de13d0922da853831d918fe2b135a51620e7a34a9e1eb659e09
SSDEEP 48:9kKoxAcTTzfWT/Rs5mm5QzThiJXO7ItB75sp7fS/0D:/RczfWFli8iAp7h
TLSH
T1FFA14A5AB7E59E24F17B8E31ACF052E796A27C821C01CA5F3258331D1CB2684D7F1A19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fsopenfilebackup.PNF

Path C:\Windows\INF\c_fsopenfilebackup.PNF
Size 4KB
SHA256 6fefeae13a372153e036a29fe389249b514e41394c9d9835b66e9f1d9a3bbd97
MD5 e8b67765e791a86c8cf3760ab71ca9a3
SHA1 fc1f770fb3be1924b7f4c8c43cc3abceff2363a0
SHA512 2783864473defbb88fe8a6b7b78e2314c866ddb3cf527bd0266f3002e753fd2d78596b80b085637bae6687725b858d9f5177693f5a6a9829a38a54f2132c8cb7
SSDEEP 48:9kA4W3dw1FPcVgfWv1LG5C2rIareHpRKuZIDbWRb59DarSop7fSg8fMf:3jNSPcVgfWv1c8D9uWNzDrop7Gs
TLSH
T111A14A55B7D88E14F1BFAD35ACF0A0E695667C425C12CA2F3248334D1C72785EBF2A19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fsphysicalquotamgmt.PNF

Path C:\Windows\INF\c_fsphysicalquotamgmt.PNF
Size 4KB
SHA256 2d2b1463071ef12cec9cbd6c72c433c384ef456c5c00cd6643a47c6c8d20e8ea
MD5 6fa438f754045a706b282a397de1b554
SHA1 a8a90e091491a7f5cd0feb22d5cb8b7b2fd4d5e6
SHA512 f74020f51c6385bd21aad8e7ab219ee9c85e58d4dfb564db11c1756d05725901fbdc58e8a44416d6ed9bfcaae13a75d57388439a0d2412a0e2c258bde9a8dbe2
SSDEEP 48:31OI26m1E+gEfWWWn1c5+NdwXijpx1keaISyAaGwpijYp7fkapR:3cIa1AEfWxnnKXYjMdyAqpYYp77R
TLSH
T118A14855BAD98E24F67F9D31ACF0A4E796A2BC421C11CB5F3248730D2C72B54DBB0A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fsquotamgmt.PNF

Path C:\Windows\INF\c_fsquotamgmt.PNF
Size 4KB
SHA256 4516cdd07bc08decd904ae90f68bfae06e8d901c15b9d819df74d914b2e91b93
MD5 9e02de9fdb64732ef780639640a1f96e
SHA1 54344a059f785bf78aeb4cf13843c15b245d73b9
SHA512 1544943cab19e8a9e47892dd97df07f6ce3a86fe5afe8351b799e91688dccef2e5c56b830e2ccb46a3da8da420e77973e2e08848c272824188f1f80b04159813
SSDEEP 48:cA4W3Zkp9czVgfWMSc5C7uFNPWX3rbISyA68MWop7fSg8fMf:xjJkroVgfWMo2d6dyA3xop7Gs
TLSH
T1E6A17514B6D98E18F67F9D31ACF0A0E69162BC425D01CA2F3244334C1872B85EBF1A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fsreplication.PNF

Path C:\Windows\INF\c_fsreplication.PNF
Size 4KB
SHA256 b0e56512a330cda61b0889e2136008031ef077b3d18f190c95c198ec4981198a
MD5 1146c93d4c3d7a67afd552bec65f9972
SHA1 b50a7b54d32eb424a399cea49ea3a4a6b27e5656
SHA512 f9d67fafc0dff8fd68003d855adaf8afff85ab0f8b48273563c3f49f5790cd649a89d5d2ce0b58a4351a684be1490929266a1bfc202f68cf534638d07155654d
SSDEEP 48:YwrVZP8hIGsQOns566YI4xCpddY3IDbcRb4iOp7fl4G51LF:9VWImO3fopA3ucNvOp79
TLSH
T1A4A1785ABAD88E14F5BA9D34BCF060E656667C826C12CA6F3208331D1C32695CBB171A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fssecurityenhancer.PNF

Path C:\Windows\INF\c_fssecurityenhancer.PNF
Size 4KB
SHA256 cab70bc519a4e905fa96b2bd275db35eab7ff65f7aed9bc78e096c1d5aa130fc
MD5 871e19c3f40174897561625cae86afe9
SHA1 3da3d7d301284e3749c7e366324791625c55f7fc
SHA512 43222f847004ee7d7d3d4c7dbec5ed12a0b62c6f8773af294a4d445c9bd1e6030cdbd2b0b14e6dc64bf76a012ff5c6d30e191a513c597f1d388db6bdc1af351e
SSDEEP 48:CQzG4HYc9Btkns5OjsGqRenoIsO30Yp7f5FSSnLGCDNpzdDD:XGK79BtkTsrFMkYp750Shf3
TLSH
T110A18C25B7E48E18F6BA9D31FCF052E798627C814C06DA1F3249731D1C72AC1DBB0629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fssystem.PNF

Path C:\Windows\INF\c_fssystem.PNF
Size 4KB
SHA256 db2f849234323e741e436edae0d5427f682af5f2094f7967f2d15d1de7da8272
MD5 c04a3519b16808e59e1120253218ed5f
SHA1 f334534e043af51a353477cdb7c29db13c256852
SHA512 9c9572ba32b335e517fc35851bddfc6f7bba6cd5a7a632df5878843070b4fce933371851fdae5b0340b6851685600345aa68c64e0586050a4750f279d90eeac8
SSDEEP 48:topYEAVcbJgA3W52CKyarg6uaIa6ByaJp7fHXB:tZEAVQ/95roa1I5Jp7HR
TLSH
T1CEA17919B7D58E24F1BE9D31BCF560E641627C621C06CB5F3284331D8C73694E7B161A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fssystemrecovery.PNF

Path C:\Windows\INF\c_fssystemrecovery.PNF
Size 4KB
SHA256 d6ed46098d8dbb9ea3eb5bd58dafd5f5bbc4612070aa53d36da22b7ce076d2f4
MD5 6350635dbba3cf7ef1dff67029641906
SHA1 9b787ad5d5b08eb966bb073059c6aaa6bda1cf79
SHA512 433b6c881309dc5a2d86e1be66f2052bacf938e10165e182c930431f277bbea881203427a6d64df9286e3574f88a711d1eb32983ffd0dcc7615b4a3c01668892
SSDEEP 48:m1oBP5dhBjVr4UZ5CyAvyMFnFAbCY3Iy/6Avawp7fSg8fMT:AoJf3jVr4tv1ry3Njvawp7G4
TLSH
T1FAA17A15B7D88A28F1BE5D31BCF090E795667C524D01CB6F3244339D1C72684E7F260A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fsundelete.PNF

Path C:\Windows\INF\c_fsundelete.PNF
Size 4KB
SHA256 21a2919a3473e93f2323a75112bd829f0ac1b9104e785a4f462f4cb980703ec2
MD5 38946012e37e80432ae10c730a9c989e
SHA1 b77a8ceb9c3eed82b1aa37a27bf7fa8e3971c133
SHA512 666eeb477d0edc61139f9a5fc01c607d8af1ec2be260b242031938d4bad512f9ef259f1e65ccb8d13df0d76ec7bc3a2455b4eab3cdc8e80bb65001fc7dffa3a2
SSDEEP 48:ZahgYTcmFfWlc5SEyyeZWK1keaIzv5yyeZOp7fuAyKDyj7a:8hPVFfW6PenMMRPeQp7upKDyj7a
TLSH
T164A18B56BAD88E14F2BA4D35ADF410E796A27C926C16CB2F3248335C0873684D7B162A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_fsvirtualization.PNF

Path C:\Windows\INF\c_fsvirtualization.PNF
Size 4KB
SHA256 e309fd7b18ee5d8c56389041cc16f91974f1504a924ece6bd4959aac76c8dd29
MD5 064afb05a3320582aaec2c83a2f0c287
SHA1 5d9096e3b5c00543cd4e6c0b025dc75076870ba5
SHA512 2cd6bc796a347fb123d14286d7071903220d125badd37f9593cc96aa4ce4c954fe9a36c6446c6d3e353b15e9fae910f720dd1a5939913c0bfd476bb3c7761117
SSDEEP 48:9oKoRZJTTv7LEr5mqdl2oRLLmkIS1AD7dl2Pp7fS/0D:34Jv7LmdFLBd1Afdup7h
TLSH
T193A1595AB7D89E14F5BB8E31BCF052E795A2BC521C02DA1F3204331D0C72694D7F0619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_holographic.PNF

Path C:\Windows\INF\c_holographic.PNF
Size 6KB
SHA256 163206f084279156629782f52d8dd691aca9620ee7f0da7163437e8c04cd19fd
MD5 0140c871d1f75a7912bdfabbb8926c89
SHA1 401d5a10aaee8ccd6617a3bd41e3b4375784378e
SHA512 c0e767af3233ca3b4f1821bfd2791db6b618fa2ac04484c63bdc592575c991021624c7f02e093853bde986f9e8b0d2bd6c7dcaebc1d6a589ee18c1bc86745197
SSDEEP 96:UUHYQZUC8DQflu9aCviAIWa2L5+8XXZhS2z:UKHfctai3XXZp
TLSH
T1BED178393AC54E25F1B5E6319DF661D7E0207C872C059D4B618D330E2C73152ABE6E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_linedisplay.PNF

Path C:\Windows\INF\c_linedisplay.PNF
Size 3KB
SHA256 2918b462e287efc6aeebc6a07891122ae04cb63a6e9df3e3ebeb0adbe82902c0
MD5 8d8660f9bd531e4a50a6bc500e893a2f
SHA1 41b3c071774d68037f23ccf23a01f7abba8ac940
SHA512 b5235d0b23df78a3a8da0615ea7a2ffa587cb1e41383efce85d1f429fd4a9d712c112d324c5a73dbf9abe73270f2d85a6e53b74c73c2d773fff61120d60cd1b9
TLSH
T1E9817A1577D58D2AF0BA9E786DF054EA9536BC915C16DA1F3248330E0CB2B84DBF0B29
MD5 SHA1 SHA512 TLSH

Submit Download

c_magneticstripereader.PNF

Path C:\Windows\INF\c_magneticstripereader.PNF
Size 3KB
SHA256 260ce9aa7b91e4b9a9a680d20051f0a6839664f2c2166c3ea930db33b34b7cda
MD5 998cf8b6890dad298dfb8ccb6fd83f08
SHA1 61522545b61316cef16e6708a8eb3fd6d8c00039
SHA512 fd9ce5bed4dc276660f48c091c2e037495d6279e62b4034036abc3dd54816ec99883c60fbc828055a8d4c6293e0aaaec3c44878bdd1e5f5b978dd095797c0a66
TLSH
T15781486A77D88D28F1BADE345EB014E65473BC514C16CA1F7588730D48B2784EBF0619
MD5 SHA1 SHA512 TLSH

Submit Download

c_mcx.PNF

Path C:\Windows\INF\c_mcx.PNF
Size 4KB
SHA256 7cca5a5ea6ce719bdc3441b2b10df8866b1a115841c79a2446c7ec7366d49718
MD5 a336acd019ee095727befe6a4d4977b0
SHA1 ec8dc3ac521677c556d99750cea38356279e2148
SHA512 31b0920c02c5b1d2778a24134bb0c7194ce5fd297277991536106ee4a93d854225b7e5e8bc1913458e891d776a982d173378106a4e7f9c81dfda05076b6533d7
SSDEEP 48:ti5FwxkbOOLVs566nEJmc/RebfrbIXqllX6JxYp7h:ti52kbOOJJPInVyJxYp1
TLSH
T1E1917769B7D98F24F27A9E31BDF090EA92617C815C06CE4F3248731D0C72784D7B0A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 42e8be06bd516b144c676a82e4d074505a264d2de8afdde31ed2465ee5d00d27
MD5 8a0c7db5ae955375c78c81c0e6d180a5
SHA1 0b72a242f4044457240fa666bcab9a2f0b67b0fe
SHA512 66d0c50586152c2e4703bea7ff9fd34b1c2203721d09ce9e2bb2dc0112c567c2da0a27b966661a62296d5804b3e2b58530ea5c7082fad2593bea4866f5343781
SSDEEP 96:yIyHRU59ka7kEsOcpXyY3qVxPOQlf88GcNy1/HC3T6gYq2hwyvVATCG5qylmqB9S:yDPDhpXQ2Q1HNogE3lJSZmXx7p
TLSH
T159428C56B7D9C919F1B68E70EDF851D948B57C821D01DE1F3068B34E1872E84EBB072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 6KB
SHA256 c59b7887b17be50f981509d822648bb3caae5173ca099c1dcf67e046acc13a82
MD5 d89c8bb612c903ae295b0f14e53bef15
SHA1 2b0d9058d682a69b275c661a46754d3efbc1ef42
SHA512 06f2e9bb9e46e3a80e29ff4ef6b2263b51973566026d068edc1e5070d93af7433cdb9e0f6671add4a444f9b646a84c94fe26315e97f4174bb9b4d5b7badf9359
SSDEEP 96:8NP2tl44AX7cWfWOMnVj3yjNMGUkTcRXqE18O8t746Efv3VfANNWuyfJ:81ffn2j3ExUkohRp6WqNWus
TLSH
T17FE1961577D98A24F1765930AFF5B0EB82657CC20C42EB5F3208731E18B3A84D3A1B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_netdriver.PNF

Path C:\Windows\INF\c_netdriver.PNF
Size 4KB
SHA256 802ffcf2934f0d9645c633ccce99bf564fe642151672fb6a32d56047739f4a2d
MD5 0a62cb4515daf958653a15ccda3919d3
SHA1 2ea1364aa64ab83353b709059b5e6fe6fa119899
SHA512 ba3bf37ed97bfc25bc86cb781881cdf8eec6855f51af2eae89ea06fd337aaec39219e9fac2c0c4e39db348d4e234e5cd17c0362f7b9dd56d8a9455fb08633490
SSDEEP 48:N+uNNpfWdm/s5mjRdugoDboXxboJ7zEp7l4GZ:N+mfWdCDOoXtoFEpV
TLSH
T1BA91555AB7E88A24F17A9D31BEF4A0F75161BC825C06CA2F3648331D1C72694E3B1729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_nvmedisk.PNF

Path C:\Windows\INF\c_nvmedisk.PNF
Size 5KB
SHA256 2c54c8d220a5416861dcc52ce06ccbfdcb9fe6c6f880699178a515b52c3886bb
MD5 e8832a2548a4357471209e5037e6bedd
SHA1 5edec2a528241261c9dc475dfd7e18988de65f7c
SHA512 6db515d80cdd911fa93c512e0554814e6750b3542026003db1ef4a24faf7ddb196e1a574ee89202cfb924788addb80a12926622feb7aeaea7a1cc3146719757e
SSDEEP 96:opdLhTkMbpB/W1W7nCJ4zYZtu+CN+xscd4af1C8:oy4B/t7W489vd4at5
TLSH
T196C19A51B7D58FA4F1B75D30ADF4A0EA8466BC815C42CE4F3218370D2C32A88D7B0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_primitive.PNF

Path C:\Windows\INF\c_primitive.PNF
Size 4KB
SHA256 7c8f22023b0b0ffc7f87d7b41e877ef337e4aaafa6ac0e4d1d8cc96a1758088b
MD5 caf50de1d8a526e883b868a515abe119
SHA1 15969b9a07c632e5279caf507df1750e204d9112
SHA512 9fd161c5d38c35173e5664955883d619dca75dc6169b935487cd903166217470a06733c5973b82e93a2589ef65cc3c306f1b06c382d8a46d32e62d9abb787178
SSDEEP 24:Z+fUJrMn0ky7itzBZXX96L59c6orqV1zbNCDil4I0ybg4KybbeTg/lp2gfxp7qQ3:Z8U6n0ky7Wxc5iwFCeaIDb/RbbVJp7dH
TLSH
T10481165AB7EA8E18F1BA99307CB460F691B67C421C06CB1F7648731D1C72684E7B071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 62a10ee5491b6050a7567946a74f0ebac871a31330d789d6a8bb0718397d0078
MD5 afabf4640e1a642bbfb305a13fee5c4d
SHA1 d025b560d9bfc3272c19e7b76bd1722215241699
SHA512 0771e4eac3f4cd51b3f8d7198cd235dbdb3679dbc5a4a07c18ebe2a5ea058b889295931f71230cb26cd0b7dfde899e1f57a78be7929be475c241cb7f8854239d
SSDEEP 96:rfjRG+gmJA6eSB3fOctxl0yxc8Vze8SWtpJO1:rrXG6zBnlZxc8ReBWlc
TLSH
T1F9B17B45F7EA8A18F17B5E30ADF4A4F695B2BC826D01CA5F3208731D18716D4EBB071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_proximity.PNF

Path C:\Windows\INF\c_proximity.PNF
Size 5KB
SHA256 0f3f305d40dd947a9b4604921d7e730308a4be67b80075cf461ce793fef32c7d
MD5 6739546642862d1f82d3a1d0690190e0
SHA1 d5b7083283b3c8a051b47be0f09c3ebb04b55b38
SHA512 4952034f9be604d618bc876de10243ee15bc0eb5da53c422640551f4ac69fd7af74a85220487ca2387561f1e97a74cf73fc511ef796ae8762386dfe68c6d2470
SSDEEP 48:60RA1oogf5S5Om5ky3E8owqOC86QVfVHVM3gQTVyzYJwm9C4l2Q:6061oN65b3f/NC8c3geczYJf1
TLSH
T183B1994577EA4E24F1BA8AB0EDF151E6A5627C431C05DE0F3208738D1C72A88E7B1726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_receiptprinter.PNF

Path C:\Windows\INF\c_receiptprinter.PNF
Size 3KB
SHA256 98b93db8f997cda293d6823788b2e28316e63cdf90616daf267fef941a061193
MD5 0c5c45c569231929a3683927ba442a1a
SHA1 c843e5ab84ab00cc8fc68cc8c33f37f9bae3f322
SHA512 db11df4db733661a4cf08a0f02d4bf999718de1a02a4e0ecfb78ef757f21b861117637714334346c6b734fae63ee723e4a0d11b157eeb8d9fac952b2eabd129b
TLSH
T11A819A1AB3E48D18F0FACA706DF054FAA526BC510C1ACAAF7248330D1872794E7F0B15
MD5 SHA1 SHA512 TLSH

Submit Download

c_scmdisk.PNF

Path C:\Windows\INF\c_scmdisk.PNF
Size 6KB
SHA256 ea2a2582c2f7e972d97af7559110ec363ab737ec5211d1fa74d2d2a60de72d44
MD5 f134d16f9a21ef175d2897f7b4c80b9a
SHA1 8d6cea4cf968ea26a28c0fce044c0bf66d423025
SHA512 d3642430947a31254a657fa25de6847ad22b94ce3b284d4c026fcd6788a8000543c1f9b53bced54cebd8bd8269495bb9df94df2ec5ca6eb883492acba74498ec
SSDEEP 96:8/0V37+8BhzIuHSuivqfY8aouaNdBEU/v87mW3aD:8/SAXbRQBFX8N4
TLSH
T1F2D19E16B7D9CB14F1B68E30ADF490EA9465BC815C01CE5F7654730E6C32B85E7B0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_scmvolume.PNF

Path C:\Windows\INF\c_scmvolume.PNF
Size 4KB
SHA256 f79d17dd4c9b067963364e640bb665505a3b48baa24e588d4a096093b0ac0a18
MD5 4aa42a00b8659753d949a2a165c29867
SHA1 3a85951166bc2f87317b97ed540a477fd6902f3c
SHA512 5be21b80316bb68f7650003f82ba723d17e8686512ab21074fe456826057e2b386eb3483113ec2074953c265598b9fa4545211d7549709c5d46adaefd981a80c
SSDEEP 48:kpvPlcFUvy4f5O0A2zYx8IDbvRb/KV2p7sXQ:khlNyIA2zYyuvN/s2pQg
TLSH
T13F91AB95BBE98E25F17B9D30BCF060E795B2BC525C01CA4F3208331D1872688DBB071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_smrdisk.PNF

Path C:\Windows\INF\c_smrdisk.PNF
Size 6KB
SHA256 0829c53fb14324f7f530a8f4c02c755c0ede4c395b956809268660302e24e5d7
MD5 e65cee26a94106ab81a3b7de063a3019
SHA1 e74f3b885b156febeb137103af1a2644c3229bce
SHA512 783b44b57f2ec5bbb03b2222ac3f6cad5e5dc8d068048e3113185cb4620257d53c7de36b8ef30e8bdbebdbf3ee555a4e30bf2b5c7ba48286a9cc5e4eaa14011e
SSDEEP 48:DaEpqgcdSi3ApUJ6X2nP//7p25W2EkrY3EweIY3IDbvORbEa6l4MDDGWOE9R4icP:lpqgcYiw6J6X2ZeYUF3umNz6gWX4J7AC
TLSH
T1DFD16755B7D88B24F17A5E30ADF0A4EA4665BC815C05DE5F3218770E2C32A84DBB073E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_smrvolume.PNF

Path C:\Windows\INF\c_smrvolume.PNF
Size 4KB
SHA256 f64e1193d171ba482f88c2589529e06f1326c46506c52da28e9a10d696c5c6fd
MD5 40e763aef39b005b35e523feb8608d8c
SHA1 ec48cc778d25912e9c77461697a340c7b32f2d21
SHA512 88e05fcffabce29e7ae70c711208b70ac52b25dc7a0c18d5e797b3a18a57c34a36ecdc487e062f6988fe41d207a126075b22e366b7882dd827cfe462fa2dbb74
SSDEEP 48:4hi2z6bhSmr5yIyPY3R3BIDbwRbBqyoyEp7SBTK:4htKhSGyPY3RRuwNB/oyEpWe
TLSH
T19E914865B7D88E24F27E4D31BDF050E686A6BC825C15DE4F3248731E1C72A84DBB1B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_sslaccel.PNF

Path C:\Windows\INF\c_sslaccel.PNF
Size 4KB
SHA256 0391195928365eedd1dfa10394db29def76e54050b9839c1e99bb279c710c246
MD5 c8302a0aba1764abfe9a94938287bd6d
SHA1 443626db33f95146dc03a3d7a6c201683fa7a8f1
SHA512 6a8e9bd19de1084210d1c3398979f299ae6a294052dc0bdc3db9a90f4665a7122cfa826d08d8144a2575225416cfb819d423c6dab0e82b9d845586c4b6f2c09f
SSDEEP 48:4TF+9t4CNUc5eTHl4llLDddY3oDb+2xb+yuHlqp79G1hX:4Y45l4llnA3OntQlqpc
TLSH
T19D918B59B7E99E24F1BA9D35BEF061E78562BC821C15DB0F3209330D1C72684C7B072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_swcomponent.PNF

Path C:\Windows\INF\c_swcomponent.PNF
Size 7KB
SHA256 fa421798b25958e1652ffba3060e5c07014caf1ad06f5561b51920663f0c59dc
MD5 dc31fa417aaa360a4c6ac28583719da7
SHA1 87ba2581e9619e8cd2d51d4d0f87c9e30981d20f
SHA512 d62bb3e7183c321d4050237cf4b9a51e1ba897186a4231f08e7721de2f541c370b91d9320b41c558967881f87ec1d20746920d5e550555abc49dcf6b1991e6c2
SSDEEP 96:bzgjoXtecSdctshuFNFYkbR64VqIqI4EHNA3RF:bEse/cqyMNIrrA37
TLSH
T1D5E12854B7E88B25F5B65E34ADF854EA4976BC821C01CA5F3128331D2C73E949AA0736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_ucm.PNF

Path C:\Windows\INF\c_ucm.PNF
Size 4KB
SHA256 39520bd25682c882cd9c5b242a424543065fbab0e87a256211df47ebb17788de
MD5 829d7ba6958754838768e976df7775cf
SHA1 0d17d8fd93773636eccb1fb2e03b33eda4f25590
SHA512 faa7394628db941461206649b2dc170c3a7097c512158ea8c7d040a9771ad5f05bac458ac019e3ee16dfd4d72d6a627f6b0a79523b4e3a890dacbfd355fbd67c
SSDEEP 48:aeGmM/A9fWwKo56JFvkX+W5fRoDbxxb4EzzvkX/WDp7q63:vH9fWw0vkhZROxt42vkvspj
TLSH
T189915669B7E58E24F17A9D75ACF5A0F69566BC421C02CF1F3248330D1C72A90DBB161A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 6e9305e188d3121b00e54d2278887589295342c44ffbb9c893f0acbb4fb5a863
MD5 5a504b001239c9fbdb6782a5a7a4022b
SHA1 55f1bfb4a5e8dfdaeb145309d384e39b8d0e54dd
SHA512 71e6d118c9e51003b81b1201b2eefbd01c13d0c2c66be6b328e859cdf4feae5da51645ff618c178af56819bdce5c6808a3661542c3f360c4f50f8040bc1f592e
SSDEEP 48:+RBCCGz7ElZd/Wycb5KQMR+YOmIDbXRbyKVMRGGLp7tVCCHr6mv7C:2BhGzY/WyUYvuXNyDLpxV3r6mvG
TLSH
T1C8918B59BBD58E24F27A9D35BDF450E746A2BC428C05CA5F3244330E0C72784E7B162B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc1-controller.PNF

Path C:\Windows\INF\dc1-controller.PNF
Size 14KB
SHA256 5749595af237e0b8a75161689df48a4edac7014f53c7c21da8842e82b17fd1d7
MD5 1d58c356c60ed71466c73af704e651d2
SHA1 8869ebfe7cc071b5b4d43c0aaf3ae93ab214bc76
SHA512 584522b54062683cd517a949ad292acd3a9b52ed30b515d662ef24ca54daa75ea8d93fc81a45dea0d6f1ea225d16e5483ef2bf6f996b5a878fddcc87387a1456
SSDEEP 192:gYLxfPVUVSQMlOJCr0V7/RW1C2srPnUcS3MuOvCj0y7eRYSjEY+pYeoWE5yhF8AG:gYLxeOWy3D85+K/t
TLSH
T18C5223017BE98B19F0B65A717EF555E688367DC19D00EB2F24A0734E5872FC4CAA0B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

digitalmediadevice.PNF

Path C:\Windows\INF\digitalmediadevice.PNF
Size 7KB
SHA256 de8843262fa670072afc60ab246cb5fa95e7ef1e43e56e490531b606eb88ae96
MD5 c2e0d084347a043dc953de156b629b25
SHA1 2bc87d91460d9b0f5a2b59eb66d89c245e04e901
SHA512 9902bca0f793fee960d72d6ca93d793f0968cdceb1dae94bef6da7213f3c10b0a9b86f82f2c5a79a159bf0f33993e1bda1c7c83e014bd788083d4cf6bdb98e42
SSDEEP 96:7vrkFJIfS45wix4fdt6cEdDCYHi159ABSOgGyOpt05:nwiCdgciRHiFA6Gtva
TLSH
T176F1E4127AD8DF5EF0FB49306EF461E62952BC829D12D69F3274770D1C32E84D6B062A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miradisp.PNF

Path C:\Windows\INF\miradisp.PNF
Size 11KB
SHA256 76bf27a070ea508542a3c19904553e9144ae7bef9ca989c5606ae4be5a4749a4
MD5 2b9bb60398360f66f7b839039b06ba5c
SHA1 ebc7290750a0ebd5d3d3ddcbbead78ab5da0e48b
SHA512 efddd24fc8cee48273582ea4b0938a2fb8426e7b291cb12d351f18fe2d5a369210ef0c6543fdef61d886bc9b82e9b461f1d5a27c75e02acc8a822b9241bb5db8
SSDEEP 192:x8zYQokEzk20HlMC3EsVCsmnAqk2l5pSKimyMiTLPPd:x8fplMkEsVnmnAqtl+KtKPPd
TLSH
T1E442459573D9CE24F0FB5D74ADF961E648267C916C11CB9F2264330E1832AD4DAF072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oposdrv.PNF

Path C:\Windows\INF\oposdrv.PNF
Size 8KB
SHA256 c28ca69a88bce92c90c5d93eb5956b465b7cf4764deee8228c6d01095a756fab
MD5 76f7712a167e8eb9a5516682cca88a38
SHA1 43403f6d21b312dde726621f1ee814e8e701e6a4
SHA512 6a2e2cf03a204a738e440846732236feb1feaf0fb49cc9682a42b8dbb1aa7c9923acfea3afebc2f13d60f66188cd006030d8de11ff60d5f392250fc23f3f08e3
SSDEEP 96:XM2mT1wjUwBF4rSmOjovI+5sv1bIRr2RGaA0ZS8LS1WIGNudUZKMF3+p/:XFRF4r1j59h2aWIGAUZK1B
TLSH
T1CE02244177E9CE04F5B35E78ADF551E64466BC829C25CB1F2264730E1C32AD8EAF072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rawsilo.PNF

Path C:\Windows\INF\rawsilo.PNF
Size 8KB
SHA256 6143a0698fc1802b5d8a9c6248e06f2b50b97b967c861b97d44126787a84f2fd
MD5 d5caf44a5a6fec11ffb18ef2cf339f0c
SHA1 338ee730e258c31c5376f891b90bea5bc8051d88
SHA512 83eae1c4d0ab3c311c2633343e2bf752c3d3d41eefbf16f1baa8bf59c36cfef303fc6b80c62885cb95dab1da67f32cd93ce79cb120ae1e95ad38009c48cd9ffe
SSDEEP 96:j9J0ZOOiYPZksQR1PRg2QeA6JSQyPBNNRgwRn4ORQni+RzRqRDJ2V6WfeDOQMp39:BZv3hWtPFKn9tkcx9
TLSH
T15B02514673F98A08F0B6AE30BDF4A5E65572BD516C20CA4F7218735E1C32A94E6B0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rdcameradriver.PNF

Path C:\Windows\INF\rdcameradriver.PNF
Size 13KB
SHA256 9aa061593b850313cdc88d9755ee7852203c531bed6a14e3763e1b4756277bf3
MD5 bdec8b381a7af49d9592bf7135b9096d
SHA1 bb3c440f2bb275c0322d3e78c9e32a70568e4550
SHA512 82b3513dd503a954dc432c50fb5d65bb114f18f4154aea4e9c41695651e0a66f0c14b59a73730942a4e8fa80b0a538f47c95c9fdc5b601fd143f8e182b45fb01
SSDEEP 192:+exjne6SlqUG34bRSGVPtk9rxVXgoODuq:+exTeleoUEk9Pggq
TLSH
T1D2524841BBEC8E24F1B39EB46EB091D98836BDA25C10D74F2151734E1972FC1DAB172A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remoteposdrv.PNF

Path C:\Windows\INF\remoteposdrv.PNF
Size 8KB
SHA256 328058c4b5f288078ec8826fcc8294609b938887c6dc560eb8baf299d85b29c7
MD5 43507b88710f846961e52b749cfa1a74
SHA1 25a856ab300c1b3175c544fa4e27d9f061c4b2da
SHA512 e252727bcaaa3997c702695b855e2b8a27802bef0da5f12b001b52c1f028eecf03a7c61f9c36bf36d8cd6fdac7a04244abaf9af92792fae9b9530b156b0402ad
SSDEEP 96:WRmoNavLQgP6EpUfyY0qaH91pD9gB5zgIt0Mr5L8LbtUIUssUvvb/9IZ///M:ie6EpuJwZD+zOvtU72pUE
TLSH
T1C902635477ED8E10F0B69E74ADF4A1E65876BC919C10CB5F2250330E1D32B88E6F072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ts_generic.PNF

Path C:\Windows\INF\ts_generic.PNF
Size 8KB
SHA256 b29e4790568a5d5d6feb9e76a64e2b9000faa0a629e4ddf21c1e67da8d4d021b
MD5 825e7eb2ff5bd54282d389c49a4e6a52
SHA1 1aa7cd398c47879d30f72e32fcfb4ef86200f1d4
SHA512 cbebafcdc3a08f7f8c618735af1da727bbc22b3c94bde89db6ae3d6d5f5f42d4ac55d570c8eb581b904149b56df476d1fc58b0fb456473d7e738d5ac38cafe2b
SSDEEP 96:RdIZJAQ6CMdgnL5Pj74iuONRBSZrP/tGmv3QM7YbgyEuVFl9nXvcp7bpGph:gT6CMdMLVj7CtJjYbgRw/vcg
TLSH
T1C012FE40B3EA8F1AF0F25A709EB850E658257D911C21DB1F3164731E2D33A94CAF072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsdprint.PNF

Path C:\Windows\INF\wsdprint.PNF
Size 7KB
SHA256 c9f9a311ab605d92754429f6cc398b64c9df5590ce49d729fbfa13a27c80f2c8
MD5 755db0bab7a1685b606d6581d9d8aea8
SHA1 aab7ef365c3b1e475420c89ce4842bd14439ddb4
SHA512 f75e7c07b2a73315896f0ae1ba20f4cae76048e160c207f0a678786f7923d37e1ef3a846afe1a3a64a6dca809c5275de60c58622966b2ad7e4764473bed047e8
SSDEEP 96:IlfrHcmpFCGsrtw1AQGRV6ltzjbZLNAzfaa03cPtKT/pudJsB:WMGstLL6TIIpudm
TLSH
T151F12346B3E98F14F0F65A745DB161EA1865BC919C11D61F3274B31E1832EC4DBB0B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusb22.PNF

Path C:\Windows\INF\xusb22.PNF
Size 9KB
SHA256 e258cbe4b5c84eca81e8b187d4cc348b27a0dd026e304f5291675fc4eb23cd74
MD5 c5579c3d00e5131178285808504154c9
SHA1 2bedf2158a04b9fb7e9a5616f788d123751130cb
SHA512 58d64d026731cffa6dcaa2204baf05e8061ae46dcb910ed251313ec7d94999c29f52559b69ec8b19ab9f337f883a072932e66ba6e927e439cc4e011ab6adfc4d
SSDEEP 96:092tB+uzyMPUfNK8FsRtGfu2Ns1omfR/661Gqed/mlGLc/lLm0/zk/VVEJMfI2Hm:RcfNDsRtGEw4GLcCV6JYm
TLSH
T11512595977E98F15F1F39D70ADF461EA04667C939C20CB1F21A4731E1832AC4EAB0B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1160-165-0x0000000003250000-0x000000000336E000-memory.dmp

Download

memory/1808-164-0x0000000003160000-0x000000000327E000-memory.dmp

Download

memory/2040-1-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/2040-9-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/2040-8-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/2040-0-0x000000000049C000-0x000000000049D000-memory.dmp

Download

memory/2040-7-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/2344-23-0x0000000005C90000-0x0000000005C91000-memory.dmp

Download

memory/2344-18-0x0000000005C90000-0x0000000005C91000-memory.dmp

Download

memory/2344-20-0x0000000005C90000-0x0000000005C91000-memory.dmp

Download

memory/2344-19-0x0000000005C90000-0x0000000005C91000-memory.dmp

Download

memory/2344-21-0x0000000005C90000-0x0000000005C91000-memory.dmp

Download

memory/2344-22-0x0000000005C90000-0x0000000005C91000-memory.dmp

Download

memory/2344-13-0x0000000005C90000-0x0000000005C91000-memory.dmp

Download

memory/2344-24-0x0000000005C90000-0x0000000005C91000-memory.dmp

Download

memory/2344-14-0x0000000005C90000-0x0000000005C91000-memory.dmp

Download

memory/2344-12-0x0000000005C90000-0x0000000005C91000-memory.dmp

Download

memory/5304-168-0x00000000033E0000-0x00000000034FE000-memory.dmp

Download

memory/5732-167-0x0000000003560000-0x000000000367E000-memory.dmp

Download

memory/5920-169-0x0000000002FD0000-0x00000000030EE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads