Overview

overview

8

Static

static

5

2026-06-28...ar.exe

windows10-2004-x64

8

2026-06-28...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 22:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-28_4a422ab4e4f5b58e5b9201ee0b0b2b1a_agent-tesla_amadey_icedid_njrat_vidar.exe
  • Size 1.4MB
  • Sample260628-2srqtsfy71
  • SHA256 1cd1da63ff921e15bfab0dc4e9326366139e7701b2fefa02d7758d2b01597fad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
executionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Power Settings 1 TTPs 12 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 61 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • NTFS ADS 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_4a422ab4e4f5b58e5b9201ee0b0b2b1a_agent-tesla_amadey_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_4a422ab4e4f5b58e5b9201ee0b0b2b1a_agent-tesla_amadey_icedid_njrat_vidar.exe"
    1⤵
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5748
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tzutil /s "Mountain Standard Time"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3944
      • C:\Windows\system32\tzutil.exe
        tzutil /s "Mountain Standard Time"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:704
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net start w32tm
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1200
      • C:\Windows\system32\net.exe
        net start w32tm
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:6084
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 start w32tm
          4⤵
            PID:1404
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c w32tm /config /manualpeerlist:time.windows.com /syncfromflags:manual /reliable:YES /update
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Windows\system32\w32tm.exe
          w32tm /config /manualpeerlist:time.windows.com /syncfromflags:manual /reliable:YES /update
          3⤵
            PID:4484
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c w32tm /resync /force
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5484
          • C:\Windows\system32\w32tm.exe
            w32tm /resync /force
            3⤵
              PID:5004
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powercfg /change monitor-timeout-ac 60
            2⤵
            • Power Settings
            • Suspicious use of WriteProcessMemory
            PID:5032
            • C:\Windows\system32\powercfg.exe
              powercfg /change monitor-timeout-ac 60
              3⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:2156
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powercfg /change monitor-timeout-dc 60
            2⤵
            • Power Settings
            • Suspicious use of WriteProcessMemory
            PID:5524
            • C:\Windows\system32\powercfg.exe
              powercfg /change monitor-timeout-dc 60
              3⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:4284
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powercfg /change standby-timeout-ac 60
            2⤵
            • Power Settings
            • Suspicious use of WriteProcessMemory
            PID:4548
            • C:\Windows\system32\powercfg.exe
              powercfg /change standby-timeout-ac 60
              3⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:3760
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powercfg /change standby-timeout-dc 60
            2⤵
            • Power Settings
            • Suspicious use of WriteProcessMemory
            PID:3416
            • C:\Windows\system32\powercfg.exe
              powercfg /change standby-timeout-dc 60
              3⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:4000
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powercfg /a
            2⤵
            • Power Settings
            • Suspicious use of WriteProcessMemory
            PID:3312
            • C:\Windows\system32\powercfg.exe
              powercfg /a
              3⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:3476
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powercfg /h off
            2⤵
            • Power Settings
            • Suspicious use of WriteProcessMemory
            PID:3260
            • C:\Windows\system32\powercfg.exe
              powercfg /h off
              3⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:3728
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\nic_config.ps1"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4628
          • C:\Windows\system32\mmc.exe
            "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
            2⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            PID:4732
          • C:\Windows\system32\mmc.exe
            "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
            2⤵
            • Drops file in System32 directory
            • Checks SCSI registry key(s)
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious behavior: SetClipboardViewer
            • Suspicious use of SetWindowsHookEx
            PID:1956
          • C:\Windows\system32\mmc.exe
            "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
            2⤵
            • Drops file in System32 directory
            • Checks SCSI registry key(s)
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious behavior: SetClipboardViewer
            • Suspicious use of SetWindowsHookEx
            PID:932

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              nic_config.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\nic_config.ps1
              • Size 716B
              • SHA256 1b95ed65982c3df32dece22b9402237933e95ba5af0720a0309bc2782d87b41e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              c_apo.PNF
              • Path C:\Windows\INF\c_apo.PNF
              • Size 6KB
              • SHA256 dcd675a316df8c2be6952f2e33aaee00d8843c084229f845414050718ef746b9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_barcodescanner.PNF
              • Path C:\Windows\INF\c_barcodescanner.PNF
              • Size 3KB
              • SHA256 44588363c0d00a6bd26575ce54e439d492c491ea9e02b85c490aa559fb9a5d88
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              c_camera.PNF
              • Path C:\Windows\INF\c_camera.PNF
              • Size 8KB
              • SHA256 92e1c789369fe60300e11d19df4debfd9d377377dccb13a61acc7b3684ac634b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_cashdrawer.PNF
              • Path C:\Windows\INF\c_cashdrawer.PNF
              • Size 3KB
              • SHA256 d4c6f856eec6a4a72860ce0562e4afac896687e98ff792dc5df6a90d3af3f4a5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              c_computeaccelerator.PNF
              • Path C:\Windows\INF\c_computeaccelerator.PNF
              • Size 4KB
              • SHA256 ea188d3dc8ef399e64ce47f44c89ea2ddf4f0e2721b6d869758f0fa20865b07f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_diskdrive.PNF
              • Path C:\Windows\INF\c_diskdrive.PNF
              • Size 6KB
              • SHA256 b2572d3c71e391b369692d16f96a223e42f62410a8b28d66e8025d4e3367ae83
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_display.PNF
              • Path C:\Windows\INF\c_display.PNF
              • Size 8KB
              • SHA256 7fcfb1cbec3a22cd8436dcb77b761e35423a76f63056567210114f8bf4c05587
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_extension.PNF
              • Path C:\Windows\INF\c_extension.PNF
              • Size 4KB
              • SHA256 c4e38d6187237c244c2e7779a81def056fafe152061efb37c1eeea2791b2c922
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_firmware.PNF
              • Path C:\Windows\INF\c_firmware.PNF
              • Size 8KB
              • SHA256 d53448932c86b232bbdf64e3d170a7c16f4491c9a8a8128b31a619ccd43351dc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fsactivitymonitor.PNF
              • Path C:\Windows\INF\c_fsactivitymonitor.PNF
              • Size 4KB
              • SHA256 8e57e318c32492cb0d58ca907b46e8c3263e110defb7e847507710694c73fdf0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fsantivirus.PNF
              • Path C:\Windows\INF\c_fsantivirus.PNF
              • Size 4KB
              • SHA256 7004779dc140fc772841ad86bb59a65ac1cfb8352e205a1fd41df1335d3ac529
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fscfsmetadataserver.PNF
              • Path C:\Windows\INF\c_fscfsmetadataserver.PNF
              • Size 4KB
              • SHA256 32fbdc1a5eb442c81e51941ee44e512d53b35daba5b12f06866c867b1f7fc2c3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fscompression.PNF
              • Path C:\Windows\INF\c_fscompression.PNF
              • Size 4KB
              • SHA256 556fbbf5a1d309b0cc8f0cbe12c5245b31e75326a4f4f76f294497dee7c400a6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fscontentscreener.PNF
              • Path C:\Windows\INF\c_fscontentscreener.PNF
              • Size 4KB
              • SHA256 ae33341c5bd572c749833bd237c0bb6876b4720b65978bda0ced88a41fa41ad4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fscontinuousbackup.PNF
              • Path C:\Windows\INF\c_fscontinuousbackup.PNF
              • Size 4KB
              • SHA256 6a45f897921e6698bd82a9cc5ec9a33595dbc066c15867b51427590b1961e835
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fscopyprotection.PNF
              • Path C:\Windows\INF\c_fscopyprotection.PNF
              • Size 4KB
              • SHA256 29464d2ff2b9a852b5df24cb25f882722d9420653d42e1ac719b9060fa1c6569
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fsencryption.PNF
              • Path C:\Windows\INF\c_fsencryption.PNF
              • Size 4KB
              • SHA256 8e3b4b810181f201f0eaf4baedc78bb0e7a7330aafcd3edf1b421bc9123f5705
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fshsm.PNF
              • Path C:\Windows\INF\c_fshsm.PNF
              • Size 4KB
              • SHA256 c771698e573553a82cd647c26999ed4be98408c59568b9116f28477745a677de
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fsinfrastructure.PNF
              • Path C:\Windows\INF\c_fsinfrastructure.PNF
              • Size 4KB
              • SHA256 f96c237f8fca4067ad33e4a8c0b2495dfceef9802170b82bb76edc7242758993
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fsopenfilebackup.PNF
              • Path C:\Windows\INF\c_fsopenfilebackup.PNF
              • Size 4KB
              • SHA256 fb6d0702f829cdb9781a470a9bd360e9b0265d36751025aa265b0ba0130968cc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fsphysicalquotamgmt.PNF
              • Path C:\Windows\INF\c_fsphysicalquotamgmt.PNF
              • Size 4KB
              • SHA256 3841faea1989280a3a7f54e01cfa99102ff8f2cb3e65743312ba6f49306d87b8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fsquotamgmt.PNF
              • Path C:\Windows\INF\c_fsquotamgmt.PNF
              • Size 4KB
              • SHA256 74fb8b5154277fff6e295d1fd0a5a1ab0fda9cf2073d1e1d2ac87b90f790c881
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fsreplication.PNF
              • Path C:\Windows\INF\c_fsreplication.PNF
              • Size 4KB
              • SHA256 b0e88b6ef66d25af0c227aac33f9c85845af6da6fbf7bf20105d87b5f50e0abb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fssecurityenhancer.PNF
              • Path C:\Windows\INF\c_fssecurityenhancer.PNF
              • Size 4KB
              • SHA256 5d772f1de4e6d08e3780e85585fe5efac1cbb72b5cdfd111daa02a6a4e7e8c5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fssystem.PNF
              • Path C:\Windows\INF\c_fssystem.PNF
              • Size 4KB
              • SHA256 b13d47ab599d77454fc9f7896da384c32b44202d8dd3eae5c7481ae36345f034
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fssystemrecovery.PNF
              • Path C:\Windows\INF\c_fssystemrecovery.PNF
              • Size 4KB
              • SHA256 6e6ebe4664e19d3662fbbb187010d4a3037eb6a46d128ddd775c423214ee2a91
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fsundelete.PNF
              • Path C:\Windows\INF\c_fsundelete.PNF
              • Size 4KB
              • SHA256 6d564155e33fc392fe937c31cc1280d096201dd1dc19c1e5c51adf94f42a5b9c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_fsvirtualization.PNF
              • Path C:\Windows\INF\c_fsvirtualization.PNF
              • Size 4KB
              • SHA256 44def632816e4e4459940ab6c2705ae1981d7ebc970bf60099a4889d23fd8820
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_generic.PNF
              • Path C:\Windows\INF\c_generic.PNF
              • Size 4KB
              • SHA256 2bf5225cf6017133e5edb14a3ee50f9c9e056c56c0d0a36ca314ffecb1f2cf46
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_i3c.PNF
              • Path C:\Windows\INF\c_i3c.PNF
              • Size 4KB
              • SHA256 adb21fbda07ef3643876b48b88e1039bc1c8d75d98f63ffca3482a41559cd222
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_linedisplay.PNF
              • Path C:\Windows\INF\c_linedisplay.PNF
              • Size 4KB
              • SHA256 9202cb1f8064f6134cb2b3804db73cbab731a5e4d8e7480bde846ec83df72f7b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_magneticstripereader.PNF
              • Path C:\Windows\INF\c_magneticstripereader.PNF
              • Size 3KB
              • SHA256 a8c75ddc119ded1e0b4f786b985addd1ca9571e7348b72b2a379c5834f29f81b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              c_mcx.PNF
              • Path C:\Windows\INF\c_mcx.PNF
              • Size 4KB
              • SHA256 44462e20a2b3da5cfd97dba6d56bd038cbdb86fe4f562f0af679d61c1750a546
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_media.PNF
              • Path C:\Windows\INF\c_media.PNF
              • Size 12KB
              • SHA256 c30651ec1095d0a155fafbafcd2ee8a0d899ee02bceb57bce59cb27260cda470
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_monitor.PNF
              • Path C:\Windows\INF\c_monitor.PNF
              • Size 9KB
              • SHA256 4962e3e833194a789c6172d10e146f9abf8671928060ebed92fcd365fb2a28b2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_netdriver.PNF
              • Path C:\Windows\INF\c_netdriver.PNF
              • Size 4KB
              • SHA256 c5b1c0389af436cdf8c01c8bd728b8513eb21ba8172ca2ec0c758c22eae417c0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_nvmedisk.PNF
              • Path C:\Windows\INF\c_nvmedisk.PNF
              • Size 6KB
              • SHA256 1a942c12eced7f3dd016e14fcc6004a49777ae08b9df6475a0b16b0c18b7a753
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_primitive.PNF
              • Path C:\Windows\INF\c_primitive.PNF
              • Size 4KB
              • SHA256 bc8962144606061c2eb076925266fdbfd5caa8373349920bb8db150d24378a02
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_processor.PNF
              • Path C:\Windows\INF\c_processor.PNF
              • Size 5KB
              • SHA256 b1e901db016c4dfe9b6beb41886c6114c41619777fe681b26ecdd0a76683e121
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_proximity.PNF
              • Path C:\Windows\INF\c_proximity.PNF
              • Size 5KB
              • SHA256 73f487799464e533574caa1daa350a5ca08a817a73ce40a1f1d32245e1cd44e1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_ramdisk.PNF
              • Path C:\Windows\INF\c_ramdisk.PNF
              • Size 5KB
              • SHA256 07f009c279f5d5951e1046fbd8e4a3fdc324dd0275eb59c0a8d97d302e83a9a1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_receiptprinter.PNF
              • Path C:\Windows\INF\c_receiptprinter.PNF
              • Size 3KB
              • SHA256 709073037385144447080a21d7a40e90c4d11bcd3b4da8e219a9098d4c0a9d69
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              c_scmdisk.PNF
              • Path C:\Windows\INF\c_scmdisk.PNF
              • Size 6KB
              • SHA256 15d0f6c26aa503c418eb35d960b39539b7f4e989f39657c2d0d72bd77e540540
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_scmvolume.PNF
              • Path C:\Windows\INF\c_scmvolume.PNF
              • Size 4KB
              • SHA256 1431aa0ffe9339e3c3e3800bf41c1239c8860fa97490be976d57d0e171adcbbf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_smrdisk.PNF
              • Path C:\Windows\INF\c_smrdisk.PNF
              • Size 6KB
              • SHA256 eee734a902777071929071fc5e624428c134568fad85bf581a6326adcd8beea9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_smrvolume.PNF
              • Path C:\Windows\INF\c_smrvolume.PNF
              • Size 4KB
              • SHA256 6ff7068f56fb5ce54982e0bb42dc6947e892ff3f034ba4f7b71c3738caa237cf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_sslaccel.PNF
              • Path C:\Windows\INF\c_sslaccel.PNF
              • Size 4KB
              • SHA256 3d5ce57cc691eb6f0bc79700f6ca483e11ddb3feb87f76697d6167dc71d25055
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_swcomponent.PNF
              • Path C:\Windows\INF\c_swcomponent.PNF
              • Size 7KB
              • SHA256 fbaf277df61f7b97b33d51eb4ec0455162db9f184000d8cb1249fe60111b87ba
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_ucm.PNF
              • Path C:\Windows\INF\c_ucm.PNF
              • Size 4KB
              • SHA256 00d7d550cc2a58618942fbcf508f821440e4cad6c2d0398d8839ccd134e25228
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              c_volume.PNF
              • Path C:\Windows\INF\c_volume.PNF
              • Size 4KB
              • SHA256 d7321989b09c47c46a2e5906a12397abe848e6436532d4dfcb46d54357db2f2b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dc1-controller.PNF
              • Path C:\Windows\INF\dc1-controller.PNF
              • Size 14KB
              • SHA256 673bd3d5d88e92c3fadd07fca36ffc438e0cf47138e856524de7ba77769fbd5d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              digitalmediadevice.PNF
              • Path C:\Windows\INF\digitalmediadevice.PNF
              • Size 7KB
              • SHA256 272d1c0052721198cdb4c5efbe7452ca20c0707ac929bc5cc64d040e2edc881e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              eyegazeioctl.PNF
              • Path C:\Windows\INF\eyegazeioctl.PNF
              • Size 9KB
              • SHA256 aa7b8e8003cb65309c2e585b52250508b7517fb450c5335752f48edc3294c376
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              miradisp.PNF
              • Path C:\Windows\INF\miradisp.PNF
              • Size 11KB
              • SHA256 a7bbd2adab743777028ad8baed0f4229f7baf61fa828ee062e7e7134b903050f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              oposdrv.PNF
              • Path C:\Windows\INF\oposdrv.PNF
              • Size 7KB
              • SHA256 460990a6e3da209764166070f7036cdc0f972ced2f0110d5bef867ea081e13b4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              rawsilo.PNF
              • Path C:\Windows\INF\rawsilo.PNF
              • Size 7KB
              • SHA256 e8138779d557ceeb238f3ec1a6d9e43d31221bc6e52984923d58c1d2ef8244dd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              rdcameradriver.PNF
              • Path C:\Windows\INF\rdcameradriver.PNF
              • Size 12KB
              • SHA256 24f8e5540956788a2fa345c7aecc57dbddceedf8788744b88f84a7ea225eeb0e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              remoteposdrv.PNF
              • Path C:\Windows\INF\remoteposdrv.PNF
              • Size 7KB
              • SHA256 503f0a1d350bd33a062a5227ef8c5ad3cc83224ae38cc0fd649e5682dd57475d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ts_generic.PNF
              • Path C:\Windows\INF\ts_generic.PNF
              • Size 8KB
              • SHA256 fb72043e2f2b7564f58b023f814725877088448804faaaa66d5c6659630202b1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wsdprint.PNF
              • Path C:\Windows\INF\wsdprint.PNF
              • Size 7KB
              • SHA256 17343a3fd3c778fdbb39f686558dd46b048d011765ab2e3a1b02a5232ce4f8cb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              xusb22.PNF
              • Path C:\Windows\INF\xusb22.PNF
              • Size 9KB
              • SHA256 863bb1a5de22022bfbca973f911670e4084d1ac7861394e897c9965ac65d9461
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/4628-1-0x0000025DAEA00000-0x0000025DAEA22000-memory.dmp
              Download

              memory/4628-7-0x0000025DAEBD0000-0x0000025DAEBEE000-memory.dmp
              Download

              memory/4628-8-0x0000025DAEE10000-0x0000025DAEEC2000-memory.dmp
              Download

              memory/4628-9-0x0000025DAEBF0000-0x0000025DAEBFA000-memory.dmp
              Download

              memory/4628-10-0x0000025DAF040000-0x0000025DAF05E000-memory.dmp
              Download