Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/06/2026, 04:31
Static task
static1
Behavioral task
behavioral1
Sample
APD_612_T82IV.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
APD_612_T82IV.exe
Resource
win11ltsc2024-20260629-en
General
- Target APD_612_T82IV.exe
- Size 12.8MB
- Sample260630-e5tpmaew5v
- SHA256 364653ca51a093f8109ef172045ef6bb1b3c5c4374ea4fd5360be35a12ccec13
- MD5 234675f0d8cdb87af59a4f39fe53b4d2
- SHA1 3c099c97cea53e6fe7ed5e22291b7bcaa4b69c34
- SHA512 3ab4f146e90c963954c502e7000ea5bf4e8cd4b9a74f11e97a0cf057c9c4b01a9cf3e675d58a4610594f8ee6a1ec8cce073b50f9cb1f79454da61bed1c5518d6
- SSDEEP 393216:PeJ8zZlJAaGIwl4Xce3fTBqRUfKtjVc6zjX:PCalKaGzl4XL3fTBcjJzL
- TLSH T112D612D0D67398B2D663247202F09BB8CAFD5D62082545AD365CBDA4DAF0E90B74B1FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Port Monitors 1 TTPs 20 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\EPSON TM Port Monitor\Ports spoolsv.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\EPSON TM Port Monitor\Driver = "EA6PM.dll" spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\EPSON TM-T Receipt6 LM spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\EPSON TM Port Monitor Setup.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\EPSON TM Port Monitor\Enable PnP Install 6 = "1" Setup.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Virtual Port Monitor\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\EPSON TM Port Monitor spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port spoolsv.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\EPSON TM-T Receipt6 LM\Driver = "EA6LMTMT.DLL" spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Virtual Port Monitor spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports spoolsv.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\TMUSB64.sys Setup.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TMUSB\ImagePath = "System32\\DRIVERS\\TMUSB64.SYS" Setup.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{d4faad16-f457-4743-90a3-879b878b15a8}\MPDW-pipelineconfig.xml DrvInst.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\EA6MDLTMT203.GPD spoolsv.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_5083be912240d5a2\Amd64\STDNAMES.GPD spoolsv.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_5083be912240d5a2\Amd64\TTFSUB.GPD spoolsv.exe File created C:\Windows\system32\EAPApiData.dll Setup.exe File created C:\Windows\SysWOW64\EAPApiData.dll Setup.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\tmusb64.inf_amd64_36083d8cc53a6889\TMUSB64.SYS DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\amd64\EA6Bcd0.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_5083be912240d5a2\Amd64\UNIRES.DLL spoolsv.exe File created C:\Windows\System32\DriverStore\Temp\{098bc9e0-cc27-6e4a-b5fd-e05b3b6c878e}\SETE352.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\amd64\SETE7DA.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\EA6MDLTMT180_1.GPD DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\SETE7EE.tmp DrvInst.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\STDSCHEM.GDL spoolsv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\TTFSUB.GPD spoolsv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\EA6Bcd0.dll spoolsv.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d4faad16-f457-4743-90a3-879b878b15a8}\SETE23B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\EA6MDLTMT203.GPD DrvInst.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\SETEA5C.tmp spoolsv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\EA6MDLTMT203.GPD spoolsv.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\amd64\SETE7C7.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\SETE7F0.tmp DrvInst.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\SETEA5A.tmp spoolsv.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d4faad16-f457-4743-90a3-879b878b15a8}\SETE238.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d4faad16-f457-4743-90a3-879b878b15a8}\SETE239.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d4faad16-f457-4743-90a3-879b878b15a8}\MPDW-PDC.xml DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{098bc9e0-cc27-6e4a-b5fd-e05b3b6c878e}\tmusb64.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{098bc9e0-cc27-6e4a-b5fd-e05b3b6c878e}\SETE353.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\amd64\SETE7D9.tmp DrvInst.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\EA6UIPTMT.dll spoolsv.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\SETE7DD.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\SETE7EE.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\SETE801.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{d4faad16-f457-4743-90a3-879b878b15a8}\SETE238.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\amd64\SETE7C8.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\SETE7ED.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\EA6PIITMT.INI DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ea6instmt.inf_amd64_23e17478a655b625\ea6instmt.inf DrvInst.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\UNIRES.DLL spoolsv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\EA6RESTMT.DLL spoolsv.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d4faad16-f457-4743-90a3-879b878b15a8}\prnms009.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\SETE7DC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\SETE7EF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\SETEA48.tmp spoolsv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\SETEA49.tmp spoolsv.exe File created C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\SETEA49.tmp spoolsv.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d4faad16-f457-4743-90a3-879b878b15a8}\prnms009.Inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d4faad16-f457-4743-90a3-879b878b15a8}\SETE24E.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{098bc9e0-cc27-6e4a-b5fd-e05b3b6c878e}\SETE351.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\tmusb64.inf_amd64_36083d8cc53a6889\TMUSB64.CAT DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\ea6instmt.inf DrvInst.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\EA6RESTMT.DLL spoolsv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\EA6BcdR0.dll spoolsv.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_5083be912240d5a2\Amd64\UNIDRV.HLP spoolsv.exe File created C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\amd64\SETE7C6.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\SETE7DB.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380}\EA6INSTMT.cat DrvInst.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\EA6PIITMT.INI spoolsv.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_5083be912240d5a2\Amd64\UNIDRV.DLL spoolsv.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f058bea9-af73-5844-8fcc-bee1eb492380} DrvInst.exe File created C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\SETEA47.tmp spoolsv.exe File created C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\SETEA5A.tmp spoolsv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\{6D3771CC-C828-4E41-8378-E79B5100B385}\UNIDRV.DLL spoolsv.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\TMUSB800\TMUSBXP\TMUSB90.inf Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\fr\LayoutPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\no\SendCommandPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\th\2DSymbolPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Setup\Resource\French\Resource.ini Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\es\FontReplacePlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\ja\LogoSettingPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\tr\SendCommandPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\zh-cn\2DSymbolPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\StatusAPI\win32\EAPApiData.dll Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\PrinterReg\Info-ZIPlicense.txt Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\TMUSB800\TMUSB64\licenseE.txt Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\th\FontReplacePlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\zh-hk\2DSymbolPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Driver\TM-T\i386\EA6Bcd0.dll Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\TMUSB710\TMUSB64\licenseE.txt Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\it\LayoutPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\ja\BarcodePlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\zh-tw\2DSymbolPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\PrintManagementTool\EAPPrtMgr.dat Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\nl\LogoSettingPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\PortMonitor\win32\EA6PM.dll Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\en\LogoSettingPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\fr\SendCommandPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\ko\2DSymbolPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\ko\UserDefinedPaperPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\no\BarcodePlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\no\FontReplacePlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\sl\FontReplacePlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Driver\TM-T\i386\EA6UIPTM.DLL Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\TMUSB800\TMUSBXP\dpinst.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\Lang\0412.DAT Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\da\LayoutPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\en\SendCommandPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\es\LogoSettingPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\hr\LayoutPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\no\LogoSettingPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\sv\LogoSettingPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Driver\TM-T\EA6INSTMT.INF Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\cs\BarcodePlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\cs\FontReplacePlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\zh-hk\EJPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\fr\EJPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\th\LogoSettingPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\Advanced Printer Tool\SystemFiles\StatusAPI\EAPApiData64.dll Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Driver\TM-T\arm64\EA6LMTM.DLL Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\TMUSB710\Setup.exe Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\Lang\041F.DAT Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\de\LayoutPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\zh-tw\LayoutPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\EAPctled.EXE Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\nl\BarcodePlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\th\SendCommandPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\TMUSB800\TMUSB64\dpinst.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\nl\FontReplacePlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\ru\LogoSettingPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Driver\TM-T\EA6MDLTMT203_1.GPD Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\de\UserDefinedPaperPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\nl\LayoutPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\sl\LayoutPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\zh-tw\UserDefinedPaperPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Driver\TM-T\arm64\EA6RDPTM.DLL Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\hr\EJPlugin.xml Setup.exe File created C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Utility\locale\hu\BarcodePlugin.xml Setup.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log spoolsv.exe File created C:\Windows\inf\oem1.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\SystemTemp\E5EE45E2-B014-412C-B1FF-945DDAD4CFEE spoolsv.exe File opened for modification C:\Windows\INF\setupapi.dev.log pnputil.exe File created C:\Windows\SystemTemp\FB139BEF-2977-4702-9002-BBE85DFB2E05 spoolsv.exe File opened for modification C:\Windows\DPINST.LOG dpinst.exe File opened for modification C:\Windows\INF\setupapi.dev.log rundll32.exe File created C:\Windows\SystemTemp\95038E76-ECAE-4013-B4E0-2C5321FDF7A5 spoolsv.exe File created C:\Windows\SystemTemp\E18CB924-EFCF-4099-83CB-B13191CBBD2C spoolsv.exe File created C:\Windows\SystemTemp\03660B75-B46F-4C49-B1BB-7EFBA1536FD1 spoolsv.exe File created C:\Windows\inf\oem2.inf DrvInst.exe File created C:\Windows\SystemTemp\9CD100ED-8A3A-4A30-B30C-380D68D44327 spoolsv.exe File created C:\Windows\SystemTemp\6D245583-9A5B-4743-954A-D032829A8AF4 spoolsv.exe File created C:\Windows\SystemTemp\1C39B359-161F-4371-BC1F-BD1010C205A7 spoolsv.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log dpinst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe File created C:\Windows\SystemTemp\5249AC4A-6D35-411E-AA00-AF7343E3D6C6 spoolsv.exe File created C:\Windows\SystemTemp\ECE381A8-4434-4713-B18A-094B464B4F2B spoolsv.exe - Executes dropped EXE 6 IoCs
pid Process 3256 Setup.exe 3876 APDLog.exe 5408 Setup.exe 6128 Setup.exe 484 dpinst.exe 3272 PrinterReg.exe - Loads dropped DLL 5 IoCs
pid Process 3408 APD_612_T82IV.exe 6000 spoolsv.exe 3256 Setup.exe 6000 spoolsv.exe 6000 spoolsv.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APD_612_T82IV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language extrac32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APDLog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PrinterReg.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID dpinst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs dpinst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs dpinst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs dpinst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs dpinst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dpinst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID dpinst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom dpinst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dpinst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID dpinst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 dpinst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dpinst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom dpinst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dpinst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dpinst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 dpinst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3256 Setup.exe 3256 Setup.exe 3256 Setup.exe 3256 Setup.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3256 Setup.exe 3256 Setup.exe 3256 Setup.exe 3256 Setup.exe 3272 PrinterReg.exe 3272 PrinterReg.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3408 wrote to memory of 3256 3408 APD_612_T82IV.exe 86 PID 3256 wrote to memory of 4008 3256 Setup.exe 87 PID 3256 wrote to memory of 5408 3256 Setup.exe 93 PID 5408 wrote to memory of 6128 5408 Setup.exe 94 PID 6128 wrote to memory of 484 6128 Setup.exe 96 PID 6128 wrote to memory of 4584 6128 Setup.exe 98 PID 4584 wrote to memory of 2788 4584 cmd.exe 100 PID 4584 wrote to memory of 5816 4584 cmd.exe 101 PID 3256 wrote to memory of 1796 3256 Setup.exe 102 PID 3256 wrote to memory of 2148 3256 Setup.exe 104 PID 3256 wrote to memory of 3272 3256 Setup.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\APD_612_T82IV.exe"C:\Users\Admin\AppData\Local\Temp\APD_612_T82IV.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\APD6\Setup\Setup.exe"C:\Users\Admin\AppData\Local\Temp\APD6\Setup\Setup.exe"2⤵
- Boot or Logon Autostart Execution: Port Monitors
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\extrac32.exeC:\Windows\system32\extrac32.exe /L "C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82IV\" /E "C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82IV\TPDBase.cab"3⤵
- System Location Discovery: System Language Discovery
PID:4008
-
-
C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\Setup.exe"C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\Setup.exe" -s23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\TMUSB800\Setup.exe"C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\TMUSB800\Setup.exe" -s24⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\TMUSB800\TMUSB64\dpinst.exeTMUSB64\dpinst.exe /s /se /sw /sa /el5⤵
- Drops file in Windows directory
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:484
-
-
C:\Windows\SYSTEM32\cmd.execmd /c chcp 437 && pnputil /enum-drivers > C:\Users\Admin\AppData\Local\Temp\TMUSB.txt5⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\system32\chcp.comchcp 4376⤵PID:2788
-
-
C:\Windows\system32\pnputil.exepnputil /enum-drivers6⤵PID:5816
-
-
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 printui.dll,PrintUIEntry /ia /f "C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Driver\TM-T\EA6INSTMT.INF" /m "EPSON TM-T(203dpi) Receipt6"3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1796
-
-
C:\Windows\system32\pnputil.exe"C:\Windows\system32\\pnputil.exe" -a "C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Driver\TM-T\EA6INSTMT.INF"3⤵
- Drops file in Windows directory
PID:2148
-
-
C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\PrinterReg\PrinterReg.exe"C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\PrinterReg\PrinterReg.exe" /install /dev=TM-T82IV3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3272
-
-
-
C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\PrinterReg\APDLog.exe"C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\PrinterReg\APDLog.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3876
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Drops file in System32 directory
- Drops file in Windows directory
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:6000
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "d" "C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf" "9" "43057df13" "0000000000000178" "WinSta0\Default" "000000000000015C" "208" "C:\Windows\system32\spool\tools\Microsoft Print To PDF"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:5260
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{43d11d31-79cd-2b42-b7af-d87b2d3215f9}\tmusb64.inf" "9" "40bb771fb" "0000000000000184" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\epson\epson advanced printer driver 6\driverpack\tmusb\tmusb800\tmusb64"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3112
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f4e0e7bd-9dc5-624f-9140-36c8027156cb}\ea6instmt.inf" "9" "4713f3a5f" "000000000000016C" "WinSta0\Default" "0000000000000198" "208" "c:\program files (x86)\epson\epson advanced printer driver 6\driverpack\driver\tm-t"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2664
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\EPSON\EPSON Advanced Printer Driver 6\TM-T82IV\Setup.log
- Size 2KB
- SHA256 a70662dcb384fa71ddb0bb330232c05d09b8026bd9de63dba4ece14dba840da0
- MD5 eda41a38be3692570a14b3ac0da2e93c
- SHA1 9d021dfe5dc7851b84cb7cf7b09341736378f104
- SHA512 455cd161bf5fe5077db5a9d8ddeb3721b93f681cb4a5eea4601931d07ea23d6f74776ad1e60ce4e6b915f2b49e6f229fec2a88531290ec2035ef88c6ec7feb79
- TLSH T1E64189628E9438BB910DD206D593F69844A23C3CBBEDA2543C3F88A5F34520EF1C915A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\EPSON\EPSON Advanced Printer Driver 6\TM-T82IV\Setup.log
- Size 3KB
- SHA256 ba2f278d8239597b375bd9aae2f61d2f51bc54c86b57c8a50a99ad6c7c3c16ed
- MD5 878024834fc5ba2ee0ff0553b00ee057
- SHA1 6894f6be5c356b2d86e758425d5de6c61d9dcc5b
- SHA512 ca95505d3a8a8d80e8e8a83aac313fdf73789ceb1e62fb6e0ab3702fd4ecdb88706b7f2053b0ad851111aebba29c666c1fb8e567aa3cb639d3e6833736baf757
- TLSH T157814A5A9E943C7FE20AC205E693B9940066393C7BFDA1443C7F4455F38424EF9D919B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\EPSON\EPSON Advanced Printer Driver 6\TM-T82IV\Setup.log
- Size 4KB
- SHA256 f63a9d66e4dd0be6fce1a0e7bdb5692c3e35c58a2891fb29ef2752b8c0a07bce
- MD5 36545a89b77f35c0e148c4ede557a251
- SHA1 e18b74510f09dfe12b0980987caacab1b0c9fd96
- SHA512 589ea8de98f5b5b9677dcb7e1ea6db533b022c0e8f91ed0fcd4ef59a83914f6234d7244d5e028d27f660a41f64fc6e014e77ca9fdf107d40098e3c367931173d
- SSDEEP 96:gf4FfJaUqFfp2YKMdudSf8fafhfgfDfWfjfzfKtCMWtrvoThP0nMb0VwycMdYtYo:gm8ZBHQwUSJYrubbSXGrms5GOgQh8lgI
- TLSH T19EA1455A9F9878BFE209C305EA93B9844026393977FDA1493C7F0456F38024EF9C959B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\APD5.zip
- Size 11.9MB
- SHA256 5fbb45fd3f28cefa39867b99d970f8ba71e4f9d0955be75718dea2dde86048a0
- MD5 6866795be15c213df58d038a0be4cfa8
- SHA1 06365ef74405d46e4a894198dcae57d8a9515f58
- SHA512 5a46a0badd134dbd989114e04e44fd661a375932349d3b7d58848e6e4df6fd3fc6b060430456d5f400da4212fabdecaa9dc4133445253eeed8dd48076deb0aec
- SSDEEP 196608:2Te6MeWb2uH+5b8z/AvI99XuGVW0JPsDW3bGTUgmFsHPPqpc4Xce3wAzXqqqRUf+:FeJ8zZlJAaGIwl4Xce3fTBqRUfKtjVc4
- TLSH T114C6338DC37DF567EF536CB580C8C7C5AB428AC9C4D858C53A68C2943ECAAE25FD6910
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\EA6INSTMT.CAT
- Size 33KB
- SHA256 d7c97a64c4afc4e4c9dffcb800fc3c3c416ad0f4744d62e86d440d94dae6ba01
- MD5 4faaf1242a838675510a991f490a7097
- SHA1 6c725873b9b8b4c91f91932399f8f573b64a873d
- SHA512 8c970351a3473d7e4917c51d101bf891d1ff3d16dc84ed8d1d43e9a95a5102596004436556f61aae68d967847d7c3149cca405f84f24047ab26a22cafcb2cb7d
- SSDEEP 192:rHzrbeUSED6sy+aJxEbRM43ZatXbyCS3vmGNXe8DkbRmB2bBqGuVh1+1h1yLIz+B:2ajKG3jlVh1+1h1yLsSFiZFRejR9zugJ
- TLSH T12DF2EF69E1DE04A2E1E7C97146E6609F5C2D3FC72C10997822B3936C4952F01FA789BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\EA6INSTMT.INF
- Size 27KB
- SHA256 9b1b0a88359ab323c42b18385bbfdcf2a5372540da0caadc67ad43eaab2a455f
- MD5 f50884579343e14f36f6922e51c79a99
- SHA1 fe006502cc54cf11118fe84ed68a8738a380e13e
- SHA512 2c7853d7bf1ccd4905d8eaff8e8fe3c4cbcae9925bfdfd12b79e9ade0ec5dc667ec96cdf53f30835b9f39b81d12c80cd9976297dfdd73b0909aba8b33b52d1d6
- SSDEEP 192:Z5qQP1+zpZtyClzlZSreP1+zpZtyClzlZSeT2APCwzWw3vy3Oh7K0i/yDsl:nqbZFzur9ZFzueT2APCwzWgvSqKI4l
- TLSH T165D272BA6013CE8EAD1B98984D399C4590CEE51E60F574D0D63248712CBA724EF2BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\EA6INSTMTA.CAT
- Size 32KB
- SHA256 60855fd81d0371bc45ed2434609f2cd8b057139945ca2a69a162398c6ba28c81
- MD5 ed3978761a489e9f55812db37acd4324
- SHA1 ecd97fe6cc2d3e4f4bd3f591154f1d2fa98f3167
- SHA512 c65351aa03bb2de9813597d9bba64d558899ecc64a1c819f38c23696c8fbb81fcaffbce18144c81cb9204de19aa69b6c7458f47be6c18ce00aadbcc18a319415
- SSDEEP 384:clF66BlVh1+1h1yLsSxP3h3BFR9z2L54Z:o6GVhMf1yLsSf3BX9zNZ
- TLSH T1D5E2B966F1DF48A6E1E78E7041E5609B5C2D3FC72C2095682377A32C5862F40FA785AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\EA6INSTMTA.INF
- Size 14KB
- SHA256 bd06af05c6a551617e6895f51481c5b4c81dc509ba4b6bcfa1ac6a051450616a
- MD5 9c715e9d384b04e2f43a1346ecb959b9
- SHA1 0f649582b5f95a6713447b872107caf0596420a5
- SHA512 b3a3633d2dc7389642de2a1e01e03469cf3dd3d73892cc9b7b2aeab7e016877134650f0a095a14298a3ac981bf34836a2b6c6301bbfb5030c2ed27a31ef23af3
- SSDEEP 96:c5c050IvWAOraOV7TvnaAkaZqqJbGraJVLsZLUa5TrfMAJEKL5k8LT1ggkThcE0P:qcP3L3a0jFJB15+IvII5hR4jOZvy
- TLSH T1546293FA6013CE8AAD1B98984D395C45D0CEA92E64F574D0C63248701CBA724EF6BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\EA6MDLTMT180.GPD
- Size 14KB
- SHA256 d52af6d790f7b60eb9138ade47f7df85f37942d67f09ff8e838b1d3d202de93c
- MD5 9718c4a09b12da9fd154709e90c84740
- SHA1 b08d75ee892e182371305962db589a27aa38a6ed
- SHA512 be78fb1a4922f036e6b8fe089f3f814164f360230370affc05b86418c3493052f14472040de878f8c957741d2b5a1d8828026f7cb84cdd1549bca7de193ee7ae
- SSDEEP 192:5BFXog/4le8qc/q0GV1mOddWVj6QCQSXCXHrJAx:57/4lebPRV1m8dWB637CNAx
- TLSH T1F762668CE95D6C8B658BC45D772B02C1967DF6BB88E410FBB4C2FE18A1EC55D807EA04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\EA6MDLTMT180_1.GPD
- Size 14KB
- SHA256 c8c358e40c5fb7866c69f0aabe41dc0671e6aab10dc21bc2268e18d77f6618a8
- MD5 534139102dc8f37eb879182630c64c91
- SHA1 aecefd85a10bf72ec540ebbe3270109054982e1b
- SHA512 a449634b311f2c9dc8d686639938f4443c5dc13d3856605f738c66ad60508c43eacc9ed87418db11d185ca459264a5c517a980990c674d6f7facf8be8dea753b
- SSDEEP 192:5GFXog/4le8qc/q0GVBmOddWVj6QCQSXCXHrJ7x:S7/4lebPRVBm8dWB637CN7x
- TLSH T19E62758CE94D6C8B658BC45C771B02C1967DF6BB88E410FBB4C2FE28A1EC55D807E608
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\EA6MDLTMT203.GPD
- Size 14KB
- SHA256 d945f2a9fd89984e5fc25a48df9bfd2c3c21fdc3c09533712c139ed8ae1965ef
- MD5 dc9108ed36b49207869b3a0ddb4b2206
- SHA1 089f8adb592f25984450fe544b714efcc737dc21
- SHA512 fec7d59bb08b7c3395ec6e28bd3875cba304a95333fe4e238e45a9b79bdb755a0c73776c2208dba789b8ed1e874e8a40b9d73e1d960f2c853b342d6f8dcc0de4
- SSDEEP 192:5xFXog/4Re8qc/q0GVPmOddWVj6Q4QSXCXHrJAx:Z7/4RebPRVPm8dWB6t7CNAx
- TLSH T17362764CF94D288B758BC46D772B02C1967DF6BB88E510FBB4C2EE18A1EC45D807E608
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\EA6MDLTMT203_1.GPD
- Size 14KB
- SHA256 cd6eae1a0c6ad9938eb683b16de46d50fa76b29c34b0e1eb088ae3753cf3a873
- MD5 78b70ea388dc9a0ebe849db23214359e
- SHA1 6240a931efb4d5f2ce61b85ab76ada6afe028831
- SHA512 9f5ffe6594a6a5187e2f3863b060f05a41d4f46792288684c6cdc81b2934a3306726b820743a52486d554cf1685c681e540dae7c120c15816d125ccc1dff669d
- SSDEEP 192:5GFXog/4Re8qc/q0fkemOddWVj6Q4QSXCXHrJAx:C7/4RebPokem8dWB6t7CNAx
- TLSH T1CC62774CE94D298B758BC45D772B02C1967DF6BB88E510FBB4C2FE18A5EC45D807EA08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\EA6PIITMT.INI
- Size 210B
- SHA256 ac58233dcae8531c3d7071c4e01dabf1e0130495df05488485a252a04773c077
- MD5 8292f0bb2798935283b8d2b8383379be
- SHA1 198272dd403ad4cad39b6a1e61622232753b190f
- SHA512 914017b196fb3bc59c7e2af07fabfebaeb17ba4cb585e54dee667fb1b5584da5db79dce56b7e5c52949e3229d9ff992d2240602c5c86a6f3179007d9f9c615c9
- TLSH T18CD0A9897A809232212C62C260FA0E260FB1AA28C2301A89B89C501C440C8B2C0AEBD0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\EA6RESTM.DLL
- Size 646KB
- SHA256 c094a585039c1fd19b98be6e3bb43769879cda1e86118600bd13c7f783d87a23
- MD5 20eb81aefa4f8014ee069bb1aca080a0
- SHA1 0202fff827dfc89e4f5bc91e4e871431acd3833e
- SHA512 3be93a5aa8e5bdabb29ecd575e54e1f193fd5a8e54c521f743dca75f42ace61aa130af9b42ff9a47640d37a9be3fe0852e61ac91ed721bba9de0a93feab62606
- SSDEEP 3072:b3qTP5gztNMA4rsWfjQp1NQvwlck73VFCAVlXbj0k78oQDIVAwFfJzEHXwfjjJbj:b3KPEbWfMAwCq5nAPg0XUtbOwwXs7E8
- TLSH T1B2E42B28179E8369F17BBD3C79F84D1DBE663581E134928F02D75B5A27C39013B80B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\amd64\EA6Bcd0.dll
- Size 419KB
- SHA256 5e73993f2d2c5036a856842bd9125b033fe09ba6c7cf6d1fd394222efa4254bc
- MD5 86f8e4e96dad79df437087ab30023792
- SHA1 ff10a61f91c1ba9809a98de3c5e5dbf7abb3b1fe
- SHA512 f73ebdb7391667f907b3acca131ea0a67feaa284e2bbd8d76f3be59eb29ee87b3ed35b243cdd33db01b3b3fbdbeca32ac7ee2f7fc3e07a27ffc3beb22a9368e8
- SSDEEP 6144:0RVmFZKUXrD2C0g5EFOcxoIAJY0KKTCp1Gjopdww333SSHOMA3aezEX7x:0aFZK42C0tNIJY8TCp1GjopdwkO87x
- TLSH T19194AE86F6A706E9C257403881A3021AF76A7D9907700BFF65DAFA741A33FD65B36304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\amd64\EA6BcdR0.dll
- Size 566KB
- SHA256 6e3d75d9e87079f40f5358cdbd2749e389b82238c4957f27ea953fdac26073e5
- MD5 b107a18e36a97ca05eb80fc0071a9660
- SHA1 ca475c1257727e1b4e90ad45b1d6a1008e081712
- SHA512 d6dbb9efeba9a204c6b312cd56817669959144ae17ac68314ad0bdd4b93004067cc5b80c343047fcf02d6dd6ed61e11389fc58e56af49aa9f10335fc14e227e1
- SSDEEP 6144:6Sw6wcxUTtgGeNgwWTPsCGxRIEtWkD73isPSDqjV9pyS9C8uIgdMEcFPwot7+:6D6/mKGtWIEtWkD73isPrD9CaA1ot7+
- TLSH T1E4C47B9537A81396D17BD23DCAD74B29E9713C11473196CF01D862AE0F23BE86A3B724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\amd64\EA6LMTM.DLL
- Size 325KB
- SHA256 71c351bc4dacb5225c467a3b50144b800e503cf4412ce10bc3aabeb227f6caea
- MD5 cd87eb2176b4e82a26c148a6c1738b5f
- SHA1 e81f91fbf23f5cd5ba2c8e3703097da817e00038
- SHA512 ad8255f52d1aee498cde188adf8d6fad789df504170c205a008d90324930c38d50a595db8f98df1011f58fed643fa3869e28f6158b536bbd0d36c476353fcdb5
- SSDEEP 6144:4PJGVSgPWk6v94DcpOlJ64oKT5hIrcXvfhOixEo8KOxT7bl:4hGsyP6v94DM2J64HT5h7hOia7bl
- TLSH T17C644A56B7A500A9E17BD17C89678606E7B2B8450B61DACF0360826E3F337E15D39B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\amd64\EA6RDPTM.DLL
- Size 1.4MB
- SHA256 0ae895df3282ae1d1114ca6b7216f2724252b2e93d5c8303567ffd00a1e745b2
- MD5 e05c7f6b5d4d664d295a8fe52c3a503e
- SHA1 3c745b6d2e6e43ab111c7fec0981484eb541879f
- SHA512 25f086f637111b9fa1e641d022b3237a1bc5a7a3cbf1451e47877e0a16a77b334e71de658935bf52348154d88b485c1915cfd3befe07e1e5db8322d20132add0
- SSDEEP 24576:Bud50kJ2D7hci6ybYFK91pz9UxIETWMOxk5r7:BuobYMHz9UhTWMOxy7
- TLSH T12765800696EF32B4C2E28F748F974D23B6A068154B60C6FB125C8DE63AD36B0352775D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\amd64\EA6UIPTM.DLL
- Size 1.2MB
- SHA256 badc482273cc0712bd990091172669e042c87fd638b59bb3290d05dd4ceaab19
- MD5 9968b2c48ec9740fab39da430f758bfe
- SHA1 4923bc8d8426cd02511a7b288e55b0705bd68e64
- SHA512 0306cd60656ecd4604bb8976203eabb386cbf44071c0872911106684506c9e68c0bdbb771fbd952d65102c2493abf6e2e59373a51679382d48d1787ebcb58ad3
- SSDEEP 12288:BkaQ1+heRanJHckI8+C0SkxvwwQsh5oNKcoOfo5RlNQHL7AWHB7U:BkaQ1+kRaJ8D40bxozE5oN+Of+Re7r7U
- TLSH T153552B01ABA7940AF1B28E34CCB7876197F17A908773C69F3584175DCD6A3D06E39B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\arm64\EA6Bcd0.dll
- Size 1.1MB
- SHA256 2ba3b281474beb815aa090a14cf6e9fe85661066d6f5bfac64b2ae5d7eb2c3ed
- MD5 e3c2e73d8749072e57bf0207bdc9efcb
- SHA1 e9220c89b3aa8d395e7044297013a543489c86d7
- SHA512 a8dd93d4196f9bb0291056cde3e786f58828407e2d78e2c18d2b9af75254142e13ef29ac1ca21278274331a9005c688400ffb37d15a1a4bdea883e39d2906500
- SSDEEP 12288:HmDLBbyCLsKfAV4IlvgzUm3ieb2OD61sWl7Wq:dk4Y12O4sWl7D
- TLSH T16E457D836A2DBD87C3C7E678EC564F94301B7AF0C136848B7101229CEFA7BD0567A659
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\arm64\EA6BcdR0.dll
- Size 135KB
- SHA256 87436ef12c286c86a67e79b5d0d2f6e2fe8044f1f61fd2e6019797d40c3670bd
- MD5 e75ef53a87c9d9355e36e8b4c61fb78b
- SHA1 a9f33a3d5bc6b2e2764fa2ee850ba5adf78f6a99
- SHA512 8eee018c45ac94d5f251327b01924cda36c60d5e62a1638f714f4d1b2210931a23be2006ae2998b9a2b96b0edc56177ba492fbe9ffb2cc2ff768ee5954a0db97
- SSDEEP 3072:rK2/7CTT3UqX8wcv3WTVPxvUspDk7uv2Pl:PGHLdxvG75
- TLSH T12CD3194366ED1847E1E6DB38D8638E54273BBD648830CB4E2251714DEE3BBC49E70B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\arm64\EA6LMTM.DLL
- Size 317KB
- SHA256 6fd0643368981b13f88b39bbcdd40ba42d446f67ab0ca2715afd483f2307048a
- MD5 1d577b55638166f975e0f6ddfdb6f38a
- SHA1 384e934501d52382c9c4c3fa8412f96d3eff1c38
- SHA512 e8bff09f681b8bea9ac061fa0dee1688c03153db4d63e4f827094aef7dccbc964d0d2b0e05ea1a3866617c147b60e7724b60a9f9c84e72981b5203350573fe99
- SSDEEP 6144:70TaqnByLINhedREVzscEdcbsbFpySdhszJR5zyoaOfO5pHaCP/vvuVqDxk7:SPlyoaOfOmuvvtK7
- TLSH T108644890EB9DAC40F1D6E77CE8634E51323FB9709934C64B7122424CFDA7FC58A646A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\arm64\EA6RDPTM.DLL
- Size 1.4MB
- SHA256 e23646e789ceb74a6a4280d5142a3d7c1c9fc1143d66c17139972bad492ae720
- MD5 f9684d508b3157535892421643613fa9
- SHA1 14530b7e38e54b9fa1fb88b59a706e7a004d77dd
- SHA512 b416d419bca272aeeead1c812c97b6620bab1418bcfa4b9b853a387171af98ac3c0ab3849e8266b886d1d69d620b1b37d3989fcc9a5975bfb489f227ba9d23bc
- SSDEEP 12288:UlItSAMK9YNNYrsDXRJwyVtz2SLAET3ULhCObE7S837:uc9YNNYUyFET328ObET7
- TLSH T14865D50249DF7B74E2E19FB89F574E2335A6A82089B0C6B6210D8DD9BCD36B0745336D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\arm64\EA6UIPTM.DLL
- Size 1.2MB
- SHA256 092e26d1899f5e59014e0217072c0ac19b89310357aec4157e46627bf51043d7
- MD5 39c640ee5dbc4581294cf24c2c376c89
- SHA1 49e3c350cc2f903e196c69004c96f90ce2d5c1e3
- SHA512 6496ee08a81a1e57027e419f6def0ef2bab35232cab6c9284e3b5120dd81eb81c53e59fbe674ffe2a1c3e39b914b2049f96038ff3b2c7e56fa92e672462cd62b
- SSDEEP 12288:gQfsGlxRqgzBZhuhTXL9wkLROapxNQHL7AWH97t:9EGTdd/2rZwkLROapS7v7t
- TLSH T1344508419FDFE806F1F28E34DDB687A117B67AA0D673C61B7409134CCCAA785A924B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\i386\EA6Bcd0.dll
- Size 249KB
- SHA256 39b6db7fb10d3cad014da82dbec5321b961feb3b94274f01cb4e9b6413718e63
- MD5 bc8740552ff946aa7a391fd0c4ace877
- SHA1 26a8de108b56fc7066331ca6f63f7d5e49f99da7
- SHA512 6ae022acecd3fa1d8bd39e7d615eab3908093e9e90cfe308444ce57dce4a16c4a82dc4f9c019ab09566b231f136285264ba8b02a5b0d3c055dbf12c8d3591e88
- SSDEEP 6144:WEVtN5QbgynbmW/YghQY75RjQtxnSS18/zE97R:lV+XhYghQY75Ryx17R
- TLSH T1A044AE10F95285A7D0D2013453BE8FE66A3C5E291B6449F3F7E8B9B89834AD3273171B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\i386\EA6BcdR0.dll
- Size 37KB
- SHA256 03aebd384beb94d948dad768f9fb7643e53d54078cc7c0f857cec9346dc9739b
- MD5 894ae7c0c1f833ee4111777bc26a084a
- SHA1 e190551181cbe4ce799cff89b9f526618007eb6f
- SHA512 bdbedb601b4d5500fd949fd514f016c6506c1daf96263ef5eda7aad989b5cef149b0e0a580ff234f64ebc7f530015f2d6415d2bfd0340bb4d1326c8378c9bcbb
- SSDEEP 768:jKWEcqG44sAAoNlByYiY7zNGKzCKZikuWdm9zEo:jz343oNlg7Y7RGvqdyzj
- TLSH T1F8036B92BE684052DE9D4D7012E8E52B6C3CBB910FE090CB3795966D1E543C2BF3866E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\i386\EA6LMTM.DLL
- Size 269KB
- SHA256 86b72d0c0855cbc6b5fbf8c6afb32ea6665fad5121ee9f50482eecbfa453d8a4
- MD5 c5a40e4e542f694d31023822c10bf9f9
- SHA1 c3abaa85e26b4942d38ec34664c09149b005d6c7
- SHA512 cf05baad5ca36321dbae9a59be0c20a2e66690251f22e015d0e3e050b14e6b3d71f1cfc769a298b2a6fee06164e72a768f9342f9bf99cba81ebad9ba5e467bae
- SSDEEP 6144:Hxh0LEBK/H8gu0f+NiG2k6pjGpuEHTkE+RkLxl8XHvi7w:HraHZf+NiG2k+pNE+GgHvi7w
- TLSH T15B447C01B695C03AE6FE12B0097BEAA618BDB9701F70C9CF6394592D6D317C15A34B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\i386\EA6RDPTM.DLL
- Size 1.3MB
- SHA256 841777168fc62c6770cb1aa6f1f2bef30006b441d8a7ab829acd2adfd994c42c
- MD5 908397ef60535ae07a7d9f65da37d490
- SHA1 2430abfd4d5c06fe7cd8719f6098948c23dc1e77
- SHA512 9126a5f3ac20f2960fe01307c09977057fbcd32ba52611cfa0da4094f2b0ff17a540f0510f6e01a1ac54d1b251957c4052d596cdba5e475ec3ca620cdeabaec5
- SSDEEP 24576:HVexOptt5WpGeRqE61qp+Xh2yGedNMco5eJWhZ6ExhNKVuJ75G+ruBeskT2Y+kQP:HVeKtSVyGedNMco5eJWhZ6ExhNKA5mBv
- TLSH T12C559F00A1DFB7B1D2E14FB05F6B5D2734A499208AA0C5F7628C8DE6B8D36B1352375E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\i386\EA6UIPTM.DLL
- Size 1.1MB
- SHA256 9afcb70e9d1cc0881b3f4e530199a8ac272569226fa43d8ac57087e50dd2391a
- MD5 ebe9d63b61fa73b2e7fae596723239f0
- SHA1 9341eff0048ed0af1fe511cb600e0b3921a026a6
- SHA512 b318f9e769add349817661458bb2b6be77e54c69f177167b8d13ae21da3b7ce139f1830a1b6382f3a9d35e24a3aefe9e04ca127141433f282488cda2528b8383
- SSDEEP 12288:0qtl92r/jOczhtxV/bh4lAGZYjO3+Dt+c7h6NQHL7AWHPsx7J:0KlkWczht2AEsOYt+k7dsx7J
- TLSH T134450700BF97E112F1B54E70DCB8C7A542E97FA4D773899BBA881B5DC8246C16934B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PortMonitor\arm64\EA6PM.dll
- Size 786KB
- SHA256 f86cd554cefba4749ab637df8049963400d7e3a98027678ee194b1de3bb46d5f
- MD5 864faa116938cab441931e1b43cbe64f
- SHA1 d9b7b39441c6aed96fc21f74126ce52a5545b3d0
- SHA512 ca86c75bf1b40d078bfab8349c474c4d8749c818e49972e85930c2edac5fb999a6f20ecb441811cd55df0553956b31d45990f22ca57327fd45521b9617d106cd
- SSDEEP 12288:jK/iGRD2n1Kt9FcmSC2rLVwGxXzOVhMil9QsFZFfPcJf7:j6iGRD2n1Kl2uGpzOfxl9QsPhEJf7
- TLSH T14E0529906B9DBC45E2E7D779EDA34FA4303BFA74D534858B7112028CDDA3BC18662722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PortMonitor\win32\EA6PM.dll
- Size 537KB
- SHA256 432d0ccf1382ecbe737a17b23cbdbe79dc081fdc04785f12207d302d41426a72
- MD5 4c22e53ba458c27e832dadc9cfc4b12c
- SHA1 d6befb8f2cdd2eaa55fc455a65fe216408c06ecd
- SHA512 a754b1e2bc9a506f31845bab1e6d42176bf0637d6138f1eaf10b1924ed1cc1784f9df2c9d57f08c1d11796e85df8bb991b7403060198cc6ae33e3ce373c88659
- SSDEEP 12288:vLE/xNea0TRYQfnLiwdjpvDdhflWBxaCbi78Gq73WhpJClv+8KEpgIsfp:vLE/7QHDdhflWBxhi7fq7mhpJO+8jpgB
- TLSH T1C7C47C1179808131E2BB353059F9E6B64C7EB9311F3496CFB398097A5F705C2AA35A2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PortMonitor\x64\EA6PM.dll
- Size 698KB
- SHA256 324fbde89b85280d5e62f3782579a42be5cee9d6468a4568954ff006675f9cb0
- MD5 df762d26f469d3c1daba7498a708b53f
- SHA1 8764eedcb5791cc04e05a46356954ecccc96634c
- SHA512 ec8e6d6e50167e65f1c63434ecfa978c613156a6c8bb1a01079167193f1e64391cca1b7b0f068c9fcc725c390d1bda7f42988b3bf49b581b534b69be5e493e92
- SSDEEP 12288:HDaT56N2BD7zl7wEnspPjrG84yCKZO4thYe9YfR:HOT56N21PiyspPjrP4ydZOYGoYfR
- TLSH T118E47D1777A802B9E177D23EC9974756EAB278111B20A7CF03A4036E1F277E15E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PrinterReg\APDLog.exe
- Size 303KB
- SHA256 68cd069c8e16e43251c9dba6d79b2fec0bd98fef4f1678425ab6a75c323615d9
- MD5 d4508bcf873e19036288fefcca57b111
- SHA1 00d993756eca0bd4921ef4a6614701ba97ba1d37
- SHA512 fb55a6f6e10ec3acdfa93a9eeec32d0bd81b5c3f8e7fb7357d3ef519e5d8a9a0b5f51190c7ca8ef30522b2d30f7c5f8c4c1d3a3e48bd4ad3a890d04925029809
- SSDEEP 6144:WriVW4LtXKPANRK0+ElybIs+BNOZ6XFUuyzeUqF6Q2Sjfsh5QjuAOHJWaBt+JfJb:WriVW4LtXKPArK0+cQIs+BNO+9yzVI6k
- TLSH T156648D117682C432D57315320A79EB62897DB9344F609AEFA3E41A3DDE702C19A31F7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PrinterReg\Info-ZIPlicense.txt
- Size 3KB
- SHA256 ec4184ccaabe0abe93c05ece2762f6dea58cd76eba541b9065574d9dca5ff3dd
- MD5 e4b1bc317f4ff62426b7282504c5f193
- SHA1 0c50e0589a9eca9c5d45da406b8a37ea3fbbb4da
- SHA512 8755862b60028e40e47e1519c2700fca13b32ea093fac53d18e81a6e800cac9127abdf7dc001de5706a234b77e64c546e2de3adfbfbb760ce9f7910e62b8a8a9
- TLSH T1EC61B62F1A05437721CB436C7ADF8455B3A0852A3B4B80D8747DC26C2B1B9D987B27B9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PrinterReg\NetworkSettingTool\APDNetSetting.exe
- Size 2.5MB
- SHA256 445c08da0350f260c6bfebc2d11547b39f7c1d5392f024f08b9cb7e00d38755a
- MD5 7d6cc8ebd325ff76ecd598f06ca68123
- SHA1 9c971a6b507be59f32678706aa43e24dee59bdf7
- SHA512 c2a00fc132459e02071020bc19c512092f28453acb5b8a20272de7c1e8353d02483c89306b53b03dbd13ed865b804b9fc6b522891cd2c57ec1ef59441c61db72
- SSDEEP 49152:9EjkHh+rulmXMNZ/gDonvyrfGYbwYlDM5xJECxrYalP4nGaDP57k7G:9EwHh+reqAZ/gDWyrfGYbwYVqxJECJlA
- TLSH T17BC58E163865C0A3C91211B1697CF2BDF16F5EEC973580A7ABA87A1C3A35C9314BC727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PrinterReg\NetworkSettingTool\FWCtrl.dll
- Size 81KB
- SHA256 25c787a36be9b2ec890d4b450852539c1972eefb8d8a5ea5b4c73a187fef8d83
- MD5 5e35887797bcc995b5a85e6cec22d040
- SHA1 731170ce6639c95e49db74ed558335f72e22fd97
- SHA512 6e24f25d9efcd36ae23aa2407d2d4f8a925f2050d5c9a1fa49e8d2d48420b07e7f9a5385884749afb38d6cb88f02fffa3beeceded25d8e06b175e6cb60a4cfd0
- SSDEEP 1536:l30p/LgElBC89N5qKJuJJnsWsUcdgNnuYo1AP7qf6lgv4:lEp/LgaC8rYGVgNnuYoqPGfRv4
- TLSH T13C838C41B6D1C871E67E2D3814B0D662AE7D78118EE4CD5B3B66026E1F702D0BE35E3A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PrinterReg\NetworkSettingTool\Resources\EN\String.ini
- Size 22KB
- SHA256 b54db0e7afdfc43ef237d93049361e61988f1dc76d9e201bc6b493f3a61460d2
- MD5 0d4b5a4334d5c53bb7941ef38c0df147
- SHA1 dc0437205d25b50569b023a0eb79018cb05fef0d
- SHA512 ee77a8b97c07c92d1806cd629e066bbc41d03278d708e4ee608b4450e6b0875f7df8c70188a99c255b3f0e55a5aaf814c08e8c6b5c6995426b5d95d0a4ed4cf3
- SSDEEP 384:4YF3oLxFDCHt5Tbll+Dwq1bm8UslNkcIKU0pdE:4YF3oLxuf+UqJmPslNkW/pdE
- TLSH T175A29C2653E80119F6F7BB50E9F84E324B26BC55A97DD55C09C10E8E06F1E809862FFB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PrinterReg\NetworkSettingTool\Resources\FR\String.ini
- Size 25KB
- SHA256 941e48799065140856da3ff4db3a5a273dacb4771da076983fca70cfab03aaf4
- MD5 48a0c754bfa9a420879df265a63d40a3
- SHA1 1de93ae6d6e782f9d4ff71d88bea1361ada6590a
- SHA512 385cce1c0908046c9d484b82d9a7648a8394b3adb77b8f4fecd930e1f2364c2750a865fc890b0378e3e7dcc4b8dcecba4423b01f4f6f58dbf9f2fab36c7de8fe
- SSDEEP 384:QScLooezN7oya+lvhiLr3x4ByRkKSj2zW7YvZyZLYL:QScLooezhNH4r3gyRBSji1vZylYL
- TLSH T11EC28E6653E80215F6F77F11E9F80A225F277C8A9D39D41C09C10E8E09F1E5498A6BFB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PrinterReg\NetworkSettingTool\Resources\JA\String.ini
- Size 15KB
- SHA256 2ca069da5bb5e143f53f122d1d8be701b1b5a6bfe62f932b79067b805cd8ca79
- MD5 7316ce9701c824cf46bd040c7d638925
- SHA1 bbe843b0f1c12c2445954a90c6041a7e584d2df3
- SHA512 bb540936a60bbd3f63ea004ff56711447bf5f2cb184dd8955ef58f1245e878461b92a9965beee147d1f4be912acbbfc671250941778e2d5ca3266ec24069e623
- SSDEEP 192:5IuIl8LpSAskGsJ/Rq2tLJNSpD3EmE6svxeqeXs+ZLgk07TA/EqZo12MRp08:5XXlsIRdNgdi6svxle82ska0/Y
- TLSH T17E72BE7E2598001EA0F5D152C2E0AF77A359BC45929E6DB80DC14F8F42C494623A7EFF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PrinterReg\PrinterReg.exe
- Size 3.3MB
- SHA256 4b80c5b0244c148dceb8ae1801f22fa68eb81c6503cc36d88a41f510e818c7c0
- MD5 c9680d0ff018e9096aba3ee62c1b541b
- SHA1 516885b6bdcffa7e2ef1442a1fbc0c1e38a05af0
- SHA512 707684e2766b400a83f5ea0495f9a355a5a5f6e04d46456247436b78e3bcf0f8bb3eabe84d17d75f6f3df23610c75d8f87a71127b4d9910d2e2921a38be5a296
- SSDEEP 98304:5HXvOBJlYkzuMFHJLWYz6dVjQvcHhaAZAicjOqvKKMfKeKpKfSKKRK6KKKe86ki4:5HXGBLumH0QvcH5FDRfH
- TLSH T18AF56D50B6D64072C12301314564E73DE8FE6D72077E02DB62ACBE189EB58E2673B5FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PrinterReg\Resource\English\Resource.ini
- Size 7KB
- SHA256 bf5ac567608fbf02bdfcfb8be41f0e04a51de53fda7b9a12cbb2db9852cd51fc
- MD5 a0e59ace93fe6bbd21e53b931e82fa96
- SHA1 2e969932503dd617cfbd3deeb63c2d300461505a
- SHA512 3570b9bde4d92baa111cef3a62674509e32651c1f69deb00c3b6c4a77094e14acfa063f59d50969114d061832db42784e3981ab86d0f58759d0447dc67fad916
- SSDEEP 192:gahaQauZVUhvDbogYpywaXpwOYyWBhBea2zl:dcNJhvDbogppwOYyWBhV2zl
- TLSH T12EF17506A3F90545B2F37B50EAF411B68F677C999B38DB6D4180425F27F0E209862B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PrinterReg\Resource\French\Resource.ini
- Size 8KB
- SHA256 b1f6649d26e95464ad94a3eb578620392e3fd5a7389b3389d9a27bf397cbd951
- MD5 d7d591a2abace7fe1d10bb9f60875e70
- SHA1 63f5ea9c6b50041ad6585b5a061bac9b662a9456
- SHA512 aa24d958f247f4f1b1d1e6ce7c4b8ce62a1435d9fb7a319a4980a758b5b5e8afb6337fd31e986d3867936253964225ad19f106edce90993150a7018755f8fbe4
- SSDEEP 192:0aOwaq5zaW/KrnOnoc3DfbJaiu84XIVK8QAXCw00S0VKerW0tHttDxzYxaVG:pCjWJnoc37b0968wfjpHXDqsA
- TLSH T1ED02170567EA0149F7F27F51E9F411668E273C9A9E38CA1D01C002AF2BF1E60D962B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PrinterReg\Resource\Japanese\Resource.ini
- Size 5KB
- SHA256 f16b572ecd62251e5eb918e51f6117cc663932ab507044f7018b9e8f8c29167b
- MD5 e39643e37f7caca22f67f1a016f706e0
- SHA1 30fed68f459d39432a13b1066415ee2e60e909d9
- SHA512 e966111d5488771f8333f6326e9c08fdb807d89f25547c9d9653aed7d92b8fe9f52a419731ce0f9e529f818bc7f85087d77f2d98f7b3fd2924e2f5e4faa9e2e9
- SSDEEP 96:rhp6evfazaIaSCeSR4ckuSPMtJ7xKgWn1nKdMUmUwJ8EA3JQbZM13tZyN/ItOEax:1jfazaIa5Rrk7PMT7Re1nKxw9H9M13tU
- TLSH T1AAB1584C62D20589A1F1A25186E0B0EFA75B7C5D13BA8FAA90C9431B2760D616313FFF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PrinterReg\Resource\SimplifiedChinese\Resource.ini
- Size 4KB
- SHA256 5ef7b5af00876272300248ebfbc55d8624d1113d62a19821b0d2b7bdc311b523
- MD5 902ae44821b481127be2a4156564e0fe
- SHA1 2bb1c02f86ded784824d3331d64b47232bd7e508
- SHA512 8b7417220ff98126133e8a600390f22190cc2f4eaf190f762f9d62e5c0f646cf56345becde4dee61a98f2458327f7434bd5c8fc196f28698888091b07889f5e3
- SSDEEP 96:relmNdSqalaoaAI8JffByPvFBOArlUNpE/mUwre8Gu98RKtGS3V/1d+IJWW5:j7alaoaAI81BqvFBO4B7wqu4Kr11d+IB
- TLSH T1E491B00952E608895691B20087E064EFC7933C9E233E8F6E85C94B5B3755D212527FFF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\PrinterReg\ZIP32.DLL
- Size 158KB
- SHA256 12689a60e22fd93761ef1b7723581e56b01dd9369cc90ce91f590c5f1ce50b3d
- MD5 fc05bbacaa24969ad5ee041b3a941607
- SHA1 bf80ab2159affeebcfb0cd6404eb4c29eaa4f6a2
- SHA512 84dd4268dc27857af08bd7096bdc4d917e9f8c152c4bc3f725a9bf637c6bc23204e75b1177f3ec94e6fb007192789cf27f44a24953c4355d814450e985f4cf71
- SSDEEP 3072:4Wx6u3SlPCUREd8nlFphmqfEr9oUT8O5b9HbGfXvH:hxF4PCURQgbwcff
- TLSH T13FF3BF83346AC037E1CC413C14B19B379F3FA164668ADAC7D764CEE65D2A1A1E71D38A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Setup\Setup.exe
- Size 858KB
- SHA256 a2c9e8af9274dc7fad79781437a2596e8de96ebc57e7d90045a59d9aed1739df
- MD5 2ea98ff2a6efeb63ae9d43a445bc4d6e
- SHA1 ad0dcf728ed2cc4cd89d30d92dc9fa8276b4b846
- SHA512 e340f8a365d4fda4667727d947ccb326fcbee9f8c8af4e2b75aed058f0672c0f1f1ad58ae95c33a5ba0ef796c1245decac0da6300914ed0e33b945d9d9381c11
- SSDEEP 24576:ERaIJDaakRdst5DK+VcgyYPN8tYzjfufQ:ERaITisDDKay4N8WfufQ
- TLSH T1F1158D22F2928039D67205326A6CD675297EBF724F3246DF66DCB71D0A748E05E34B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Setup\TM-T82IV.ini
- Size 31KB
- SHA256 314518104cdd2a458440326e0758648a4bc4426fa0b6f21694d0f5d095e653ec
- MD5 4374ce78afa362f31ce50d8b8e1166cf
- SHA1 c87ec7703a8e9c0fa4ef4d7c60c31f125685ce38
- SHA512 793b98e9a9b8f0c8e0dd3ad9c1714fd18acc9705b1844c951ca9a1594aa8ac62f293acb0afbfa049da416c5bf904898e6339e75471f4b9456b5a5f6fbb9d5ff5
- SSDEEP 192:2j8WOGy1HtHfrrgBNLQ31Yo1mbOp1aOJm6iIu4dXCjsY7HYxIDPRurSmO+2mG5pQ:d1NHfrrgBNLQ31Yo19WNRfIp
- TLSH T113E2BB22BE7DF961DD0F5AF23FE55A40508E9409734520EE11817D2A03BEF7AB934EA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\Setup\TPDBase.cab
- Size 121KB
- SHA256 d0e8861a285dd4e841124dbab627f30cf6ef714f3894f2c0060602fad346082f
- MD5 5290e37cbda531c24ea059b88f5703b8
- SHA1 4bad2800992a41503ed7ff023f502a6be19035c2
- SHA512 273a88d0c94471e155f11449f362efdbe2bd472bcadec680d3c7e1799ba437256960bcd8737b5e1d121c2434d40864edc226a6b8e98c2b3a81c1c0e4c91210d2
- SSDEEP 3072:k+GlWo+LFUXjUhnMIbL1F8/JXLwbC57QWAU/du:UlWxLFOjUhnMIuLYC5AB
- TLSH T1BCC302937F35467C1B884E7AB8C425609EB2B7BCF0C257440599CAAA56F6020793EDF1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\TMUSB\Setup.exe
- Size 61KB
- SHA256 10da51e46d446b1eebe5e80e8343ba8296fa7375ab49167aa3d069251b4be406
- MD5 22f8c7bdd48b675ac50b511e5f341393
- SHA1 8a3d64bf29df3f3f55f68cd0a31cba21e7ac69cb
- SHA512 9ca6934fe2efbc7d3dc45d3542b144d3a5be5b575eaf38b79756a2ea583c0d2ce43049ff4c0edefd646b08e87fc09510423330187ef1dca6972b05bebca976e9
- SSDEEP 1536:PuLCA+/yMjXcSlRj52b9P2eM5ZU8V/7c7Cx:GLCA3ulRj52b9eeM5rV/o7
- TLSH T18D538D12BD90D433D85789B124E4D2A19F7F76522BE0C0DB776982AA4F313C16B3936E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\TMUSB\TMUSB710\Setup.exe
- Size 90KB
- SHA256 ad9ebc3ae95216ffaf0b02ad1919da7a510b9f91c03e704bbaa95e8811674b80
- MD5 c5743178ce215232e6945d8097f9401e
- SHA1 60d6d102069d866f01748932677456b3348b2b15
- SHA512 c9de1b4fd755c649bbba4c87710f5164517b92b0b5d09c911442468b9d1752eb2b978168b095e1f4762699b4e265407925ac949da830427c02ffb05409317f74
- SSDEEP 1536:adgc3FCAWCHltT+8m/gXxJRQoGzOxVqLV4NXMna7c7dvxxL:yzUAdHH6/gXxJyoGzOxVqLV4NXMnao7t
- TLSH T12493C083BED10832F88249B020E15B759A7BFA520562CDC7FF24CE665E72741DB3A257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\TMUSB\TMUSB710\TMUSB64\DPInst.exe
- Size 843KB
- SHA256 18cf3dabf006bd1001d1c68370a15fb06ca47498a0021d8100df2e20976a6740
- MD5 95affca2fe839bf82f52ba44d1e1dc50
- SHA1 d91fd8ed74f3236fe8d78d8eecb3ca6065d5206a
- SHA512 c74885c0b0a509b79220874a3f152c7acd77808412813d70c6712bff27b56d37dcfa1e0db291b03483986728d9f920f9fb1d13bae253a4d6e412b74996d1899d
- SSDEEP 12288:QaeRl73Vde53ss/yC+JavFV07cfT+PeQqOTqtjGsJeCIGPX7:QF373FsgWFVicfT+PLqOCjGcIGPX7
- TLSH T14205B309F56A4361E8B2D1BDC5E36A59EC7138465B30CAC70309E36D1EF7BCA8536B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\TMUSB\TMUSB710\TMUSB64\dpinst.xml
- Size 1KB
- SHA256 12dbecc696081497040beccb66676f59725777bb7380f2adcc32bf5941ffeec3
- MD5 d7fb2496bde13c08e7713e22259d1817
- SHA1 1b1eaae704e507575af32c4187e77c1f060dccc8
- SHA512 3a59d98bfec45a65a6d33ce536936c3b9db3b11b9ee14e0234fe75af380f9d50d65f7922d43dc51be6e5995b01029c9ba0bcbc967a000186e77c815d4b6ef222
- TLSH T19A31774CD2D46360A9338710F82339A7AF804F5BC529754138EE816B7BB6C3DD0979B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\TMUSB\TMUSB710\TMUSB64\tmusb64.cat
- Size 8KB
- SHA256 94980c82c4ee4b0ef1c4618fab4536e55c024295cdddab9d106a7b888311ff5f
- MD5 b679db2783876dd75c44de0fed6978e2
- SHA1 f5c3bcb22d84ae386a671976d2fc86005b32b0e4
- SHA512 57d7201433f9eb43e8de31f9d6ef4733c08ec8d68f254619d3d8c3aa0937d8383936ba68e2d5c8edd44e4204448bac3aa4607442134ce720b057b4400548ce92
- SSDEEP 192:7el/2l2df+4cjZ60LEG6+g+3Ef5KYpBjSw0Fbqve:7vN4cjDe+3Ef5dpBjx82m
- TLSH T133023BEAC9BC51C7EC979C7053D8ED8BBC39ABC39C10052A52EB97A818433D1B70891D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\TMUSB\TMUSB710\readme_e.txt
- Size 9KB
- SHA256 45c6984b9e37ea7c8b7db09e9982f5d963e6ee3670c821f25e88ebfb7b4b8d41
- MD5 2586c9c15c1aeae0fbc7b4246c121b60
- SHA1 909e75b23e8ae3e312d248a6c644737d2372edd8
- SHA512 0dcdf45cb58fd629ae6f56b5f7df879d015cee8f2b1fc76c7be2d01a9bb318f543cd5ed240616057bb18b24f7017f356c4d0fa9e35ee2ce64d7154199e65e4bd
- SSDEEP 192:T47ISS6iF6l3gJk76Wbg8mAbbRYnRYqvi0sib+FkRS03OFPu/hW6plcgQ3:Tru3+Wbg1AbbGeFG31VplLQ3
- TLSH T1232243458EA9D2782133C2526C0F6A83F37A51EB4C72559838BC80686F7265EC36F5F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\TMUSB\TMUSB710\readme_j.txt
- Size 9KB
- SHA256 069fa98157c1f859a861aacc4f7b1a1303c9b2b46280fd59a0c48362cef64f40
- MD5 a48cd43ad50cbf4fcf3029af2437f228
- SHA1 eee0970a23f43f1fd51a9dd7e3190e0239a383ed
- SHA512 a871098d8d66662262f27668831989a6d7c06217a8f946854967e31df2e2b6eae7657af383cbf463b3559026485c81c5aa91a06c35513cf473d340651a4bb42e
- SSDEEP 192:p4gLIs6xPy8f/8me8iy8/4TrsSlShM9PCqoh8oh8t858R8zc8kK787N8h+0EAm99:p+xPtf0mBit/4Trs4Shvh5hyw+DbMYd1
- TLSH T1931263B0CC93EF25113ED362192F4F87EA2A47D3C4A18749BA2E91F46FF72995249844
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\TMUSB\TMUSB800\TMUSB64\dpinst.xml
- Size 1KB
- SHA256 5bc6dd9d40738d6f2dbe6161a596ac35d7a6c32005b7eb0a79c5a0c6acf673bf
- MD5 dbd52cc335e81ea31f5839bd67e39a16
- SHA1 9d48c104ac238af9f2c21e4d3ddfe4a4f1aae85a
- SHA512 1dafa72f6e5930608f4a88c4f1a82c4d5b9253d3508f7b80d170960ee67c209b50f354172ec069650f090cf6086ec593d1f6bcd52790c361715c911f9a8152e2
- TLSH T11F315C8CD1C813A199338710F91738A6AF904F5BC539758038FE815BABB582DD057AB6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\TMUSB\TMUSB800\TMUSB64\licenseE.txt
- Size 85KB
- SHA256 09b8c3fdd6df6bf26821e3e95ef666492548866c491ed50ac4c74f26266e547e
- MD5 d37f5b35c1cdc854df630c7d1ab94a60
- SHA1 08de3d3ebecf8567737c854bdfd83d0895a3e166
- SHA512 906d4fe31c179c6e6a2c03468af6d8ad176c97dd0637ca21df70a5b2c07cfc7ede7c5df21ea3cca0e00f8f4207c0f159d1116b9d940f4505b3e67077bb2ee630
- SSDEEP 1536:sqEb60p22uzMz4i5cyieAB6YO5K+ebjWgPvp7p0wnOswvZlNuu10stRNeO5j3b/Z:Qb60p22uzY4i5cyieAB6YO57ebjWgPvW
- TLSH T11683A951A3FD5608FAF77F60AEB992684E3A7C96AD3DC25C1250105E0AB2E50DD70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\TMUSB\TMUSB800\TMUSB64\licenseJ.txt
- Size 36KB
- SHA256 49f6c099b188ea4e2ed4eefe4d43eed32a8aaed362c7951982da46a4b9135c36
- MD5 260d5362e1a6682108ccf3d21d861401
- SHA1 5c76346b386afae3495385782b631e58047f03f8
- SHA512 66f29c0f6a478f31e620373f7ba7fc7d2a43fc32d1e831b663bb9f2edcc5251efae2f084ce3169a429613999bd3c33b68eac80f25a1ee20bf2bad388a465721c
- SSDEEP 768:HUBROUigx/OU/IhUF9q7pOUBUxg3EWOU+OUZOUtLOUZOUZS20goMAQMt0k/QkY3l:HUBRKgx/nIhS9q1Cg3EWmBlLRxS20go4
- TLSH T1EAF2A39D641482CEB6F78166856E36FC77AAF63491D84C800485C18B5CA68EE7306FEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\APD6\UnZip32.Dll
- Size 137KB
- SHA256 3ee2a868a45760ad81337998dfbee020816238499c5601bff4b7945765a215e5
- MD5 f42e14561cfa6c01f591f23bbb280ed3
- SHA1 93156a3e6432fb6dde506fd73bf54dccbd7edae9
- SHA512 d487f9908fcd8f4778fc000e9011c57bcf43ef08c33aa886f9e2e29fd9e38c90df182933261331d35be377f04e877bd432c5365628a9c0c7e494b7a15b9076f5
- SSDEEP 3072:FNKo08G6wPrzUYORkrYA9tVDMO87bBKro7K:FUo0fbUdRkrYAjVDG7bBZ7K
- TLSH T14FD38D427D9C50B1ED82613DBA962737C93EE3601117E4D6B76CCDE28F143C2B2AA259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82IV\Resource\English\LA_EN.TXT
- Size 96KB
- SHA256 0b00db432e605bb1976e3965bd02b1965e9a189b7d90f30488336ea051356e30
- MD5 10617ced2b74a10e2004b44222a49cf7
- SHA1 94e4b3ab06ee3f10d75d783f664456ae2a7cc1f2
- SHA512 0de4bf042fbf028afa6cea465d63d6a8cc604f2c52ac0deda4f5a3a8ddadf5285680602c746937963ee16364c5fb83ed599331bbd24b2ce72ae03bf3c6d580cd
- SSDEEP 3072:Qb60h22uzYIi5cyieQB6oO57ebjWgPvb0wnOswh+sTNGO5j3b/hGjEiVrQbsQJbi:Qb60h22uzYIi5cyies6oO57ebjWgPvbP
- TLSH T1DCA39851A3FD5608FAFB7F60AEB952684E3A7C96AD3DC25C1250105E0AB2E50DD70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82IV\Resource\English\Resource.ini
- Size 13KB
- SHA256 efb41647730bef9eb196fdc6c06c26175f20eaa7b984ae5c18f04fcff943a94b
- MD5 cf59dcda57ae763c168de090e5f6edfa
- SHA1 29448fd6578fecd02d3d7ee4879b9f2beca36293
- SHA512 7145c79efd02dcabb439bbe7ba625f1d02ec9dc2dd94515f53049295cc27ca4fabe5a56ce0b0113171f8e44180d8d5749897c1ac7fdc1beff059c217b296d444
- SSDEEP 192:w9wa/Eiajrt6Wb9b7i+R+ZSca2aNa1TfaWa5eG5/azasaUIR:wH/cVI2TBrQ1TiL5suRUIR
- TLSH T13C52BD46A3F80619F2F73F50BEB451A58E7B7C99AE39EB5C0240005E1AB0E14D8B1B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82IV\Resource\French\LA_FR.TXT
- Size 117KB
- SHA256 b0ede0ee7194e7e7d27020bd0a7e852b0f58249d7f2f233fb7f8f4163407c01e
- MD5 2a2c33505dc67104f2c5a3c96a081330
- SHA1 a12a6d46a9411c6a47caac594e3f6d6d19a78094
- SHA512 4de8c0ef6b0c36c08936e554062cf2a0eb75a6a3286b07a327e7619cccd414b5a560f0ef46d98a681836e84e651c41a38256decc82b16df034a825ff26107916
- SSDEEP 3072:sm/OaYmWkXgv4QSp8VONl9XcSoW1QdLjO0Z/qM0lr2/zq1ZbZJhfYCPpJRRUxZP0:sm/OaYmWkXgv4QSp8VONl9XcVWSLq0Z4
- TLSH T17BC33061A7FA9209F2F77F91AEBD55558E3B7D969C3AC11C0250109E1DB2E40CAB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82IV\Resource\French\Resource.ini
- Size 14KB
- SHA256 5baed2b3113355505599116ac453701dac1606e54986072e0fa603a1b3d6f915
- MD5 81d520ec327fd19541bb9c13e710e3c2
- SHA1 c952e3b02c08a0e54340fca589c6688b6f243680
- SHA512 253db5b42a5595b8f717a3b66d643a8c994e7ac8c1cc180fc8d1bf49886aaae9150a9be06e734d26f51103eeac23f55afd83aeb369478e690b8889599ad9fd32
- SSDEEP 192:wAufyVaCwaTDphG/sPHHhb1A5CqwRpKaD5w+E2kee1nesePcwa2aNaEGutGa2UaX:wz2LocLPKa4LrQ0J+4NV3QUIR
- TLSH T10662BE19A7E90255F3F33F51BDB901A48E7B3C9A9D39DA2D0280009E1EB0E54D9B1B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82IV\Resource\Japanese\LA_JA.TXT
- Size 41KB
- SHA256 20513a5d330d5293a90e7cbcb2861c5d9ef3370c0729e494ec7fe8c70811db7c
- MD5 8fb294f7e9b33ab513377f0d74b9fce3
- SHA1 e55312ea489ee1a471c6c43674dc29034ea039fb
- SHA512 6368ef5e75a6d0af4b00180248fc9de656a947983e388bc5a2e990e5f669784f64eb1903db807ffe27d5722f736ec568b2008d38d2421a9761a98a09ff1efcc6
- SSDEEP 768:HUBfOUig//OU/IhUFZwFbOUzU7g3ECOUWOULOUtxOU3OUiFIRzJ80Lz0gcMAQMtt:HUBfKg//nIhSZw12g3ECeDlx/6FIRzJq
- TLSH T17613A39D244482CEB6F78166456E36FCB3AEF63491D84C840445C0875CA68EE730AFFE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82IV\Resource\Japanese\Resource.ini
- Size 9KB
- SHA256 5a608062e2c257ebf4d046688ac83366943caf9b1ea1e02dc009983620d333eb
- MD5 c4497ed5aec566159699a2b893038e78
- SHA1 316340485f152d8060c073dac2748ad038982403
- SHA512 c15ab5699c732800966c578c88f92fa4bc82de562de45ccb0ff2aa8c21061926cc2b1d607e1c91b8a6daf08cc2d7ac5cecf6053da146bab309a285af4a1d6909
- SSDEEP 192:w1yaK8aIkqcYXbWRbEm55/a+a8aOyUaLa9K/n/cjaBaDawIJ:wZKhIMYXaQjjhVJW9i8+wIJ
- TLSH T1AB12CD0C7A950E4EB4F293E142F1B1A99B97BC9823BA5E5905C4850F2760C596323FBF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82IV\Resource\SimplifiedChinese\LA_CN.txt
- Size 26KB
- SHA256 56b127b4dc09dd95c1277de732a10980e6e00e26422c5d6d8333be42d088a576
- MD5 cfdff85dc5db0d29805bdad9758fde6b
- SHA1 fbb484ddef3a9c7022f2f047047ad8ff64eacd6c
- SHA512 e6f463a8dc7f9125a99f300be30fc0caa8fc26ff26fb5c1a80154df505dcccbab8e9150b35fb7625773f1400876f75aa55ce111add6a0b47d9e97d9ab7a9391e
- SSDEEP 768:xodH6Zdl2ZK0BTDX1EhsTeTF8wDx8ZBS7W99+RTh:xea/MZK8TDPyroSa4
- TLSH T1EAC22B3EB8B30316D9C68940BDE653D053CD2592AB6E2FD607FF400C789E51476E2ADA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82IV\Resource\SimplifiedChinese\Resource.ini
- Size 6KB
- SHA256 e9d1bf5e37bc771eca86ed7362563c7f5eee72b037146c72141313250282c7df
- MD5 e6774460fd2d677a70d604aed350be75
- SHA1 df10e0d91f81673dda9b178dd5b9800d4c756e40
- SHA512 9867c6f699664d997b72b82b4aca6be50e6bc2baae98f8a908ed52d3c6a99d0adf12a937e2445028b18e6426d52b22e37072f5575b2244a596d941ed21d2e4a9
- SSDEEP 192:wxa6baUcuEf0He5Ucp2WOtakaCaGaUaVV31PCalamaYIF:wsDUxEM+Fp2WOwZ/7JRYbYIF
- TLSH T1EAE1BB0C42D90D89A7E167018BF4819ACB873D8E233A9F5E40D5852B2B78C517523FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82IV\install.ico
- Size 361KB
- SHA256 c78b0a8ff02cba8bed7055d1939690fab9a324de6ba20dd257a56b2cd0469b2c
- MD5 f3e7046c664a5cbf07a881d61f962136
- SHA1 f0e249a40188098225f1126675cd1143c60ab700
- SHA512 e2dab4a2f8e59fc96ca3ca13647633218409fe071274dfe65df675057593ee482cf894c4e57960ce2d85423702f87bd8b27876c5735748d71e3a48b9ec4a7a06
- SSDEEP 6144:plz2icjOqvKKMfKeKpKfSKKRK6KKKe86kib1boD9KKeWwd8BdDRfj1e18A:plSicjOqvKKMfKeKpKfSKKRK6KKKe86Z
- TLSH T1CB744FE0D67399B6D663107212F09BB8C9FE5DA2192A02AD349CBD54C8F1D94B34B1FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\ea6instmt.inf_amd64_23e17478a655b625.ini
- Size 1KB
- SHA256 9b88fa4754351bf3010743df2e99b5e8b4026b8964f33b450087e5ba9bea2694
- MD5 51ede41995af289b01b5081d20560093
- SHA1 7bc6c850c8ad9ac79ff7e919a1a26c1b30613e1c
- SHA512 bdd27e5498ef5d3147d579d3705cb1756ed0e8798ba379fa2a2989938ff2725037317e1cd86f29acfb0459126f5fbca174b234bb94c018cd4d995cdd67def4a6
- TLSH T11D3179C6236B78EC40C86403276A893DC325B37F2A46AC393790E8D44F19A5BAF04B07
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\tmusb64.inf_amd64_36083d8cc53a6889.ini
- Size 416B
- SHA256 e60d96034437274ef2ddec76196a7b30637360cff9290164d30ab316b90bb4f6
- MD5 d98f987a2c5e0ee1fb234c8301d31edb
- SHA1 97c970fdf1e088f379642be53a309aca8a0c5582
- SHA512 c2b76d1526fd36dddab039e16d9857c8d37240c2a52b708a5626ddc413eef4c8015ec73e875e18e610ea7259f6540e8979027d452c09b91f8d15151bba01a33b
- TLSH T13FE0E5E5C66DB1EE5502906686796D39810F271B2B15549177A0F1E05F85C06EF0164E
- MD5 SHA1 SHA512 TLSH