Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 00:14

General

  • Target
    device-monitoring-studio.exe
  • Size 14.5MB
  • Sample260710-ajf47act6y
  • SHA256 c182a1993b1f2dc41b1e073b26967e23cf2579bbf7708425376ef82fd2c78510
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 8 IoCs
  • Drops file in System32 directory 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 13 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 60 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\device-monitoring-studio.exe
    "C:\Users\Admin\AppData\Local\Temp\device-monitoring-studio.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3268
    • C:\Users\Admin\AppData\Local\Temp\7z92C9ECC4\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\7z92C9ECC4\setup.exe"
      2⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4132
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2108
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{40a271f5-8f09-284c-87c2-efa8338892fb}\hhdnet.inf" "9" "4bf5789e3" "0000000000000180" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\HHD Software\Device Monitoring Studio\hhdnet2"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:2352
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{23ed4e46-7d94-724a-8485-fe1ab454c23d}\hhddmsusb.inf" "9" "415cbc32b" "0000000000000190" "WinSta0\Default" "000000000000018C" "208" "C:\Program Files\HHD Software\Device Monitoring Studio\hhddmsusb"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:2220
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\hhddmsusb.inf_amd64_4a187d425be47604\hhddmsusb.inf" "0" "415cbc32b" "0000000000000160" "WinSta0\Default"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4080
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3832
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c097f40c-6749-be44-b1a3-2a3e26e70ae2}\hhddmsserial.inf" "9" "4ae0df647" "0000000000000194" "WinSta0\Default" "0000000000000198" "208" "C:\Program Files\HHD Software\Device Monitoring Studio\hhddmsserial"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:5872
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\hhddmsserial.inf_amd64_2d9be54d705ce60e\hhddmsserial.inf" "0" "4ae0df647" "0000000000000198" "WinSta0\Default"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3480

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ChakraCore.dll

        • Path C:\Program Files\HHD Software\Device Monitoring Studio\ChakraCore.dll
        • Size 7.5MB
        • SHA256 65227302b89436968677657170d22db7de6206bbbd17bfce04ed67221f98aa3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msvcp140.dll

        • Path C:\Program Files\HHD Software\Device Monitoring Studio\msvcp140.dll
        • Size 628KB
        • SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msvcp140_atomic_wait.dll

        • Path C:\Program Files\HHD Software\Device Monitoring Studio\msvcp140_atomic_wait.dll
        • Size 56KB
        • SHA256 3d0cbfaa1bf3eecf5a3f4491d2960ee803cb994f30292c6adc4a07c498f60e2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        net.dll

        • Path C:\Program Files\HHD Software\Device Monitoring Studio\net.dll
        • Size 327KB
        • SHA256 a4a3050ea32e1dfba7ce44a684bd50fc2efec743d8525108a63aa12661f6ac53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serial.dll

        • Path C:\Program Files\HHD Software\Device Monitoring Studio\serial.dll
        • Size 736KB
        • SHA256 c7fc97aabc60a728a1ff66966ec7110427cafcdd6d6ab433da1bb7392c1062c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        usb.dll

        • Path C:\Program Files\HHD Software\Device Monitoring Studio\usb.dll
        • Size 676KB
        • SHA256 866c069b57ae7a16665039bec2946b3205f1dffaa132fe47874dfc27cc2941d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140.dll

        • Path C:\Program Files\HHD Software\Device Monitoring Studio\vcruntime140.dll
        • Size 174KB
        • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140_1.dll

        • Path C:\Program Files\HHD Software\Device Monitoring Studio\vcruntime140_1.dll
        • Size 48KB
        • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        config.xml

        • Path C:\Users\Admin\AppData\Local\Temp\7z92C9ECC4\config.xml
        • Size 27KB
        • SHA256 2b630d7fa4d5ec9569d2552e1124e571dc6b2a354224b4b19867ddbfa0a8585a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icon.png

        • Path C:\Users\Admin\AppData\Local\Temp\7z92C9ECC4\icon.png
        • Size 18KB
        • SHA256 e306b6474e45395222c4bb5369679ff237b825c545efbcfb300345c66449a0c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Users\Admin\AppData\Local\Temp\7z92C9ECC4\setup.exe
        • Size 1.2MB
        • SHA256 f9238121745de1050314d348920447574b2ea735e447ad9b86d28eceb4f4e7ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        {4B7577C8-E891-4B4B-BCEE-37604B765575}.7z

        • Path C:\Users\Admin\AppData\Local\Temp\7z92C9ECC4\{4B7577C8-E891-4B4B-BCEE-37604B765575}.7z
        • Size 13.9MB
        • SHA256 83dc846c06a74145390db93487b549704bf0224b5a02901dda628b0e0eb9172e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dmssrv_reg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\dmssrv-safeguard\x64\dmssrv_reg.dll
        • Size 527KB
        • SHA256 c061bb28d953c3bbb162c86a9ee5d4d18503c12551fdc617b3b9ffff8ca7f7fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        modbus.cdxv2

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\modbus.dll\modbus.cdxv2
        • Size 360B
        • SHA256 d69ac073122e4299119e9707eddd9740a38ddadcb886f5ec85b857c1bb06bb1e
        • MD5 SHA1 SHA512 TLSH

        modbus.dll

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\modbus.dll\x64\modbus.dll
        • Size 1.6MB
        • SHA256 bcf6d76e7f2c2d5935fdc5cd51284af837b00c91be07a802c59f15bc777b8902
        • MD5 SHA1 SHA512 SSDEEP TLSH

        netman.cdxv2

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\netman.dll\netman.cdxv2
        • Size 232B
        • SHA256 749207e80db35b7ad8dc53a523fa781456c43d6aa66713ed68cf670e661fde0d
        • MD5 SHA1 SHA512 TLSH

        netman.dll

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\netman.dll\x64\netman.dll
        • Size 299KB
        • SHA256 652791ec46f244182298d127cc8dfe1da79a3bf5b38f1c67999659d02db41247
        • MD5 SHA1 SHA512 SSDEEP TLSH

        protocols.cat

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_headers\protocols.cat
        • Size 8KB
        • SHA256 80e5341ff6b3ddbd0afa2fe0b15e6ec214b021c47f9de30735b3ac760b23eb07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        protocols.ppack

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_headers\protocols.ppack
        • Size 1.1MB
        • SHA256 817c8bd4ba128fb49ae32564e3f02326d7a4fe931031ec76186046bdf34f069e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        std_netdefs.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_headers\std_netdefs.h
        • Size 2KB
        • SHA256 c02820815ec019d92ca1c09a9ce6846e633ded117d1e13805864f5864622c3be
        • MD5 SHA1 SHA512 TLSH

        stddefs.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_headers\stddefs.h
        • Size 2KB
        • SHA256 3e4261efe2df53401311065b7f832d687812a981fea794478cd24c599c376832
        • MD5 SHA1 SHA512 TLSH

        arp.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\arp.h
        • Size 5KB
        • SHA256 9abd80fa4463f17fe33c8b2fb902d1faa3780d7fbcacd051b7f5978339efe323
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bvlc.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\bvlc.h
        • Size 45KB
        • SHA256 d4be940bd5e1ad153e341d5c56778d3beb6516180659ef2c46ef6af06af99023
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ccp.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\ccp.h
        • Size 3KB
        • SHA256 4094a124bcacefa8d2d8331a02a66e758ab9204fe812345f7e2252efc4951d88
        • MD5 SHA1 SHA512 TLSH

        chap.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\chap.h
        • Size 1KB
        • SHA256 73091ed43c136b9e3af3b4dad662df97486608a8ed64d7ab5264ecc70c2d8e99
        • MD5 SHA1 SHA512 TLSH

        dhcp.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\dhcp.h
        • Size 11KB
        • SHA256 b1f70811babb91fbc5b72e900c3c0147eb9d63c858d9cc03f0fcf6905e3db304
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dhcpv6.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\dhcpv6.h
        • Size 14KB
        • SHA256 a6ad0bad279766fa8767452b316e30c043df2c9ed8617af98203fcb488622d1b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dns.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\dns.h
        • Size 9KB
        • SHA256 449af47f9bfecc0468d53bfac696c35218c4e575f64e96c80c24b59058fe04f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fscc.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\fscc.h
        • Size 2KB
        • SHA256 f1885ace0b120eb79bf2019781987a7f5f716f19dcc5b49533b71af8835b55ce
        • MD5 SHA1 SHA512 TLSH

        gre.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\gre.h
        • Size 3KB
        • SHA256 8a76d24fe053de1880cc5b21df262cb54240e1b59f20ff5688c3a431cf3e49cd
        • MD5 SHA1 SHA512 TLSH

        http.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\http.h
        • Size 3KB
        • SHA256 d04de8c161f0336ac9476029458b40ab2b1255859d14d765b65b1a6cee4a7883
        • MD5 SHA1 SHA512 TLSH

        icmp.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\icmp.h
        • Size 5KB
        • SHA256 137ecf4cc1b2af7740340ae5b1df19034698afbf3d0afdb2951e30e580d5d327
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icmpv6.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\icmpv6.h
        • Size 17KB
        • SHA256 0ab30c2af0596286f12b4847b2321b5d1ee51bd14c002fd2d22df06a52d74538
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ip.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\ip.h
        • Size 14KB
        • SHA256 6a12030b0b383c3108a6e332f4fe4608b984ed84af5273d837994f7b0b124670
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ipcp.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\ipcp.h
        • Size 3KB
        • SHA256 66c4d9a329882a825802cd1259ec0ccb51926c20895a71f2686d247943cb46db
        • MD5 SHA1 SHA512 TLSH

        ipv6.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\ipv6.h
        • Size 1KB
        • SHA256 4737c64c6356097ce6b9eb2959e6d66aec49bdeaba18e4462e368539c382b61d
        • MD5 SHA1 SHA512 TLSH

        lcp.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\lcp.h
        • Size 5KB
        • SHA256 ebfa2a08cd5efef710e69975e5bfd160523f913d182a411489a64799b059a0a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lldp.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\lldp.h
        • Size 9KB
        • SHA256 079f1c30087ff2c28c4fb6af2619b0186e64ca55817b8b94542d4ca0caed29ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        modbus.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\modbus.h
        • Size 16KB
        • SHA256 5169a9b29d282ce93e976fa04a510d67bfad811081fc8455dbdfb4e509a25777
        • MD5 SHA1 SHA512 SSDEEP TLSH

        modbus_ascii.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\modbus_ascii.h
        • Size 21KB
        • SHA256 6402f3e563540f9497d0601ab141773e4dfcbe4cc9a7fa667ffc11b04a7b615b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msrpc.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\msrpc.h
        • Size 6KB
        • SHA256 a012b226cc352405de0ca608e983ded38761ea277774da7a6b2f134115b937ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nbtns.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\nbtns.h
        • Size 4KB
        • SHA256 b6fa8b72b5c0b665d52188642cefa1daf0c31b41b928bf776dba6358f8e4673e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        netbios.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\netbios.h
        • Size 3KB
        • SHA256 5d7e83de459e97241a6b4f15787fea7570e992a0eddb4de751d7721802c7a2c6
        • MD5 SHA1 SHA512 TLSH

        netbiosbase.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\netbiosbase.h
        • Size 7KB
        • SHA256 8d4d3b40dc3ec79703aa299d93437372af06770a7053416e990c01a5fe959759
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ppp.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\ppp.h
        • Size 5KB
        • SHA256 48ed0b7c613a6e49c93588388f9bf917c3464540fdd93c21c639d96e4a3a7aa6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pptp.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\pptp.h
        • Size 6KB
        • SHA256 95e10f18fbdd8196d180342e1555c7b07f67d13a93fc14d4ca9615ccbbb34582
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rfc2217.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\rfc2217.h
        • Size 7KB
        • SHA256 08095e7a82599243917d2145d348aaa52f134948b6cd9515c827080d060aa8cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        smb.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\smb.h
        • Size 78KB
        • SHA256 b1a244cacbb86fb7b26fecb490055e13dc6bd2f473d6362a1c9d40f7c43d576d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        smb_transport.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\smb_transport.h
        • Size 823B
        • SHA256 cbafbf9d70696d6a47b6f4d5495a5fbaab8af7f6ad2d858c71d5e6e7fb4520b9
        • MD5 SHA1 SHA512 TLSH

        std_serialdefs.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\std_serialdefs.h
        • Size 7KB
        • SHA256 181f3c38a84b85cc9264e159a5be5a4907db0c972c6de5ea86c31a7654bb9a63
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tcp.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\tcp.h
        • Size 9KB
        • SHA256 273a4069e71563c75330e83d1b47b98366dbd4f20ac265aceae8780fd4252364
        • MD5 SHA1 SHA512 SSDEEP TLSH

        udp.h

        • Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\udp.h
        • Size 2KB
        • SHA256 de1957696294baedc2f1d8a960e18c6d0530813ac313895ee6c9abfa601d22a9
        • MD5 SHA1 SHA512 TLSH

        dberr.txt

        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 64KB
        • SHA256 a6a78d1346222ec8b5e5721856801830c32ba1e51b7ca3ad64b732308fb7f5cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dberr.txt

        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 64KB
        • SHA256 cab1e79f65fdfa3e0d3310367d7bf1ed1e405f44b582df626949096f133e2cf3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hhddmsserial.inf_amd64_2d9be54d705ce60e.ini

        • Path C:\Windows\System32\DriverStore\FileRepository\hhddmsserial.inf_amd64_2d9be54d705ce60e.ini
        • Size 444B
        • SHA256 f4b53a47112f2b5fc0885b53fa076a996a8ab4064ad617588aadd1f231762575
        • MD5 SHA1 SHA512 TLSH

        hhddmsusb.inf_amd64_4a187d425be47604.ini

        • Path C:\Windows\System32\DriverStore\FileRepository\hhddmsusb.inf_amd64_4a187d425be47604.ini
        • Size 432B
        • SHA256 a558e957d66063cc51a7645dabfd24f68c3e5d7cdf1015195b43e386a4a6d9f3
        • MD5 SHA1 SHA512 TLSH

        hhdnet.inf_amd64_9bec1483b0e34704.ini

        • Path C:\Windows\System32\DriverStore\FileRepository\hhdnet.inf_amd64_9bec1483b0e34704.ini
        • Size 534B
        • SHA256 2424c9a2782367fd498528a9586aa9e45be7700cd4e6ec99fcd96096fc9dd6ea
        • MD5 SHA1 SHA512 TLSH