Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 00:14
Static task
static1
Behavioral task
behavioral1
Sample
device-monitoring-studio.exe
Resource
win10v2004-20260513-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
device-monitoring-studio.exe
Resource
win11ltsc2024-20260709-en
19 signatures
150 seconds
General
- Target device-monitoring-studio.exe
- Size 14.5MB
- Sample260710-ajf47act6y
- SHA256 c182a1993b1f2dc41b1e073b26967e23cf2579bbf7708425376ef82fd2c78510
- MD5 8055407e589d7f6cc83a73b75f5687dc
- SHA1 2478ab02dae085163c2e1429ea69903f3fabea2f
- SHA512 251dd4449c367b83265455b19791ff11a813d9a0bdabce7bf9b824bf64abf1026ec2b42d29bddc75379e6cd31c0b1c0ff470778f0e94d32de78e374c4821c3cd
- SSDEEP 393216:ocg3MuNJG0KP3D0vap0m2EuZu2EtkGyvvetBv3C5op9exAUf7FXo:rfuNQbrgaG75qyneP3rexAwi
- TLSH T18FE6330776FA6032F429083BA675900791BEE381E545A0FF6767D4BE0FA01092797AF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 8 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\hhddmsserial.sys DrvInst.exe File opened for modification C:\Windows\system32\DRIVERS\SET6865.tmp setup.exe File created C:\Windows\system32\DRIVERS\SET6865.tmp setup.exe File opened for modification C:\Windows\system32\DRIVERS\hhdnet64.sys setup.exe File opened for modification C:\Windows\system32\DRIVERS\SET6875.tmp setup.exe File created C:\Windows\system32\DRIVERS\SET6875.tmp setup.exe File opened for modification C:\Windows\system32\DRIVERS\hhdnethp64.sys setup.exe File opened for modification C:\Windows\System32\drivers\hhddmsusb.sys DrvInst.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhddmsserial.inf_amd64_2d9be54d705ce60e\hhddmsserial.x64.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{968a2dfc-09ae-af4d-8ead-0d6257ff41d2}\SET64BC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec6d91d5-d3ad-f747-bcb7-7a6b19418f28} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{756778fc-4165-5e48-9e64-463de20a0773}\hhddmsserial.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{756778fc-4165-5e48-9e64-463de20a0773}\SET6FA9.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{968a2dfc-09ae-af4d-8ead-0d6257ff41d2}\hhdnet64.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{968a2dfc-09ae-af4d-8ead-0d6257ff41d2}\hhdnethp64.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhdnet.inf_amd64_9bec1483b0e34704.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec6d91d5-d3ad-f747-bcb7-7a6b19418f28}\hhddmsusb.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{756778fc-4165-5e48-9e64-463de20a0773}\SET6FD9.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{968a2dfc-09ae-af4d-8ead-0d6257ff41d2}\SET64BE.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{968a2dfc-09ae-af4d-8ead-0d6257ff41d2}\SET64BE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{968a2dfc-09ae-af4d-8ead-0d6257ff41d2}\hhdnet.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec6d91d5-d3ad-f747-bcb7-7a6b19418f28}\SET6A69.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{968a2dfc-09ae-af4d-8ead-0d6257ff41d2}\SET64BD.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhdnet.inf_amd64_9bec1483b0e34704\hhdnet.inf DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhdnet.inf_amd64_9bec1483b0e34704\hhdnet_x64.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_331e9c5c335ac9bd\netnb.PNF setup.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec6d91d5-d3ad-f747-bcb7-7a6b19418f28}\hhddmsusb.x64.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{756778fc-4165-5e48-9e64-463de20a0773}\hhddmsserial.x64.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{756778fc-4165-5e48-9e64-463de20a0773}\hhddmsserial.x64.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhddmsserial.inf_amd64_2d9be54d705ce60e.ini DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhdnet.inf_amd64_9bec1483b0e34704\hhdnet64.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_084fae4985f9e985\wfpcapture.PNF setup.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhddmsusb.inf_amd64_4a187d425be47604\hhddmsusb.x64.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_3f8df7d3f8955ba8\netpacer.PNF setup.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhddmsusb.inf_amd64_4a187d425be47604.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhddmsusb.inf_amd64_4a187d425be47604\hhddmsusb.x64.cat DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{968a2dfc-09ae-af4d-8ead-0d6257ff41d2}\SET64BC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\hhdnet.inf_amd64_9bec1483b0e34704\hhdnet.PNF setup.exe File created C:\Windows\System32\DriverStore\Temp\{ec6d91d5-d3ad-f747-bcb7-7a6b19418f28}\SET6A6A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhddmsserial.inf_amd64_2d9be54d705ce60e\hhddmsserial.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{756778fc-4165-5e48-9e64-463de20a0773} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{968a2dfc-09ae-af4d-8ead-0d6257ff41d2}\SET64AC.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{968a2dfc-09ae-af4d-8ead-0d6257ff41d2}\hhdnet_x64.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_22107a56317eae6e\ndiscap.PNF setup.exe File created C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_cbac0f4324473ecc\c_netservice.PNF setup.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec6d91d5-d3ad-f747-bcb7-7a6b19418f28}\SET6A6A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{968a2dfc-09ae-af4d-8ead-0d6257ff41d2}\SET64AC.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhdnet.inf_amd64_9bec1483b0e34704\hhdnethp64.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_9b261cc833ca42f2\netvwififlt.PNF setup.exe File created C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_75188f35842f64ce\netserv.PNF setup.exe File created C:\Windows\System32\DriverStore\Temp\{ec6d91d5-d3ad-f747-bcb7-7a6b19418f28}\SET6A68.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{756778fc-4165-5e48-9e64-463de20a0773}\SET6F89.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{756778fc-4165-5e48-9e64-463de20a0773}\SET6FD9.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec6d91d5-d3ad-f747-bcb7-7a6b19418f28}\hhddmsusb.x64.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhddmsusb.inf_amd64_4a187d425be47604\hhddmsusb.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{756778fc-4165-5e48-9e64-463de20a0773}\SET6FA9.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhddmsserial.inf_amd64_2d9be54d705ce60e\hhddmsserial.x64.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhddmsserial.inf_amd64_2d9be54d705ce60e\hhddmsserial.x64.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{968a2dfc-09ae-af4d-8ead-0d6257ff41d2} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_859bcbd9052a3d45\netrass.PNF setup.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec6d91d5-d3ad-f747-bcb7-7a6b19418f28}\SET6A68.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{968a2dfc-09ae-af4d-8ead-0d6257ff41d2}\SET64BD.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ec6d91d5-d3ad-f747-bcb7-7a6b19418f28}\SET6A69.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hhddmsusb.inf_amd64_4a187d425be47604\hhddmsusb.x64.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{756778fc-4165-5e48-9e64-463de20a0773}\SET6F89.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_1094dc5a16e3f79d\netbrdg.PNF setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\HHD Software\Device Monitoring Studio\studio.exe setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\hhddmsusb\hhddmsusb.arm64.cat setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\usb_video_view.view.ts setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\pran.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\http.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\modbus_ascii.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\network_example.view.ts setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\hhddmsusb\hhddmsusb.arm64.sys setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\usb_urb_view.view.ts setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\serialraw.dll setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\nbtns.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\modbus.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\dmssrv_config.exe setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\dsc.dll setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\linet.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\PPPoE.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\hhddmsserial\hhddmsserial.arm64.sys setup.exe File opened for modification C:\Program Files\HHD Software\Device Monitoring Studio\protocols\lcp.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\usbmass.dll setup.exe File opened for modification C:\Program Files\HHD Software\Device Monitoring Studio\protocols\arp.h setup.exe File opened for modification C:\Program Files\HHD Software\Device Monitoring Studio\protocols\dns.h setup.exe File opened for modification C:\Program Files\HHD Software\Device Monitoring Studio\modbus.dll setup.exe File opened for modification C:\Program Files\HHD Software\Device Monitoring Studio\modbus.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\usbvideo.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\icmpv6.h setup.exe File opened for modification C:\Program Files\HHD Software\Device Monitoring Studio\protocols\protocols.cat setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\usbcomm.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\protocols.ppack setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\hhdnet2\hhdnethpa64.sys setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\serial.cdxv2 setup.exe File opened for modification C:\Program Files\HHD Software\Device Monitoring Studio\protocols\std_serialdefs.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\bcontrol.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\res.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\remotesrc.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\inprom.dll setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\gre.h setup.exe File opened for modification C:\Program Files\HHD Software\Device Monitoring Studio\protocols\smb_transport.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\serial_example.view.ts setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\netconv.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\usb_video.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\hhddmsserial\hhddmsserial.inf setup.exe File opened for modification C:\Program Files\HHD Software\Device Monitoring Studio\protocols\smb.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\monitoring.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\custom.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\udp_win8.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\std_serialdefs.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\lldp.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\hhddmsusb\hhddmsusb.x64.cat setup.exe File opened for modification C:\Program Files\HHD Software\Device Monitoring Studio\protocols\protocols.ppack setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\univis.cdxv2 setup.exe File opened for modification C:\Program Files\HHD Software\Device Monitoring Studio\protocols\dhcp.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\filter.dll setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\usbvis.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\concrt140.dll setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\ipv6.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\serialline.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\logit4.dll setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\logpanel1.dll setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\meditor.dll setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\binding.dll setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\arp.h setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\protocols\serial_request_view.view.ts setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\newdld.cdxv2 setup.exe File created C:\Program Files\HHD Software\Device Monitoring Studio\hhdnet2\hhdnet_arm64.cat setup.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log setup.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\INF\oem1.PNF setup.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe - Executes dropped EXE 1 IoCs
pid Process 4132 setup.exe - Loads dropped DLL 23 IoCs
pid Process 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language device-monitoring-studio.exe - Checks SCSI registry key(s) 3 TTPs 60 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Settings setup.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe - Modifies registry class 35 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio Tool Configuration File\DefaultIcon setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio License File\shell\open\command setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio Workspace File\shell\open\command setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dmslog8 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio 8 Log File\ = "HHD Software Device Monitoring Studio 8 Log File" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dmswks9\ = "HHD Software Device Monitoring Studio Workspace File" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dmslic setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dmsdwc9\ = "HHD Software Device Monitoring Studio Tool Configuration File" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio Workspace File\DefaultIcon setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio Workspace File\shell\open setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio 8 Log File\DefaultIcon\ = "C:\\Program Files\\HHD Software\\Device Monitoring Studio\\logpanel1.dll,0" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio 8 Log File\shell setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio 8 Log File\shell\open\command\ = "\"C:\\Program Files\\HHD Software\\Device Monitoring Studio\\Studio.exe\" \"%1\"" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio Workspace File\shell setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dmslog8\ = "HHD Software Device Monitoring Studio 8 Log File" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio 8 Log File setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio 8 Log File\shell\open setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dmswks9 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dmslic\ = "HHD Software Device Monitoring Studio License File" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio License File\DefaultIcon\ = "C:\\Program Files\\HHD Software\\Device Monitoring Studio\\Studio.exe,2" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio License File\shell\open\command\ = "\"C:\\Program Files\\HHD Software\\Device Monitoring Studio\\Studio.exe\" -l \"%1\"" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio Workspace File\DefaultIcon\ = "C:\\Program Files\\HHD Software\\Device Monitoring Studio\\Studio.exe,1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio Tool Configuration File\ = "HHD Software Device Monitoring Studio Tool Configuration File" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio License File\shell setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio 8 Log File\shell\open\command setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio License File setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio License File\DefaultIcon setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio Workspace File\shell\open\command\ = "\"C:\\Program Files\\HHD Software\\Device Monitoring Studio\\Studio.exe\" \"%1\"" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio Tool Configuration File setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio 8 Log File\DefaultIcon setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio Workspace File setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio Tool Configuration File\DefaultIcon\ = "%INSTALLDIR\\Studio.exe,3" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio License File\ = "HHD Software Device Monitoring Studio License File" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio License File\shell\open setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dmsdwc9 setup.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4132 setup.exe 4132 setup.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeBackupPrivilege 2108 vssvc.exe Token: SeRestorePrivilege 2108 vssvc.exe Token: SeAuditPrivilege 2108 vssvc.exe Token: SeRestorePrivilege 4080 DrvInst.exe Token: SeBackupPrivilege 4080 DrvInst.exe Token: SeLoadDriverPrivilege 4132 setup.exe Token: SeLoadDriverPrivilege 4132 setup.exe Token: 33 3832 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3832 AUDIODG.EXE Token: SeRestorePrivilege 3480 DrvInst.exe Token: SeBackupPrivilege 3480 DrvInst.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe 4132 setup.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3268 wrote to memory of 4132 3268 device-monitoring-studio.exe 86 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\device-monitoring-studio.exe"C:\Users\Admin\AppData\Local\Temp\device-monitoring-studio.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\7z92C9ECC4\setup.exe"C:\Users\Admin\AppData\Local\Temp\7z92C9ECC4\setup.exe"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4132
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2108
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{40a271f5-8f09-284c-87c2-efa8338892fb}\hhdnet.inf" "9" "4bf5789e3" "0000000000000180" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\HHD Software\Device Monitoring Studio\hhdnet2"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2352
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{23ed4e46-7d94-724a-8485-fe1ab454c23d}\hhddmsusb.inf" "9" "415cbc32b" "0000000000000190" "WinSta0\Default" "000000000000018C" "208" "C:\Program Files\HHD Software\Device Monitoring Studio\hhddmsusb"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2220
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\hhddmsusb.inf_amd64_4a187d425be47604\hhddmsusb.inf" "0" "415cbc32b" "0000000000000160" "WinSta0\Default"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E01⤵
- Suspicious use of AdjustPrivilegeToken
PID:3832
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c097f40c-6749-be44-b1a3-2a3e26e70ae2}\hhddmsserial.inf" "9" "4ae0df647" "0000000000000194" "WinSta0\Default" "0000000000000198" "208" "C:\Program Files\HHD Software\Device Monitoring Studio\hhddmsserial"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5872
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\hhddmsserial.inf_amd64_2d9be54d705ce60e\hhddmsserial.inf" "0" "4ae0df647" "0000000000000198" "WinSta0\Default"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3480
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\HHD Software\Device Monitoring Studio\ChakraCore.dll
- Size 7.5MB
- SHA256 65227302b89436968677657170d22db7de6206bbbd17bfce04ed67221f98aa3a
- MD5 4cfa5acdf2c609444a3bf6bd3fb208aa
- SHA1 d5f254630e91880b7b5547559570f2af9484cfd1
- SHA512 5552deb7c84b7bf7d4e1802f20d911d26c746274f3b1925032e804604bb84ce77dbae83a598b2b2f4954561ed38ab8843b626ddeb6d16698b695e8be439f3b6e
- SSDEEP 196608:d7T0xUiNhMsEnOo5jVT3OneBLS/vcDVfHsDpITVy0FiQ/OoFoZQZV:d7TlykJWo2ZOV
- TLSH T1E6865D5BA3AE0098D167C2388567DB27DBB1FC15272057EB0690B6292F33FE05B39761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\HHD Software\Device Monitoring Studio\msvcp140.dll
- Size 628KB
- SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
- MD5 4796bb351c00d47717906bbee4e20837
- SHA1 480c725faafa25d2274bde6f8791bcd8b525e5e5
- SHA512 2777a9b104f0ac244d90572e02c2f2fb911ce4e8bd9f7b099074d5614c9a7d423c14eb6c46087167e160b6c614d6fbdd9b762b41eb7f023ff66ee65837071db5
- SSDEEP 12288:60hIKSLeXl9vce+YtEd5tFYDIpDv5bKwWKBaXzogmIGq2HZ5D13EXwbkDZmaD4EJ:60VkwDIpsezBbkDZmaDH50NQEKZm+jWA
- TLSH T1E8D42923774D02A0D195F2B9A1C74306E7F1B8464323A3C392EADA6D2F5B3D9677B250
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\HHD Software\Device Monitoring Studio\msvcp140_atomic_wait.dll
- Size 56KB
- SHA256 3d0cbfaa1bf3eecf5a3f4491d2960ee803cb994f30292c6adc4a07c498f60e2b
- MD5 cb5404c8773b6a3758d05c9c8b551339
- SHA1 8544021005709c682ce4d2430fba88aff0fc7eb3
- SHA512 691dc781dcfe2ad9f1e324ad31fdd55dfa120a4a56e6dad9f61e62029c9687a7a3806d920a3eca2dd2c8e3fa8a9c420132b342d74d59cdeb3c749be5630a05f9
- SSDEEP 768:E23X0bNO5FEEsn/H2QzRclqoLJcb9zP4s9zW3:raUfcnf2Q1clqoLSxzRz
- TLSH T11E435A19CE39E017E74A8D74C616C806FD72BED78B90B5CB67419CCA0DA6BC8DB39205
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\HHD Software\Device Monitoring Studio\net.dll
- Size 327KB
- SHA256 a4a3050ea32e1dfba7ce44a684bd50fc2efec743d8525108a63aa12661f6ac53
- MD5 f4557e764e8d3682276208c168b4bdc1
- SHA1 015dd6b4d38e15b73d64f15584b4e3125649f19b
- SHA512 47eb7ea077723abb22730d9fd958d58c269d84e539caa817ac3565ae5e4c8edbae9027e77a8e42255aa59b9130a872a064dd359ce7b6c6c6ce6924bec4c0f814
- SSDEEP 6144:+i4uGLb//jQ7S0Reydu9TfgQlP5pKf2w08lQ26cGKkR7hMgb6KtcgvLN2nX:+iYMcrgupKPSZcNK7xXcgvxC
- TLSH T10B645D16E5A800B9E177C1B9CA979D06DBB27846073466CF13C0D96B3F27AE89E3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\HHD Software\Device Monitoring Studio\serial.dll
- Size 736KB
- SHA256 c7fc97aabc60a728a1ff66966ec7110427cafcdd6d6ab433da1bb7392c1062c0
- MD5 96a11387f9b47345d831ea56d80f6214
- SHA1 c2784c6c41ca8b7802d890a268b4a04595854294
- SHA512 be7f7da5f09fe29ac78de4d3b0fd9c6a2b5df9be328a1ef36b3d1ea9222ba630f6e9fb7fb7ac153fefacf3e98cbf594ee9bef7a4fee5e6e598aa92df0be6f5b3
- SSDEEP 12288:ba0+qkde0A2Zbej2cBUCcVCFvYZfP91AuymnpVkbOImbjUtzz9w:ba0bR0lDmYF9SmnGm0zxw
- TLSH T1CFF46D12FAF801A9E177D179D6679917EB7238460334A9DB03C09A6A2F33ED45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\HHD Software\Device Monitoring Studio\usb.dll
- Size 676KB
- SHA256 866c069b57ae7a16665039bec2946b3205f1dffaa132fe47874dfc27cc2941d8
- MD5 6bf611c638d5515323873764c577b9c9
- SHA1 2d97d1c3edcb4b729e6e81705dcb31b0c63ba6bf
- SHA512 0a2c3aaf25cab8e6d995bbcea671694bdac1615df0d6fe8dac0eaa3f5a27d0dda5b07b36c72bb259ccd507924003a7505005e626554ab90f67a7929bd5b0421f
- SSDEEP 12288:FXD26gNJrUUDDWPvGLCwKKZ5WrJAQZ5ZVDWCt:Ry/JJWPvGLCDAsZhX
- TLSH T123E44B12A5A402BDE17BC276DB538912EFB278461734A6DF03C1DA661F33AD84B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\HHD Software\Device Monitoring Studio\vcruntime140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\HHD Software\Device Monitoring Studio\vcruntime140_1.dll
- Size 48KB
- SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
- MD5 bbfa92d8173376c972fd58dcf5ca6aaa
- SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
- SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
- SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
- TLSH T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7z92C9ECC4\config.xml
- Size 27KB
- SHA256 2b630d7fa4d5ec9569d2552e1124e571dc6b2a354224b4b19867ddbfa0a8585a
- MD5 5d5f48b11f077b638b635a8c2ce76eeb
- SHA1 e08c8c912c1b59c934ac161f3aed6d14968f0745
- SHA512 78223743e5199585197155e4665d60f8217c3fd50654f98edbef163c36bc2443c9b04d9adf978847837cd707ce11cedd5d326f54ac8e22f939acfdc7470eb884
- SSDEEP 384:YZVdFBMES5k2GmWh3/TGNsQk/SYoPIyDP:SCk2wGNsz/SYxyDP
- TLSH T155C2CE35B2B1ECA122C0587A1F723DCE9AEAE17BDD9F700881EF36D443A744602D55E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7z92C9ECC4\icon.png
- Size 18KB
- SHA256 e306b6474e45395222c4bb5369679ff237b825c545efbcfb300345c66449a0c4
- MD5 507ccda3e0a1b71132860ee79a418f8d
- SHA1 4265bd8e6fd71fa0cd2c2c6e0699727fd3834dc1
- SHA512 4bae4405fa9a119fb8931638bdcb467595060ae2acbeeeb8cab853cfc71b87ae7b2ef3860f7f113e17f0020f604bcc31d3c88fd834e4eeec6d33f48e79665e49
- SSDEEP 384:bkZJkU7ZoEveM1UZpQAbQTfk064+KoTye56yAe+HmAwggnaeIKszJguC6kzK:onkU7ZosWnQAcA2RWy0ZAeamJbnZo
- TLSH T1A982D081060A89F91E2E7858F2E85CD1BE234E3ED0E9D211C881B006B4F5353EEDB9F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7z92C9ECC4\setup.exe
- Size 1.2MB
- SHA256 f9238121745de1050314d348920447574b2ea735e447ad9b86d28eceb4f4e7ad
- MD5 0df69b7ba86e09a9780cccd0fe914bcf
- SHA1 3ad4fc2ef7e9b2e099a6c799bcb69717d3cb94db
- SHA512 fd4063bcf81bf62ac8a4f61e72c4cc6e6b5254f2df1d59324ff9b5c04ba201aa03a0569ba86270da61840b46ec8a60970e1a8998376fd0a6f6e20f41128e6969
- SSDEEP 24576:nIrXckfDzHGCH5oWQDAYxx9SftjUUEgbif:ngckfDzHGCHyWQnJSlwFgbK
- TLSH T1BA459F1BA6BC42F9E0BBC175C646580BEBB2744A1334E59F03E08A566F375209F7E712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7z92C9ECC4\{4B7577C8-E891-4B4B-BCEE-37604B765575}.7z
- Size 13.9MB
- SHA256 83dc846c06a74145390db93487b549704bf0224b5a02901dda628b0e0eb9172e
- MD5 e390e062f69cd4bcda8e85fd825b4dd3
- SHA1 9772c8548f1e06a065b8350f2f86fc51a1adb2f2
- SHA512 6a84b20c09a98add8953d4d9a5cd7feca2935f4e669ae062254e523fac4b32fe9b3fa008d77bd46a6e67fe98004e9f7315a4921f8adf724e01ff8d9ba72d8a89
- SSDEEP 393216:3aznAcfuPSVvoijcfn0D5spSJZz4BJp8unn9sy5qppO0/rsf8L7G8:q8cf6O/4f0NRMplnN8g0/r/5
- TLSH T113E63307277D2072F419087FA6B8904791ABD382F146A0BD5B77E8FD5AD041E27C3AE6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\dmssrv-safeguard\x64\dmssrv_reg.dll
- Size 527KB
- SHA256 c061bb28d953c3bbb162c86a9ee5d4d18503c12551fdc617b3b9ffff8ca7f7fe
- MD5 84a5784056d1833dc7751ca8d19acb57
- SHA1 16f99c22777e2fff126b34f64802c3f469d90f66
- SHA512 25315f0c87cf10ad56297bb04f01a18bdbdc4d7690e8736b0637bbb63b028d495799a18acd277c1d6e35d7ca8bd90813083d0c3842a460ae8f745e0dd2c0de75
- SSDEEP 12288:BOLbwSkWlK963zwCZDc2JZL2gDRbYyewTzSeGUIJDzThwnkqGWYmUudhGxj0zPPR:eqWYTBxjEKmSO3wC
- TLSH T1A5B46E35B2AC53A9E156E13889D74506E7B17886133196CB57D08ABF1F2BBF05B3F220
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\modbus.dll\modbus.cdxv2
- Size 360B
- SHA256 d69ac073122e4299119e9707eddd9740a38ddadcb886f5ec85b857c1bb06bb1e
- MD5 3f8425605f8a2ac69228155b0a65ce36
- SHA1 5d5c58146ff511c46ca7d12096442093dd52c920
- SHA512 4d3f6a590a94472c6fc6cf4da5f0e6459624a529766c6d881606e86eee852d31147a98039b9a41313843e92b5740780183fff3007dca27003fc8a8a95cf79756
- TLSH T1E9E068A6E0078842318A071A120FCA4688F24AF42EA8B58BE455284A8D116B44D1F421
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\modbus.dll\x64\modbus.dll
- Size 1.6MB
- SHA256 bcf6d76e7f2c2d5935fdc5cd51284af837b00c91be07a802c59f15bc777b8902
- MD5 47dd652f5b12ada798fa338f15c46b44
- SHA1 d5142f6a45d25b8d4f07949840b8abc9ae1d5a88
- SHA512 5442851d7a70800e512e7e7c083aef963908df3885befaacabf6a80069ddffda4cb1a741d97f2a123ec5ce164ac55739886ab396d53170acfa7b13c151a9fd2c
- SSDEEP 24576:3e2izOo9mZW7JtapnwoYXy6cgNgBw+sfhn9RoC8Wb5:3bLo6CJcpnwoP6cgOGzRoY
- TLSH T12C756C13A6F440EDD07AD0B8D653AE17E771384A0B34AADB02D18D5A6F33EE0567E712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\netman.dll\netman.cdxv2
- Size 232B
- SHA256 749207e80db35b7ad8dc53a523fa781456c43d6aa66713ed68cf670e661fde0d
- MD5 406efb2e37b22ad78d9ccdf519f2eff3
- SHA1 379df574023c9bdef05c318522a133fae23af37e
- SHA512 3bf639f9f28ebef6260d5ad46ea5c312989a3723572c659948ee7bf48159857fbccacd7c8b542d333c993e718fe603e98389e854922f120015bd5382f7b73739
- TLSH T167D0230DEF9B6C20003004430923BCA0CD220FFE335210000B3C4C086FCD5F5A202079
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\netman.dll\x64\netman.dll
- Size 299KB
- SHA256 652791ec46f244182298d127cc8dfe1da79a3bf5b38f1c67999659d02db41247
- MD5 4c21d44120493b5d8113d1ec594115e4
- SHA1 2e5aa5cc7200a6ecc9093c117af1fd5e08f9b6d7
- SHA512 7a6dc29c87973ff251d8677f8a266615b1f9767660d350d542728ef4a87b58a41a0e477950fd8aa6b3300808ccf57c58c6638a1e64634c0b67b319d0cbf5b526
- SSDEEP 6144:trD22VQE3e7NSbaDLiCs2yO207vpVDTT+ynQUJOpO:gwESb5eeM
- TLSH T198643B23B6B5046AE167C17D8743C906DF727C8A4730E1DB12D1D99A2F73AD1AA3E324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_headers\protocols.cat
- Size 8KB
- SHA256 80e5341ff6b3ddbd0afa2fe0b15e6ec214b021c47f9de30735b3ac760b23eb07
- MD5 53e972ece4e1003cdfebd58ec7aa7550
- SHA1 3cc3f4649e92b6557e3c905f027abe8569fe9867
- SHA512 6a02a493f5f2efa5e51615ecafb5eadb1f5ad3c8b65985be827d3bfb97e67722026a5e6fe0b50efcecc15b984a1002c6066550da369494c56535e7b621c2fd23
- SSDEEP 192:evPw+qxowgoInfrVNy8dmL4pUQaULc8pq8RvTU9WD:eLUDInTVNyAmL4/y8R7U0D
- TLSH T1E5024AE3C9647C419C97AE10B8D49423FD73B9C61AC6D4C26148C1528AC23873FCE2BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_headers\protocols.ppack
- Size 1.1MB
- SHA256 817c8bd4ba128fb49ae32564e3f02326d7a4fe931031ec76186046bdf34f069e
- MD5 e88ea6ed79a1a127eb1e0e8d4ce31d84
- SHA1 025189b77663b734bdae1bd5c0f7c026159b858e
- SHA512 dbaf112bdc69b3eb69866870fccd0ab3f95b95d71d614520321a50adb7ed67fcaa71192f49010e53748da4309747c5b26e5e14d50911e6568a063a40239cc2e3
- SSDEEP 12288:WYdQMUK12gm/qmCKHPYKZmBMEVhE3dtxmFBzY9P7FF:WYsgm/qmpHQ/nWzxgzkf
- TLSH T15745F51ABA2E7196C07300746A369440EE6DD63B914886B77C7CD315EFB58A4C332FDA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_headers\std_netdefs.h
- Size 2KB
- SHA256 c02820815ec019d92ca1c09a9ce6846e633ded117d1e13805864f5864622c3be
- MD5 4e7caab101c577b517c35aeaea011d8b
- SHA1 b2890e5667d60bd56d6f35209df105752f27b688
- SHA512 6f538c3136cde519bd933385e6f15599bd55835a79c66214cdab198e6a4ca36ad59b772aaf4be5e66869c8055d77722111aa1d642284bc20f370973c6be9454d
- TLSH T1155173A433DE712A14D2005142F22A42E9BDF4C498BFC856B45FC25463D0DB8EF39AE5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_headers\stddefs.h
- Size 2KB
- SHA256 3e4261efe2df53401311065b7f832d687812a981fea794478cd24c599c376832
- MD5 38ff13a140f7097f136bd6d5920d6c57
- SHA1 6a16a05b9318ebc8154a7244ce21e565ab16a021
- SHA512 526a2ca91d4c7a03b3da5f12e4444b4c4d80ebbf62f81dbab19ef848e860e2e91f34fd21dac4650147e9b73c2843437c72501a6da142768d5891dfcb596ef4f2
- TLSH T1225120963D89E1F459372A63E33A050DE14F88073DF5E9B4A017953C0403D98F2F6AEA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\arp.h
- Size 5KB
- SHA256 9abd80fa4463f17fe33c8b2fb902d1faa3780d7fbcacd051b7f5978339efe323
- MD5 4766e19fba3d7232de562eeb42d04619
- SHA1 4fc843f37fc442e3a2ed4aeaa3fb6c18a017204b
- SHA512 bd1a0b368e948fa4f4441b3bb3ee507763db5ceebb67e7a6e95a946878ae59d9977fe45adbd4c1d3f42db8ce221f9a8dd33f796f27ad23204791213c363fbf2d
- SSDEEP 96:UGD0jnXt3GFOmXpDROGMC8Reb+dJ/DfSxEQ7OVlqsSWCW2jwW4WUi1nRqhnSb:H4JGFOmXpDQnB4O4Vy+
- TLSH T19EC110057B6FB158A62020C2E1B5A9E1C71CC0CA557E69B3F86CD215D3F21B8DF98EE1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\bvlc.h
- Size 45KB
- SHA256 d4be940bd5e1ad153e341d5c56778d3beb6516180659ef2c46ef6af06af99023
- MD5 caec1adb9245a1c2c986928ba27065ee
- SHA1 c4a54ece183c89729a8b410e68452953432e579b
- SHA512 641d74feb8e2fc75958b95df9bd83801c61fa587af2b94064b759fb88e88bd4c3c3fadec372db5928a46176442d1784fe37bd55d1848e0cb6dc443f7e7618e4d
- SSDEEP 768:l/ZRDQjXCFIFXBAvw2tdiRvglPbD8OJE1wz:ZZRUjyF6BAvw2tdiRvgPJE1wz
- TLSH T1BE23865A735CA9CB49A24468C53224E1D86CC038C06EF9D3796AC774F4C25E8D736BEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\ccp.h
- Size 3KB
- SHA256 4094a124bcacefa8d2d8331a02a66e758ab9204fe812345f7e2252efc4951d88
- MD5 222f7b9c6468c9293505232dbe1c6346
- SHA1 eeabfe9750097c61297f38eaaabfd8494bf4f1fc
- SHA512 249f0e09933a9403a4ae6432093d9095ad5fd1a2c82e0af34bbef02028c112cbf71f4eeb816bd07d18ddb35ffdcf2abfce8eea27c5b00a2711d82b123fbfc629
- TLSH T1F371ED0E367CB1DC569370A58E327440DDAEC20CF19AA67B2C1AC628F885D59D377EC6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\chap.h
- Size 1KB
- SHA256 73091ed43c136b9e3af3b4dad662df97486608a8ed64d7ab5264ecc70c2d8e99
- MD5 7279381ae29952625836ddd6a5652579
- SHA1 61cf9dcb09bbc2d654f15d062ada8b296d37a515
- SHA512 a99cbc7bf3c26147e562230fd84f900260e567375cdba195761994b40b3737600bb727b2ed2f2e457e50650b9c5eb7fc07c1cb5c3d6883b429608e888218844e
- TLSH T124214225349D41E50E1352C6A33219199B39C25CBB3FFA26341CC918590AA49E267CC1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\dhcp.h
- Size 11KB
- SHA256 b1f70811babb91fbc5b72e900c3c0147eb9d63c858d9cc03f0fcf6905e3db304
- MD5 7fe86fe87ecc81c1d20a154af810ad20
- SHA1 8e03c60521bf1cbe38bdd7c3c32e3c8357602691
- SHA512 50d18728a727892da5e2a47c1d2e829e7fb9827dd2766141a12b808f004f02a04d25592b38ad2dbc72efb2b4b40ab0a5a24846bddd2a5bcd824b2c81f00bd321
- SSDEEP 192:H46lhx654DF+B9GGTSMGXxXznyXGRjazZsNMr:hM4DEMqGczZsNMr
- TLSH T18F42154C313A63CA27D745AC493B28D1C729878DC45EA9232F0CE316F981EDAD7635E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\dhcpv6.h
- Size 14KB
- SHA256 a6ad0bad279766fa8767452b316e30c043df2c9ed8617af98203fcb488622d1b
- MD5 6d6c4407a3458df357bb6c4587e3727e
- SHA1 890f376744c9d180d7953b7ad13f88c203815fae
- SHA512 d417d9aa8f1e1a4221930ac206ae898f398b7ec337c1b51a03e909c9e7a375645bf2a380b687a97a0e9a72076d4e9ddd7b72dd3f3f1b3144bad2b465984454bd
- SSDEEP 192:H4z3HHCj9IImIlEKJA6WUbP79IgDPhn7Plf:k3nCKImI379IMpf
- TLSH T1F662FE057179D09695E38C9313372C60CBB5A708E93E4EBB6B19C210E84A6EDD77398A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\dns.h
- Size 9KB
- SHA256 449af47f9bfecc0468d53bfac696c35218c4e575f64e96c80c24b59058fe04f0
- MD5 d6ccc970f23cf1944fc0e77f9cad312b
- SHA1 ab4f3181734c1c965a7e77a5097908aeaba5dff8
- SHA512 25fdd1b851be60b7eeac82ea3d9c624b90645c5f216fe39acd81d86fcc856fa0a50f1ae554d822178a0d7f3831145e9cdd4457b9eda7a9fcbbe2b68f085f13a9
- SSDEEP 96:UGD0jnqMIVoiOUJNvS5QpTEaL7diaLTfZXehi07Z6mBjiWJFdd2173za+XXRGZs1:H4sV5HEaLzsYSxdE792IqdN1qjqE3
- TLSH T1CF12738C713E31E5C4A310691733A124F8FCCA50AAF96377E484C225F5C5A66EBB1DE2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\fscc.h
- Size 2KB
- SHA256 f1885ace0b120eb79bf2019781987a7f5f716f19dcc5b49533b71af8835b55ce
- MD5 57036cca647471369e2d8950351e0f59
- SHA1 48d4912eb4289f3cf6c51a008963b3c359ed01d9
- SHA512 ba13fd5e9f2e6c0dd04cd020c1acdd686959442a726b464d01c7952532a1fb4eccfe8f7b50ddc657164d7ee4daa76c2bfd01a6063b488f3b00d2b65f6b631e37
- TLSH T171517321FF853459783902DAF130BD01F10DAC8F62FBD511229A9B38F9BA5454E34B0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\gre.h
- Size 3KB
- SHA256 8a76d24fe053de1880cc5b21df262cb54240e1b59f20ff5688c3a431cf3e49cd
- MD5 28ca8f8647ac31842eaeb1616bc35492
- SHA1 1449bf1db3736b8a75a673bfb9fd5eb39cf7d8db
- SHA512 30fdbe3d78f6fe60b4ff64f8fff8f872646070ed0b20bbe4f8ac3c489d07ca5fa514e4d3bb7b075029834681f81fd8ede7fe1ec47544676e62d7e67bc13fdced
- TLSH T12E71873A721E22BB8A03019C5176C981F556CA14E7E59E637D0EC748F102D6ADAA3DC7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\http.h
- Size 3KB
- SHA256 d04de8c161f0336ac9476029458b40ab2b1255859d14d765b65b1a6cee4a7883
- MD5 e0e8c44402de12a90f61209ebd3be834
- SHA1 0d7597454a1288df7b128fb3d4200dd255b85bb2
- SHA512 d0dd47c48973fc84e3da406e67a2840188c165746d6c1d33d68321f8c5d64aa4a20b52bce451b7a66952c9898ddf2e466922bf9a65c3bfd2bb315268c5976835
- TLSH T1A071DE4532AD98844A67416C407A1DD8FC2DC04592BA9EF37C24C614FD815D97373FDA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\icmp.h
- Size 5KB
- SHA256 137ecf4cc1b2af7740340ae5b1df19034698afbf3d0afdb2951e30e580d5d327
- MD5 1ddd1a5b88e62efcf973895d066d6c4e
- SHA1 d6a03b2d2789147c46fc9f0ffb6fb08d76daf644
- SHA512 e433fa337ccb2285e05bef58f4d0d9e52b367fe86f96ac7da110ab3f5822ceefed8b47639bbe71fe720ffabca0e8aec1988d24ba04a20bc262af1512da730788
- SSDEEP 96:UGD0jnQv+stYrhRsMTNGNG5gOJtZ5gATrAkSShUoM1PUMZXMMhAogAnIXM6tRZF:H4/dRcc5fTgbO3M1cMGM9oMi3
- TLSH T1D3B1B6F5329278E7922350A596709640FA74088C3DDB733739AEC34999C6825FF72D72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\icmpv6.h
- Size 17KB
- SHA256 0ab30c2af0596286f12b4847b2321b5d1ee51bd14c002fd2d22df06a52d74538
- MD5 507430a72783b174a1bc6bd4cc833f6a
- SHA1 0f79f5ba703b2d6c1922264af3333083798b7fa1
- SHA512 c3ac471e482b212d9fffd58fd03949eb234e755203aa321f11245d6f163e78e3ed000f6c459c98c4aa33d661791c8e7b2e5425757769fbf86749de1e4f0d39ff
- SSDEEP 192:H4RnSxiCxx0kUUaMgcdWCsCT1ZkNk5uXrsCNMbxK1eGz7uk6hH0l8Cq3CbBWxBth:/xxaMlWCsCZae+rskMbxzGz7UUFpwR0K
- TLSH T14782EE29722CB5CA98B315A413B21890D5FDC858998E4FA37C0DC26AE451EA5C733EE3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\ip.h
- Size 14KB
- SHA256 6a12030b0b383c3108a6e332f4fe4608b984ed84af5273d837994f7b0b124670
- MD5 e2e9aeffb13c0005587f691f328975e9
- SHA1 cf4c591ef2e8cc807903798f4eb97a4c4e87f7bd
- SHA512 c8edab778e4a3fc093f41f28fc4451e2648d47294bda396b30d2b33f3d575506c9e77ad1512ee97074783afdd23b75f025b988a6850e007b6a86363b35684c19
- SSDEEP 192:H4SKabuHrJaVCw/Bug0D82njxrfXgFLVzVCKs:HaNgg82ntbXqVIn
- TLSH T1225230DB173F7299055298E8BABB5B01D1EFE23F998D40503CFAC1516183894CF2ADB2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\ipcp.h
- Size 3KB
- SHA256 66c4d9a329882a825802cd1259ec0ccb51926c20895a71f2686d247943cb46db
- MD5 834fbb1312047a2f5793089a58b8a49a
- SHA1 0eb1c3a73480eb26f0ed6290be39600a9ec2069f
- SHA512 5678dea423ffede8c5220b46b500bf300911dec46fa26f25e6ccdf991f764320b990c7f71e73a8b992774f45216c5bd0248ac0a16b41c1c39ec3e5ccef05f0d9
- TLSH T17B71F14237EEA4AD59B340C447B228A1C57CD1B8E99E4E53350CC739D190EA4CFA7ACA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\ipv6.h
- Size 1KB
- SHA256 4737c64c6356097ce6b9eb2959e6d66aec49bdeaba18e4462e368539c382b61d
- MD5 68560cf47a77d4a792d321556b684f7a
- SHA1 cf47cb9272ced5ff01cfdce9985e3880b6c0531c
- SHA512 bf4b829c47689b0d6b7c0fe149b8e21adad667f236335069abd2ce1b965246c261c84cf3ca8a0f764692bdfbaceb18af1938453d0514e9ab06f6990bbda1733e
- TLSH T1C4216368343F33D94D2310D6A2721541EF2CE484EBBA3A143019C15DE08288DE7BB952
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\lcp.h
- Size 5KB
- SHA256 ebfa2a08cd5efef710e69975e5bfd160523f913d182a411489a64799b059a0a2
- MD5 fc9a8dd5e6facccae2f5b976d9b37ba3
- SHA1 cd906a88dc14f36b1fa71b64444d6243ba80ff2a
- SHA512 0093a8b1b72326fc4bbcfc1b7e890d1a14eaadb6a4b2a58a70569ecbbdef0059d8b37e5f880be5e25a8d9df0853bd5dc1f0f4bcc8a0a636352f7092c1173c905
- SSDEEP 96:UGD0jn2eSF/TbnAqQkvyelSma3bLBuV5jWy/XkdMeJWuD31n1WLkBJ/QLRGhQh:H4qV5CYHMD3u4BJG/
- TLSH T1A2C1FE45762D719A9193816D0A323064D8BED138F17AF27B380DC219F4DA6AAC333EC6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\lldp.h
- Size 9KB
- SHA256 079f1c30087ff2c28c4fb6af2619b0186e64ca55817b8b94542d4ca0caed29ef
- MD5 af501a0c2b72065fbf2b5484df6dab4a
- SHA1 3e450ff63367d493371fbea83166ad7b463c20e5
- SHA512 89f4f8c027ac19f0b813f8ecd67dc74175d9940082274fad85e75e94194c573dcb2f63b63f8e84701870bcbd5cff7bb1343d2ffc6f896a19a819d1ce638d6b54
- SSDEEP 192:H4adtdBXqcQt7Q0LqZ4lXiYfIzld3+WlkfRH5o6ooQuTsG6o:ZdtdBPQt7Q0LqZ4lXrfIzlgWlkfRH5o6
- TLSH T11D12CB99762EB2CD84C3053646B228D0C8BCCC39855F5BA77816C66BF4919D2C37AF98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\modbus.h
- Size 16KB
- SHA256 5169a9b29d282ce93e976fa04a510d67bfad811081fc8455dbdfb4e509a25777
- MD5 6ad454135f9937285a7f7991b13ba25e
- SHA1 23da108e17a1fdc50ba06946ab5735af1a08a552
- SHA512 4aeacf19b161d5e5cad03e520cbb733b354c8bdf7679cd7ab950c929dd69245ae7ad0e6e50004663d5e0bc99f541648b5cdd230a01bbe3563568ab21a08fcbac
- SSDEEP 192:H42Cy7RwbWONoeS+ZppaUNnQOx1NFNQ5GvrVW8cEpHnBNtiGnyQrFlnLWdMZ4wnx:0bWW7XcEp7Own5FvEk
- TLSH T14B727279F95D70CFDE4350A8A9365460E8BDE42CA81EEB67B80DC1A5FC450CDCB32992
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\modbus_ascii.h
- Size 21KB
- SHA256 6402f3e563540f9497d0601ab141773e4dfcbe4cc9a7fa667ffc11b04a7b615b
- MD5 23994b1ff6f3c3af1c2c9746499e6ee3
- SHA1 37f852794035e52c6b65392e3dbca88fc72744e6
- SHA512 a96cadb5b2406b6df8f4bbd5a28dc6c6f9269adb1252795e7d0d014b7f2b3ee7999fdbebbe28f32ba3f8dcda66fafd0ec160099addd30828d1e4f77ef65cf2ac
- SSDEEP 192:H4egOg7gpgyIzrGTOdT2P94TyKCL+RTy3dBgx0A208cEp3naLhtna3BW0wHVKG4D:9L+RxYcEpOc0BHyGG4InRZHEi
- TLSH T1D2A2322DFE8E708AA751805C653711E9DC3ED12D902ED8BBBC94C294FC558CA97A34E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\msrpc.h
- Size 6KB
- SHA256 a012b226cc352405de0ca608e983ded38761ea277774da7a6b2f134115b937ea
- MD5 9da1a25f0f60b60f34ca9e48bb0d0b19
- SHA1 e0e6ad09ad0163f757ad54f9560110bb7c2eec45
- SHA512 80d0dc3d42e2e3dedc18fb2641517eb28e56648ce903f04cb1f1c7656444e88254c65deccf62616280cac3300ea80818d1808f263c791d972108e51ff1d8e584
- SSDEEP 96:UGD0jn4w3hCgmJIhD1NKr8Zyn4b6xWGk4N:H4h3ArIhWN
- TLSH T11ED12F61BC6F89DD5A7900806B311C42DE79CA02B9DD9AB3280C4616B1DF8B8D773D9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\nbtns.h
- Size 4KB
- SHA256 b6fa8b72b5c0b665d52188642cefa1daf0c31b41b928bf776dba6358f8e4673e
- MD5 ac5817e5bcbd8104e9ab61fd66f948cb
- SHA1 5d6d0f3501192cf71a6b57f6a864e2f882525e21
- SHA512 9e259144eb53b0122a067a7e6200a5da53b1d16c425f23499cead382a5e145e047b02a9e1bcfa3aa79fb27724912284c7d7178e7926a1f564381c7339183b4e5
- SSDEEP 96:UGD0jnINDFI0L8idGPQ2jX6nIUZLYOy6TSp9ooW0yHmQefMgdAlxWccZ4ST5DXey:H44d853Yk3MhoXeWX
- TLSH T14181402A31DF32F4E963226175B60993FBF9CA04FD2E23B8B44190656343A059F31D97
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\netbios.h
- Size 3KB
- SHA256 5d7e83de459e97241a6b4f15787fea7570e992a0eddb4de751d7721802c7a2c6
- MD5 c11b881d97c28ecf4eaa8746ca80fc60
- SHA1 1116bfd681f3a898c75c07110609402dd0fc92ca
- SHA512 7276fcdddccbed051770960e1fd63f0710563f07e1194d5e3061ccd25d6395d95dcea6c83310b72f01b742daab61550df1b1031533be9d7dd5b13dd02889aefc
- TLSH T1F2712158325F729C1935809967715182FABEC00869EE6BA1B85DC7DDB120C66CF36EC3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\netbiosbase.h
- Size 7KB
- SHA256 8d4d3b40dc3ec79703aa299d93437372af06770a7053416e990c01a5fe959759
- MD5 14dabf587795d548d30dc0d8591baf3d
- SHA1 a7fa38441a6dcc878f644ce440f6592f65666ffa
- SHA512 8ad2896e21ee1ce1ea575430d63285b0d7e0ff445cc9414d96ea8259e9d135fb662d88fd01c124a7a1ef328e3eb010d7f4b7770a951b0680e7deaa0db812209b
- SSDEEP 192:H4aaNoGUKtIv9qiUA0YpKJepKewOAZaAqJeKzzeKWK/KwAcFnD:VcskoVwYdD
- TLSH T179E102C836BDA1E80962B1F74933B061FAECC84899E587837D19E628F501657F331DD2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\ppp.h
- Size 5KB
- SHA256 48ed0b7c613a6e49c93588388f9bf917c3464540fdd93c21c639d96e4a3a7aa6
- MD5 ed01a11dc0ac9a5286449ffb5f3d565d
- SHA1 ad3a16da033777db0dfd9f2b99a01e48f2ea55eb
- SHA512 317792d7ddc216e446872829aca7ed334ae94a5c363dde8ca77cbf5a84a0d682bf41907df3769c685ce5d57dea0a21bbdd58e5fc47b95513ca59e1956158e807
- SSDEEP 96:UGD0jnAaRNoi7ozRDcf7Nfq5rQPuuce/3C5wGcckunru8JCb7ICUMv2Wjlc6r2nF:H41B7Nfq5rQPuuD/3C57MfNvlLUl0HhE
- TLSH T1E7C1AA1EB3AE1C8C451DA8653A35A5E4C91FD08C814E956FBDC4CA0CF6075B9E272AC2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\pptp.h
- Size 6KB
- SHA256 95e10f18fbdd8196d180342e1555c7b07f67d13a93fc14d4ca9615ccbbb34582
- MD5 9530d1b161ca6dee794a74b645415745
- SHA1 3ece227632e4fb0a89b2d45bae78bebc312d2533
- SHA512 0360f14c6a10a5cecd3c66b1245f5a44f844201aab034b3a83f79a6770ceeb0c0bd9822fc8685f511cb718750366d28bfd066fc724eb0fb9881f77afe0bb060e
- SSDEEP 96:UGD0jnC20ugBjAYAtiaZdM7hAStLgXa7sHTILSQk8WTNUaMQD6MCZWZPS7tkDJwC:H4BKaELukG8WTyZWTuamlA
- TLSH T1F3D1821E736952EAE32762506D369822DBBDE400640D2BB13C45C667C183DC5CBB2EAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\rfc2217.h
- Size 7KB
- SHA256 08095e7a82599243917d2145d348aaa52f134948b6cd9515c827080d060aa8cc
- MD5 93268b1e694a6a04c0693fddd275dd64
- SHA1 7382a94fdfb4fce30ff62e678dd94a1ac9db071c
- SHA512 0d9025bbb23dc235832f9096c7238190678115eeed6ba59fab0b4db77a29ad640cd0debbb0e6353530b47476eae93e2695d37dfbd2cfab0728bcb272968cb71b
- SSDEEP 192:H4ZBx6Os2PG1OuclQ48IrIyKNoflZIKIWEXUi4Pumpidec:mBG1qQKEyKWfAVWEf42ge
- TLSH T160F1895A303E93ADD9646028AB7154B1AE3CE54897DAEFD33401CC15B4C31EAE23F58E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\smb.h
- Size 78KB
- SHA256 b1a244cacbb86fb7b26fecb490055e13dc6bd2f473d6362a1c9d40f7c43d576d
- MD5 0893affe0a6abfcd7f7231d281e7d330
- SHA1 2b6fd8a0eda140c16f26ce404db7d8944a475411
- SHA512 5c24f08658e858ca26371e52754fe2022d19f9e50d66897f8c87d17387719cbc444c633dd43aa18493a2b57bdc8b5b94ba5f76af93fe41746a4a62e1b55459dd
- SSDEEP 1536:/docx5YhEK15/w1CuPr8vHaO8hTyCTbw5MN:loPEK15I0uPr8vHYhTyybw5O
- TLSH T131738455F22F74DBC95754003A708452AEE9D510BD8EE7A33CCDB2226468D98CF33EA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\smb_transport.h
- Size 823B
- SHA256 cbafbf9d70696d6a47b6f4d5495a5fbaab8af7f6ad2d858c71d5e6e7fb4520b9
- MD5 438e80dca0388e40fcba649bdb8a801f
- SHA1 5faa2220bf46fdc26be815536be4d61bcb828c3e
- SHA512 f13a8e64623d391ce6ed9ad0593c28e821472cafad20b963f81cdfc86113b1c6fb6eab722fe9a17673b274845e07dbe152590cb3778242b4e84fd21f9c40568c
- TLSH T1B70146F179FE91B10F5380C5D3165D06F739A048BE3B9910309ACB1C214BD4DD266C42
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\std_serialdefs.h
- Size 7KB
- SHA256 181f3c38a84b85cc9264e159a5be5a4907db0c972c6de5ea86c31a7654bb9a63
- MD5 cb1b41c1c53ae175a7f617f05dcf7933
- SHA1 13a4cc63aaa504e1e6707c5d0f7d581a98a58bc2
- SHA512 22038a7ab844dd3c78d9caadabf51bf4c7ab7d53a94302a697ab4da3beae2cda0830914b8bcdd00f491656b9aa6645856cb1dd81116266c13d8bf3ada573b1f4
- SSDEEP 192:H4/DBvu/5Q2aUHZij9h4GALcDree15ZgPTc21QpatMrJ/wZFX:+y5Ha19KGALQreA5ZgPY21aIkJ4HX
- TLSH T1A5E10E152DF622F6D43944E2733A3C049753B2438DE8EDC7B68C6B8A17431599EA931F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\tcp.h
- Size 9KB
- SHA256 273a4069e71563c75330e83d1b47b98366dbd4f20ac265aceae8780fd4252364
- MD5 b198cc3e6cecb7bc4b752c8c2accc2b1
- SHA1 4535224dee5ed0ef6ebc96bbf620d6a871d03b00
- SHA512 5e04e7eba9cfbf1bb2402e121133e80c91522a97b8850bbe4c8ea4c333fb3d6ccad069957ca438dcc7a060e98beb660d9ea66e532d9a7ff02d342afdef358cc2
- SSDEEP 192:H4FsGmaT/NPCq9Kbb0Gv6MUbEBB6ZbYs09:oNmajNPCq9K/0GCIt9
- TLSH T107125596B22CB04E626740258933A0E5C53DD469E18AD3F3385AC366F486AFDE773DC1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{93F4A8AD-FC50-41E6-A84F-A96909BA956A}\Components\shared_network_serial\udp.h
- Size 2KB
- SHA256 de1957696294baedc2f1d8a960e18c6d0530813ac313895ee6c9abfa601d22a9
- MD5 39c969583fa9bee003a063978be5d996
- SHA1 1582ba53cf076147308b9509e2830b60cd9119e3
- SHA512 fc6d6f93047df838f35a027980f20e9a772e60a9f3c6b439c6ad76037b13d397ce7cfffebad4ea39a7e5d9ff5b2be38d59c34b5c071e48b4003791789056d275
- TLSH T14041CD78326E90910B19899A927672E8DF2DD14CE15ADC073C44C64CF88B0EE8BD3ED7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 64KB
- SHA256 a6a78d1346222ec8b5e5721856801830c32ba1e51b7ca3ad64b732308fb7f5cb
- MD5 b0518bb3a59db3decea725730f1ae35a
- SHA1 55637a5fe2f51886bd511fc327a68990fb86b4e6
- SHA512 53adb15913730ae7813fdb9e72fc5b5fd13bf49dc68701f9571314f4757a1a590ca69c7c665737c0311d9ad8934498956568fdbf295417844a7c97f745565894
- SSDEEP 1536:sKWASuAGPpFnsFYS9uevNwyk4iymyf8dUENGKGPPiEzJuLPES83O1b3LfYdNmRTX:3Nv
- TLSH T1FD533C05C0D8C529C9B60FA262A7EE72CD2E658A770B0DA531AD7201DDC3B552F7A07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 64KB
- SHA256 cab1e79f65fdfa3e0d3310367d7bf1ed1e405f44b582df626949096f133e2cf3
- MD5 aab6ba0612f70dbec924959e3242bd63
- SHA1 1882350d07953892ce47ff6738f59981620d0eb7
- SHA512 41bc746748c2d62aaa04c228c38ecc1d6462b6537d0c197e7502faac8fce2701f3cc7b556893dff44c6ca88a3ad3dfcaf5f2db93fdba5df25c84beed6fdf7db3
- SSDEEP 1536:sKWASuAGPpFnsFYS9uevNwyk4iymyf8dUENGKGPPiEzJuLPES83O1b3LfYdNmRTY:3NA
- TLSH T1E3532C05C0D8C529C9B60FA262A7EE72CD2E658A770B0DA531AD7201DDC3B552F7A07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\hhddmsserial.inf_amd64_2d9be54d705ce60e.ini
- Size 444B
- SHA256 f4b53a47112f2b5fc0885b53fa076a996a8ab4064ad617588aadd1f231762575
- MD5 5d1c7b8ccdda26481f0df7fd236d2095
- SHA1 fc14a28fba60678cdb1f788dff13c5100790f4e2
- SHA512 8cdad247cfaf78387e893b09579a112ed11d38751bfe5c41ce6d024ac974ed0f8fb738feb31953fe200be05087f314cca46d0e0555e07986cfae56995c85f5c7
- TLSH T1FDF05C87A46C87FD7151B030A2049B35FB3BB64F049070D13280EAE04F59C01CF3C988
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\hhddmsusb.inf_amd64_4a187d425be47604.ini
- Size 432B
- SHA256 a558e957d66063cc51a7645dabfd24f68c3e5d7cdf1015195b43e386a4a6d9f3
- MD5 df04b0e4718c47e758d57cfa76f1ac94
- SHA1 a6c05b5b1ec6c29bb2b09d57908e71e558a2ca6f
- SHA512 9fbf702cc306bd2371cb9fdfb3aff6338a2c2054d97870d5e854c86ae516cc441c48b57386424e7a3b768a054c28035f7cadd52e6f7de6982aa527e68a35701b
- TLSH T106E0558A60ACCACDB20AE2214B5C1B34FB41B32B14E0B0B377928340AF06923EC75CC4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\hhdnet.inf_amd64_9bec1483b0e34704.ini
- Size 534B
- SHA256 2424c9a2782367fd498528a9586aa9e45be7700cd4e6ec99fcd96096fc9dd6ea
- MD5 44bf7df70c65c7718f696aeb6beb4bac
- SHA1 770b1e6f9d5e9f108fbdd4a2f505cb56b3c8783c
- SHA512 a841d667b568a4a3d6a34245180a5119fdf262e9a14e1b8a66e771aeffc511bc3e6e6323e98ccffcc5fb7e1d7600215445693ca860ca24daf5cde9612b44dce7
- TLSH T187F0F0C291BAE1ED76417661A3084F71CB01B16B2271D9E133C0CB004F17D86DDA8C54
- MD5 SHA1 SHA512 TLSH