Analysis
- user interaction
yes - max time kernel
365s - max time network
345s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/08/2026, 12:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
qudongjingling8 (3).msi
Resource
win10v2004-20260513-en
windows10-2004-x64
40 signatures
600 seconds
Behavioral task
behavioral2
Sample
qudongjingling8 (3).msi
Resource
win11-20260513-en
windows11-21h2-x64
36 signatures
600 seconds
General
- Target qudongjingling8 (3).msi
- Size 113.9MB
- Sample260804-pb4mvazbmg
- SHA256 ea2310616e800fd6e4567c9ea7d2854a34ee3dca483f7d97d310911dc5ae1e87
- MD5 d145252ac11967fa900441e15a58a4e2
- SHA1 9fbc613a30748776f529ef0d3558f1305a6c14db
- SHA512 2b3b794a27214cdeb3807bb2adc5225af85cdd3d4c880282a09abc7b7419ea9bd3a803cdd6032be03acad24d21ea49a0a1d01a39fb36e947346acf6cfc981df7
- SSDEEP 3145728:WqKzc79UEe57xHgHY/sr0LtfI9FG+ylBRlgCFx/PP0ux:WqKD5ZIr0ZwFG+uveAPPHx
- TLSH T1A848338725C66437E3E22E3C94B05724ED34BE18B321C9A787B1FC4973385B266BD15A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" DeviceSyncHost.exe - Drops file in Drivers directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\dgsafe.sys Setup.exe File created C:\Windows\system32\drivers\dgsafe.sys Setup.exe File opened for modification C:\Windows\SysWOW64\drivers\DgSafe.sys dgservice.exe File opened for modification C:\Windows\system32\drivers\DgSafe.sys dgservice.exe File created C:\Windows\system32\drivers\DgSafe.sys dgservice.exe File created C:\Windows\system32\drivers\ksapi64.sys dgservice.exe File created C:\Windows\system32\Drivers\kavbootc64.sys.T0 dgservice.exe File created C:\Windows\system32\drivers\bootsafe64.sys.tmp_0 Setup.exe - Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\kavbootc\ImagePath = "system32\\drivers\\kavbootc64.sys" dgservice.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\kavbootc\ImagePath = "system32\\drivers\\kavbootc64.sys" dgservice.exe - ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x001200000002ba53-1449.dat acprotect behavioral2/files/0x001200000002ba4e-1452.dat acprotect - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 28 IoCs
pid Process 1800 DeviceSyncHost.exe 4464 Setup.exe 3176 DeviceSyncHost.exe 1292 dgservice.exe 3624 dgutil.exe 5072 dgservice.exe 2012 ksyshelper.exe 2588 ksapi64.sys 1196 dgservice.exe 1064 dgservice.exe 2500 drivergenius.exe 5924 usbpnp.exe 6100 dgprotect.exe 4460 kvipgui.exe 5516 usbpnp.exe 2908 khwinfo64.sys 5560 dgprotect.exe 5016 drvinst64.exe 2672 Process not Found 2844 Process not Found 3632 Process not Found 6092 ksysslim.exe 5864 kdiskcleanup.exe 3344 Process not Found 3704 Process not Found 5256 kvipgui.exe 2352 drivergenius.exe 5980 dgutil.exe - Loads dropped DLL 64 IoCs
pid Process 656 MsiExec.exe 656 MsiExec.exe 656 MsiExec.exe 3600 MsiExec.exe 3600 MsiExec.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe 3624 dgutil.exe - Modifies system executable filetype association 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\kismenu_64bit dgprotect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\kismenu_64bit\ = "{9F79622A-09C0-433d-ACC5-7DD44573FB3E}" dgprotect.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 4 IoCs
description ioc Process File created C:\Program Files (x86)\MyDrivers\DriverGenius\desktop.ini Setup.exe File opened for modification C:\Program Files (x86)\MyDrivers\DriverGenius\desktop.ini Setup.exe File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini dgprotect.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-18\desktop.ini dgprotect.exe - Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: drivergenius.exe File opened (read-only) \??\F: dgprotect.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: drivergenius.exe File opened (read-only) \??\f: dgutil.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Power Settings 1 TTPs 22 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1860 powercfg.exe 2680 powercfg.exe 2032 powercfg.exe 4900 powercfg.exe 2444 powercfg.exe 876 powercfg.exe 4944 powercfg.exe 3968 powercfg.exe 1640 powercfg.exe 1112 powercfg.exe 4060 powercfg.exe 1832 powercfg.exe 3336 powercfg.exe 2476 powercfg.exe 3820 powercfg.exe 2448 powercfg.exe 1864 powercfg.exe 1004 powercfg.exe 2164 powercfg.exe 1644 powercfg.exe 3244 powercfg.exe 3476 powercfg.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 dgutil.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository drivergenius.exe File opened for modification C:\Windows\SysWOW64\cfg\dectcomp.dat drivergenius.exe -
resource yara_rule behavioral2/memory/4464-36-0x0000000000400000-0x0000000000546000-memory.dmp upx behavioral2/memory/4464-207-0x0000000000400000-0x0000000000546000-memory.dmp upx behavioral2/memory/4464-213-0x0000000000400000-0x0000000000546000-memory.dmp upx behavioral2/memory/4464-260-0x0000000000400000-0x0000000000546000-memory.dmp upx behavioral2/memory/4464-1348-0x0000000000400000-0x0000000000546000-memory.dmp upx behavioral2/files/0x001200000002ba53-1449.dat upx behavioral2/files/0x001200000002ba4e-1452.dat upx behavioral2/memory/1292-1617-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/3624-1691-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/3624-1690-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/1292-1623-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/3624-1739-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/3624-1738-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/2500-1759-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/2500-1764-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/1292-2170-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/5924-2169-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/5924-2168-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/1292-2167-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/6100-2384-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/4460-2412-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/4460-2413-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/2500-2440-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/5516-2439-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/5516-2473-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/5516-2474-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/5924-2564-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/2500-2559-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/5560-2560-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/5560-2658-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/5560-2659-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/6100-2742-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/6100-2741-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/4460-2897-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/2500-3011-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/2500-3010-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/4464-3108-0x0000000000400000-0x0000000000546000-memory.dmp upx behavioral2/memory/5864-3126-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/5864-3135-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/5864-3134-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/5256-3174-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/5256-3175-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/2352-3277-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/2352-3278-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/5980-3406-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/5980-3405-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx behavioral2/memory/5980-3424-0x0000000072AB0000-0x0000000072B58000-memory.dmp upx behavioral2/memory/5980-3423-0x0000000072B60000-0x0000000072C2A000-memory.dmp upx - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 3 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN Setup.exe File opened (read-only) \??\VBoxMiniRdrDN dgservice.exe File opened (read-only) \??\VBoxMiniRdrDN dgprotect.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\60047637.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\61000061.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\cfg\dgscript.ini Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ressrc\chs\delaydownloader.dat Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\rule.krf Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\xlmodule\download\xlbughandler.dll Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\security\kavbootc64_ev.sys Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\70003812.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\70007040.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\browser.dat Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\iglist.dat Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\kdiskcleanup.exe Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\kvipgui.exe Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\msvcp140_atomic_wait.dll Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\61000091.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\bootpop_rcmd_double12_2.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\vipsdk\vipapp_logo.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\kclearak.dat Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\api-ms-win-core-heap-l1-1-0.dll Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\kskinmgr.dll Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\e598f36.exe Setup.exe File opened for modification C:\Program Files (x86)\MyDrivers\DriverGenius\data\kinstalledsoftpurifyrecord.dat-journal dgprotect.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\61000094.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\70006818.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\qt5svg.dll Setup.exe File opened for modification C:\Program Files (x86)\MyDrivers\DriverGenius\data\cardicons\senlinshouhuzhe.png drivergenius.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\60037746.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ressrc\chs\dpisetting.ini Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\newrcmdlocalcfg.dat Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\icon\dn-1.png drivergenius.exe File opened for modification C:\Program Files (x86)\MyDrivers\DriverGenius\log\drivergenius.kvipsdk.dll.log drivergenius.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\60000043.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\91000004.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksyseng3.dll Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\xlmodule\xldl.dll Setup.exe File opened for modification C:\Program Files (x86)\MyDrivers\DriverGenius\data\icon\23.png drivergenius.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\nicdrvhelp\images\image002.jpg Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\60000141.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\70005443.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\html\images\barcode.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\hddscanner.exe Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\dgcore.dll Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\60000066.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\70000651.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\autorunkxetray_icon.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\cfg\dgcfg.ini Setup.exe File opened for modification C:\Program Files (x86)\MyDrivers\DriverGenius\data\icon\14.png drivergenius.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\kdumpcfg.dat Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\xlmodule\download\download_engine.dll Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\kadblock.dll Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\rcmdv2sp01\cfg\pic\taobao_1212_0.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\dpinst64.exe Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\api-ms-win-core-localization-l1-2-0.dll Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\60000678.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\70005120.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\rcmdv2sp01\cfg\pic\jskt_4.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\install.xml Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\lscripts\base\lsqlite3.l Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\softicon\softicon48\70006779.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\rcmdv2sp01\cfg\pic\dg_rcmd_subicon.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\qq_pcmgr_rcmd.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\rcmd_icon_sub_default.png Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\data\kvipapp_setting.ini Setup.exe File created C:\Program Files (x86)\MyDrivers\DriverGenius\kdupcleanup.dll Setup.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\inf\mdmvv.inf drivergenius.exe File opened for modification C:\Windows\inf\prnms012.inf drivergenius.exe File opened for modification C:\Windows\inf\ramdisk.inf drivergenius.exe File opened for modification C:\Windows\inf\virtdisk.PNF drivergenius.exe File opened for modification C:\Windows\inf\volume.inf drivergenius.exe File opened for modification C:\Windows\inf\wvmic_kvpexchange.inf drivergenius.exe File opened for modification C:\Windows\inf\intelpep.inf drivergenius.exe File opened for modification C:\Windows\inf\mdmcpv.inf drivergenius.exe File opened for modification C:\Windows\inf\mdmhandy.inf drivergenius.exe File opened for modification C:\Windows\inf\mdmpin.inf drivergenius.exe File opened for modification C:\Windows\inf\wfplwfs.inf drivergenius.exe File opened for modification C:\Windows\inf\amdsbs.inf drivergenius.exe File opened for modification C:\Windows\inf\cpu.PNF drivergenius.exe File opened for modification C:\Windows\inf\c_fscontinuousbackup.inf drivergenius.exe File opened for modification C:\Windows\inf\c_swdevice.inf drivergenius.exe File opened for modification C:\Windows\inf\intelpep.PNF drivergenius.exe File opened for modification C:\Windows\inf\mdmgen.inf drivergenius.exe File opened for modification C:\Windows\inf\sisraid4.inf drivergenius.exe File opened for modification C:\Windows\inf\xinputhid.PNF drivergenius.exe File opened for modification C:\Windows\inf\c_sbp2.inf drivergenius.exe File opened for modification C:\Windows\inf\iagpio.inf drivergenius.exe File opened for modification C:\Windows\inf\mdm5674a.inf drivergenius.exe File opened for modification C:\Windows\inf\mdmgl001.inf drivergenius.exe File opened for modification C:\Windows\inf\msgpiowin32.PNF drivergenius.exe File opened for modification C:\Windows\inf\netbc63a.inf drivergenius.exe File opened for modification C:\Windows\inf\netl160a.inf drivergenius.exe File opened for modification C:\Windows\inf\nett4x64.inf drivergenius.exe File opened for modification C:\Windows\inf\adp80xx.inf drivergenius.exe File opened for modification C:\Windows\inf\mdmtdkj2.inf drivergenius.exe File opened for modification C:\Windows\inf\microsoft_bluetooth_hfp_hf.inf drivergenius.exe File opened for modification C:\Windows\inf\netserv.inf drivergenius.exe File opened for modification C:\Windows\inf\netwmbclass.inf drivergenius.exe File opened for modification C:\Windows\inf\nvdimm.PNF drivergenius.exe File opened for modification C:\Windows\inf\scmvolume.inf drivergenius.exe File opened for modification C:\Windows\inf\wvmic.inf drivergenius.exe File created C:\Windows\SystemTemp\~DF80C9D56152F1B53B.TMP msiexec.exe File opened for modification C:\Windows\inf\c_wpd.inf drivergenius.exe File opened for modification C:\Windows\inf\uaspstor.inf drivergenius.exe File opened for modification C:\Windows\inf\umbus.PNF drivergenius.exe File opened for modification C:\Windows\inf\amdsata.inf drivergenius.exe File opened for modification C:\Windows\inf\c_scsiadapter.inf drivergenius.exe File opened for modification C:\Windows\inf\fusionv2.inf drivergenius.exe File opened for modification C:\Windows\inf\mdmadc.inf drivergenius.exe File opened for modification C:\Windows\inf\msports.inf drivergenius.exe File opened for modification C:\Windows\inf\mssmbios.inf drivergenius.exe File opened for modification C:\Windows\inf\printqueue.inf drivergenius.exe File opened for modification C:\Windows\inf\vca.inf drivergenius.exe File opened for modification C:\Windows\inf\battery.inf drivergenius.exe File opened for modification C:\Windows\inf\mdmmoto1.inf drivergenius.exe File opened for modification C:\Windows\inf\net2ic68.inf drivergenius.exe File opened for modification C:\Windows\inf\tpm.inf drivergenius.exe File opened for modification C:\Windows\inf\ufxchipidea.inf drivergenius.exe File opened for modification C:\Windows\inf\usbvideo.inf drivergenius.exe File opened for modification C:\Windows\inf\wvmbushid.inf drivergenius.exe File opened for modification C:\Windows\inf\circlass.PNF drivergenius.exe File opened for modification C:\Windows\inf\c_extension.inf drivergenius.exe File opened for modification C:\Windows\inf\c_sensor.inf drivergenius.exe File opened for modification C:\Windows\inf\rdshup.inf drivergenius.exe File opened for modification C:\Windows\inf\remoteposdrv.inf drivergenius.exe File opened for modification C:\Windows\inf\rtux64w10.inf drivergenius.exe File opened for modification C:\Windows\inf\usbcir.inf drivergenius.exe File opened for modification C:\Windows\inf\usbstor.inf drivergenius.exe File opened for modification C:\Windows\inf\c_memory.inf drivergenius.exe File opened for modification C:\Windows\inf\hvservice.inf drivergenius.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dgservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drivergenius.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language usbpnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kdiskcleanup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dgutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dgservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dgutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksyshelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language usbpnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dgprotect.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dgprotect.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksysslim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dgservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dgservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kvipgui.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drivergenius.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kvipgui.exe - Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName drivergenius.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg drivergenius.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dgservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs drivergenius.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dgservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc drivergenius.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg drivergenius.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs drivergenius.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007693c80d07c71b6c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007693c80d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007693c80d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7693c80d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7693c80d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID drivergenius.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags drivergenius.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 drivergenius.exe - Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dgprotect.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dgprotect.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dgservice.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dgservice.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Setup.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dgprotect.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName dgprotect.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dgservice.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName dgservice.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ drivergenius.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{0dc89376-0000-0000-0000-f0ff3a000000}\MaxCapacity = "2047" dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion kvipgui.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{53EA8E76-386A-4429-9956-8F3E9D646D76}\Shell\Delete\Command\ = "\"C:\\Program Files (x86)\\MyDrivers\\DriverGenius\\ksysslim.exe\" -delete_virtualdisk -report_virtualdisk:delete" kdiskcleanup.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{C0FEDCE5-5151-4a82-BB2A-90E7A2922C60} = "2" drivergenius.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dgprotect.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{3D8FEECD-D399-4e79-A3E3-FBD40514A0A8} = "1" drivergenius.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft kdiskcleanup.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{C76F2122-C246-4CD5-A405-4BC39D33355B} = "1" drivergenius.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{53EA8E76-386A-4429-9956-8F3E9D646D76}\DefaultIcon kdiskcleanup.exe Key created \REGISTRY\USER\.DEFAULT\Software drivergenius.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{B529D59C-0A8B-4d33-88A5-F6F36B72F7CE} = "1" drivergenius.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{53EA8E76-386A-4429-9956-8F3E9D646D76}\ = "C盘瘦身专家" kdiskcleanup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{53EA8E76-386A-4429-9956-8F3E9D646D76}\Shell\Delete\Command kdiskcleanup.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{53EA8E76-386A-4429-9956-8F3E9D646D76} kdiskcleanup.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{44C43C93-A8C3-4D84-A702-E42390B6C856} = "1" drivergenius.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{45E6BBDF-A4C8-4c10-AA4E-639A62EC2BD7} = "2" drivergenius.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{C628EB29-0FCE-493e-82A5-3CB80EC2379F} = "2" drivergenius.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE kvipgui.exe Key created \REGISTRY\USER\.DEFAULT\Software\MyDrivers\DriverGenius\magiccube dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dgprotect.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{53EA8E76-386A-4429-9956-8F3E9D646D76}\InfoTip = "一键解决C盘空间不足问题" kdiskcleanup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{53EA8E76-386A-4429-9956-8F3E9D646D76}\Shell\Open kdiskcleanup.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{0120C03F-5DAD-4ba2-BEF7-E12BDDC4E9CE} = "2" drivergenius.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{5805DDA3-9BD1-4ee4-9D8C-C19B406B30A4} = "1" drivergenius.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00300064006300380039003300370036002d0030003000300030002d0030003000300030002d0030003000300030002d006400300031003200300030003000300030003000300030007d00000030002c007b00300064006300380039003300370036002d0030003000300030002d0030003000300030002d0030003000300030002d006600300066006600330061003000300030003000300030007d0000000000 dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer kdiskcleanup.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{0dc89376-0000-0000-0000-f0ff3a000000}\NukeOnDelete = "0" dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT kvipgui.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\MyDrivers dgprotect.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" dgprotect.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{53EA8E76-386A-4429-9956-8F3E9D646D76}\TileInfo = "prop:System.ItemAuthors" kdiskcleanup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows kdiskcleanup.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{401FB46E-6C80-45cb-9C1F-AEFFD2EA278A} = "1" drivergenius.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{53EA8E76-386A-4429-9956-8F3E9D646D76}\Shell kdiskcleanup.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE kdiskcleanup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace kdiskcleanup.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{D9339F50-FE32-4489-9FAF-F0C0D7A30CBB} = "2" drivergenius.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{DCD9A274-B01C-4411-A40B-059C88E70CE2} = "2" drivergenius.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{DEDA92F4-C05C-44bb-8DA4-456779CFB214} = "1" drivergenius.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" drivergenius.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness kvipgui.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dgprotect.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{1C5523B5-F7C7-4abd-98F5-96936608C127} = "1" drivergenius.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{6F2942B1-698B-4fe0-84C6-336D3A2EE6BB} = "2" drivergenius.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings kvipgui.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dgprotect.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dgprotect.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{B4986DA7-1F72-49bc-98E5-6EDDE1FA547B} = "2" drivergenius.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\kingsoft\Antivirus\ABTest\{CFA7D410-4420-449c-9158-7841FC4F44AE} = "1" drivergenius.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shellex dgprotect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\kismenu_64bit\ = "{9F79622A-09C0-433d-ACC5-7DD44573FB3E}" dgprotect.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{9B4EEDF7-FC98-4fa0-8440-9D1BC57B5F2F}\user_type = "1" dgservice.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C5681C31399E8BC40807C94891E14376\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dgprotect\shell\open\command dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dgprotect\shell dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\Shellex\ContextMenuHandlers\kismenu_64bit dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{174D89F2-6321-428f-85C2-E1758DE1A258} Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0} dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F79622A-09C0-433d-ACC5-7DD44573FB3E} dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shellex\ContextMenuHandlers dgprotect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shellex\ContextMenuHandlers\kismenu_64bit\ = "{9F79622A-09C0-433d-ACC5-7DD44573FB3E}" dgprotect.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C5681C31399E8BC40807C94891E14376\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{174D89F2-6321-428f-85C2-E1758DE1A258}\Implemented Categories\{C702EE3D-6C27-442b-9619-5148EB18CF91}\idinst = "1" Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dgprotect\ = "URL:dgprotect Protocol" dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shellex\ContextMenuHandlers\kismenu_64bit dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53EA8E76-386A-4429-9956-8F3E9D646D76} kdiskcleanup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{9B4EEDF7-FC98-4fa0-8440-9D1BC57B5F2F}\time = "1785845744" dgservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C5681C31399E8BC40807C94891E14376 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C5681C31399E8BC40807C94891E14376\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dgprotect\shell\open\command\ = "C:\\Program Files (x86)\\MyDrivers\\DriverGenius\\dgprotect.exe %1" dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers dgprotect.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53EA8E76-386A-4429-9956-8F3E9D646D76}\FromProductId = "2" kdiskcleanup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C5681C31399E8BC40807C94891E14376\PackageCode = "20B81EE908F8804478C5E3C876170FD4" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C5681C31399E8BC40807C94891E14376\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{174D89F2-6321-428f-85C2-E1758DE1A258}\Implemented Categories\{C702EE3D-6C27-442b-9619-5148EB18CF91} Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID dgprotect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F79622A-09C0-433d-ACC5-7DD44573FB3E}\InprocServer32\ = "C:\\Program Files (x86)\\MyDrivers\\DriverGenius\\kismenu64.dll" dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E} dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\kismenu_64bit dgprotect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command\ = "%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,OpenAs_RunDLL %1" dgprotect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\kismenu_64bit\ = "{9F79622A-09C0-433d-ACC5-7DD44573FB3E}" dgprotect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command\DelegateExecute = "{e44e9428-bdbc-4987-a099-40dc8fd255e7}" dgprotect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{9B4EEDF7-FC98-4fa0-8440-9D1BC57B5F2F}\desc = "eyJkYXRlIjoiMjAyNi0wOC0wNCJ9" dgservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C5681C31399E8BC40807C94891E14376\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7CCF219-E9DC-4341-AE33-99DC5E38BE4C}\INSTTIME = "1785845554" Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\Shellex\ContextMenuHandlers\kismenu_64bit dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C5681C31399E8BC40807C94891E14376 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\kismenu_64bit\ = "{9F79622A-09C0-433d-ACC5-7DD44573FB3E}" dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D} dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID dgprotect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\kismenu_64bit\ = "{9F79622A-09C0-433d-ACC5-7DD44573FB3E}" dgprotect.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C5681C31399E8BC40807C94891E14376\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA2C4E8A2599B6405B47F0F0148E9C1A\C5681C31399E8BC40807C94891E14376 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C5681C31399E8BC40807C94891E14376\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{9B4EEDF7-FC98-4fa0-8440-9D1BC57B5F2F} dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node dgprotect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\kismenu_64bit\ = "{9F79622A-09C0-433d-ACC5-7DD44573FB3E}" dgprotect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C5681C31399E8BC40807C94891E14376\ProductName = "qudongjingling" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA2C4E8A2599B6405B47F0F0148E9C1A msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C5681C31399E8BC40807C94891E14376\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34CCA881-939B-419a-A76E-6E109B8EC7DF} dgservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dgprotect dgprotect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F79622A-09C0-433d-ACC5-7DD44573FB3E}\InprocServer32\ThreadingModel = "Apartment" dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{174D89F2-6321-428f-85C2-E1758DE1A258}\Implemented Categories Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\kismenu_64bit dgprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{9B4EEDF7-FC98-4fa0-8440-9D1BC57B5F2F} dgservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C5681C31399E8BC40807C94891E14376\Main msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C5681C31399E8BC40807C94891E14376\SourceList\Media\1 = ";" msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3268 msiexec.exe 3268 msiexec.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 4464 Setup.exe 4464 Setup.exe 4464 Setup.exe 4464 Setup.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 3176 DeviceSyncHost.exe 3176 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1800 DeviceSyncHost.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe 1292 dgservice.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3216 Process not Found - Suspicious behavior: LoadsDriver 11 IoCs
pid Process 676 Process not Found 4464 Setup.exe 676 Process not Found 676 Process not Found 1292 dgservice.exe 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4440 msiexec.exe Token: SeIncreaseQuotaPrivilege 4440 msiexec.exe Token: SeSecurityPrivilege 3268 msiexec.exe Token: SeCreateTokenPrivilege 4440 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4440 msiexec.exe Token: SeLockMemoryPrivilege 4440 msiexec.exe Token: SeIncreaseQuotaPrivilege 4440 msiexec.exe Token: SeMachineAccountPrivilege 4440 msiexec.exe Token: SeTcbPrivilege 4440 msiexec.exe Token: SeSecurityPrivilege 4440 msiexec.exe Token: SeTakeOwnershipPrivilege 4440 msiexec.exe Token: SeLoadDriverPrivilege 4440 msiexec.exe Token: SeSystemProfilePrivilege 4440 msiexec.exe Token: SeSystemtimePrivilege 4440 msiexec.exe Token: SeProfSingleProcessPrivilege 4440 msiexec.exe Token: SeIncBasePriorityPrivilege 4440 msiexec.exe Token: SeCreatePagefilePrivilege 4440 msiexec.exe Token: SeCreatePermanentPrivilege 4440 msiexec.exe Token: SeBackupPrivilege 4440 msiexec.exe Token: SeRestorePrivilege 4440 msiexec.exe Token: SeShutdownPrivilege 4440 msiexec.exe Token: SeDebugPrivilege 4440 msiexec.exe Token: SeAuditPrivilege 4440 msiexec.exe Token: SeSystemEnvironmentPrivilege 4440 msiexec.exe Token: SeChangeNotifyPrivilege 4440 msiexec.exe Token: SeRemoteShutdownPrivilege 4440 msiexec.exe Token: SeUndockPrivilege 4440 msiexec.exe Token: SeSyncAgentPrivilege 4440 msiexec.exe Token: SeEnableDelegationPrivilege 4440 msiexec.exe Token: SeManageVolumePrivilege 4440 msiexec.exe Token: SeImpersonatePrivilege 4440 msiexec.exe Token: SeCreateGlobalPrivilege 4440 msiexec.exe Token: SeBackupPrivilege 2776 vssvc.exe Token: SeRestorePrivilege 2776 vssvc.exe Token: SeAuditPrivilege 2776 vssvc.exe Token: SeBackupPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeShutdownPrivilege 3600 MsiExec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeDebugPrivilege 4464 Setup.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 4440 msiexec.exe 4440 msiexec.exe 5924 usbpnp.exe 6100 dgprotect.exe 6100 dgprotect.exe 6100 dgprotect.exe 6100 dgprotect.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5924 usbpnp.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1292 dgservice.exe 3216 Process not Found 3216 Process not Found - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3216 Process not Found - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 3268 wrote to memory of 724 3268 msiexec.exe 85 PID 3268 wrote to memory of 656 3268 msiexec.exe 87 PID 3268 wrote to memory of 3600 3268 msiexec.exe 131 PID 3268 wrote to memory of 4464 3268 msiexec.exe 90 PID 1800 wrote to memory of 1004 1800 DeviceSyncHost.exe 91 PID 1800 wrote to memory of 1860 1800 DeviceSyncHost.exe 93 PID 1800 wrote to memory of 2164 1800 DeviceSyncHost.exe 95 PID 1800 wrote to memory of 4944 1800 DeviceSyncHost.exe 97 PID 1800 wrote to memory of 3336 1800 DeviceSyncHost.exe 99 PID 1800 wrote to memory of 3968 1800 DeviceSyncHost.exe 101 PID 1800 wrote to memory of 2680 1800 DeviceSyncHost.exe 103 PID 1800 wrote to memory of 1644 1800 DeviceSyncHost.exe 105 PID 1800 wrote to memory of 2476 1800 DeviceSyncHost.exe 107 PID 1800 wrote to memory of 3820 1800 DeviceSyncHost.exe 109 PID 1800 wrote to memory of 1640 1800 DeviceSyncHost.exe 111 PID 1800 wrote to memory of 3176 1800 DeviceSyncHost.exe 113 PID 1800 wrote to memory of 1832 1800 DeviceSyncHost.exe 114 PID 1800 wrote to memory of 2448 1800 DeviceSyncHost.exe 116 PID 1800 wrote to memory of 876 1800 DeviceSyncHost.exe 118 PID 1800 wrote to memory of 4060 1800 DeviceSyncHost.exe 120 PID 1800 wrote to memory of 3476 1800 DeviceSyncHost.exe 122 PID 1800 wrote to memory of 2444 1800 DeviceSyncHost.exe 124 PID 1800 wrote to memory of 1112 1800 DeviceSyncHost.exe 126 PID 1800 wrote to memory of 3244 1800 DeviceSyncHost.exe 128 PID 1800 wrote to memory of 4900 1800 DeviceSyncHost.exe 130 PID 1800 wrote to memory of 1864 1800 DeviceSyncHost.exe 132 PID 1800 wrote to memory of 2032 1800 DeviceSyncHost.exe 134 PID 1292 wrote to memory of 3624 1292 dgservice.exe 139 PID 4464 wrote to memory of 5072 4464 Setup.exe 140 PID 1292 wrote to memory of 2012 1292 dgservice.exe 143 PID 4464 wrote to memory of 1196 4464 Setup.exe 146 PID 4464 wrote to memory of 2500 4464 Setup.exe 148 PID 4464 wrote to memory of 5924 4464 Setup.exe 152 PID 2500 wrote to memory of 6100 2500 drivergenius.exe 154 PID 6100 wrote to memory of 4460 6100 dgprotect.exe 155 PID 6100 wrote to memory of 5516 6100 dgprotect.exe 157 PID 1292 wrote to memory of 5560 1292 dgservice.exe 160 PID 1292 wrote to memory of 5016 1292 dgservice.exe 162 PID 3216 wrote to memory of 6028 3216 Process not Found PID 6100 wrote to memory of 6092 6100 dgprotect.exe 164 PID 6092 wrote to memory of 5864 6092 ksysslim.exe 165 PID 4460 wrote to memory of 5256 4460 kvipgui.exe 166 PID 1292 wrote to memory of 2352 1292 dgservice.exe 167 PID 1292 wrote to memory of 5980 1292 dgservice.exe 168 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" DeviceSyncHost.exe - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\qudongjingling8 (3).msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4440
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:724
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A2F970EDA5101D41A288E1EB8E39D9922⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:656
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 995FDDE2C4BD26E678E54F36D31FD2CB E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3600
-
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Program Files (x86)\MyDrivers\DriverGenius\dgservice.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\dgservice.exe" -RegServer3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5072
-
-
C:\Program Files (x86)\MyDrivers\DriverGenius\dgservice.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\dgservice.exe" -Service3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1196
-
-
C:\Program Files (x86)\MyDrivers\DriverGenius\drivergenius.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\drivergenius.exe" -enterdriverpage -from=10003⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Program Files (x86)\MyDrivers\DriverGenius\dgprotect.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\dgprotect.exe"4⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Program Files (x86)\MyDrivers\DriverGenius\kvipgui.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\kvipgui.exe" --pid=2 --open_web=main --vipfrom=1 --preload_by_pid=61005⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Program Files (x86)\MyDrivers\DriverGenius\kvipgui.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\kvipgui.exe" --type=utility --channel="4460.0.1283993662\1135633546" --lang=en-US --no-sandbox --no-sandbox --lang=zh-CN --log-file="C:\Program Files (x86)\MyDrivers\DriverGenius\log\kvipgui.exe.log" --log-severity=error --pid=2 /prefetch:86⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5256
-
-
-
C:\Program Files (x86)\MyDrivers\DriverGenius\usbpnp.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\usbpnp.exe" InstallAndUpdate*5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5516
-
-
C:\Program Files (x86)\MyDrivers\DriverGenius\ksysslim.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\ksysslim.exe" -create_virtualdisk5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Program Files (x86)\MyDrivers\DriverGenius\kdiskcleanup.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\kdiskcleanup.exe" -create_virtualdisk /tab:16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5864
-
-
-
-
-
C:\Program Files (x86)\MyDrivers\DriverGenius\usbpnp.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\usbpnp.exe" InstallAndUpdate* /inst3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5924
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exeC:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe1⤵
- UAC bypass
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1800 -
C:\Windows\system32\powercfg.exepowercfg.exe /change standby-timeout-ac 02⤵
- Power Settings
PID:1004
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /change standby-timeout-dc 02⤵
- Power Settings
PID:1860
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /change monitor-timeout-ac 02⤵
- Power Settings
PID:2164
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /change monitor-timeout-dc 02⤵
- Power Settings
PID:4944
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /change hibernate-timeout-ac 02⤵
- Power Settings
PID:3336
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /change hibernate-timeout-dc 02⤵
- Power Settings
PID:3968
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /setacvalueindex SCHEME_CURRENT SUB_SLEEP UNATTENDSLEEP 02⤵
- Power Settings
PID:2680
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /setdcvalueindex SCHEME_CURRENT SUB_SLEEP UNATTENDSLEEP 02⤵
- Power Settings
PID:1644
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /setactive SCHEME_CURRENT2⤵
- Power Settings
PID:2476
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /getactivescheme2⤵
- Power Settings
PID:3820
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /requests2⤵
- Power Settings
PID:1640
-
-
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exeC:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe user-session --session-id 1 --parent-hwid e696b35ebe3a7e2e955eeac51458b4f72⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3176
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /change standby-timeout-ac 02⤵
- Power Settings
PID:1832
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /change standby-timeout-dc 02⤵
- Power Settings
PID:2448
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /change monitor-timeout-ac 02⤵
- Power Settings
PID:876
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /change monitor-timeout-dc 02⤵
- Power Settings
PID:4060
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /change hibernate-timeout-ac 02⤵
- Power Settings
PID:3476
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /change hibernate-timeout-dc 02⤵
- Power Settings
PID:2444
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /setacvalueindex SCHEME_CURRENT SUB_SLEEP UNATTENDSLEEP 02⤵
- Power Settings
PID:1112
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /setdcvalueindex SCHEME_CURRENT SUB_SLEEP UNATTENDSLEEP 02⤵
- Power Settings
PID:3244
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /setactive SCHEME_CURRENT2⤵
- Power Settings
PID:4900 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3600
-
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /getactivescheme2⤵
- Power Settings
PID:1864
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /requests2⤵
- Power Settings
PID:2032
-
-
C:\Program Files (x86)\MyDrivers\DriverGenius\dgservice.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\dgservice.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks for VirtualBox DLLs, possible anti-VM trick
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Program Files (x86)\MyDrivers\DriverGenius\dgutil.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\dgutil.exe" -uninstallrepair2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3624
-
-
C:\Program Files (x86)\MyDrivers\DriverGenius\ksyshelper.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\ksyshelper.exe" /update_magiccube2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2012
-
-
C:\Program Files (x86)\MyDrivers\DriverGenius\dgprotect.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\dgprotect.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5560
-
-
C:\Program Files (x86)\MyDrivers\DriverGenius\drvinst64.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\drvinst64.exe" -r abcde2⤵
- Executes dropped EXE
PID:5016
-
-
C:\Program Files (x86)\MyDrivers\DriverGenius\drivergenius.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\drivergenius.exe" -geterrdriver2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:2352
-
-
C:\Program Files (x86)\MyDrivers\DriverGenius\dgutil.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\dgutil.exe" -diskscan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:5980
-
-
C:\Windows\system32\drivers\ksapi64.sysC:\Windows\system32\drivers\ksapi64.sys1⤵
- Executes dropped EXE
PID:2588
-
C:\Program Files (x86)\MyDrivers\DriverGenius\dgservice.exe"C:\Program Files (x86)\MyDrivers\DriverGenius\dgservice.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1064
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:4348
-
C:\Program Files (x86)\MyDrivers\DriverGenius\khwinfo64.sys"C:\Program Files (x86)\MyDrivers\DriverGenius\khwinfo64.sys"1⤵
- Executes dropped EXE
PID:2908
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Power Settings
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58b523.rbs
- Size 505KB
- SHA256 5584af46d5214139e4e33203eb67668e4a02b840152073c94e617c72da87fa01
- MD5 1f996a6cb12dcdbc8742fe87b9803846
- SHA1 2d19d876fff70a9ee79e5b3e0a5a718796beeba9
- SHA512 c186bb6d34f979ac0b0ba2a7daf5932d032943e213cf793e276f662304d070e4860410cb183a6c16dd40cc3135de5c17df67d60f2f7ac9f0d2f9f1d1157912ca
- SSDEEP 6144:oqFh6H2Usw/QIZDrFGMU3usoO0Ey21WJC/3kZTDOR2R7MY9AgMMh3HO9NMu:t/6WUFZ03uz6R1WJ+ITDOgZ9AgMkuMu
- TLSH T1FEB47C25B052207BE6FA0D32F524CB706E3DB62467D8899F83D0884E7D245D36EB771A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\PatchCore.dll
- Size 685KB
- SHA256 5382ee703c7f31d0b3d21a3dd1f7b6296a0dbd2a0867c26da5d46ceb93e8550b
- MD5 e28b4fff9664f6214345945eacd0cad5
- SHA1 e2d19d0d52724fa9d9fdbbb84d2ed5f80263346e
- SHA512 d12f336378ced9c0a2c992d139f7fa612b24851d57ca65612de934dae772034b52bf07d980650f0c6fd7d1fccfb7820e1bc65d9d976ddda1c27dc80ea0326af9
- SSDEEP 12288:wRnwINABmqBQxzpkmPtRNSqgiC6RSc4yp/NsE4r/K:MrABmqulfbO6xNv4r/K
- TLSH T17CE46B12B741C036F9BF01B6857E4A7EA56CBEB01B6450C7A3C47D8E1AB09D36B31617
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\PnpSup.dll
- Size 1.3MB
- SHA256 69c3a1b675e0e4e3fdc868ef0410dbc12254e4ae9256de5b2b785fc34ee413d6
- MD5 87010a7b4878045d2e7d76d190b9fa2e
- SHA1 c46397b9c8f127ad1f632f956514584ee9dd39f0
- SHA512 17e26b0603208b28384bd06920deb08c387d361051faea7a7b081e9931b9572fc89cf88e1dde8922a38e548d53ffb8d0e023e77fb2d02a3d911111f8e12ae7af
- SSDEEP 24576:wPMQiC7X43FN0D+ErSyVWh0CDyudeR3Tfx5qQ0ho/Au9eS8E2UO:wkQioIw+EGy8+CDyuCuo4Upt2UO
- TLSH T10055BE123781C072E1AE03B1D91AD72969BDEC204B3189D7BBD47ADC6E749C399367C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\cfg\dectcomp.dat
- Size 107B
- SHA256 698c26766766b32e19567cf32d661f50712a694a5b666e49d5b5f3dd13ac5f66
- MD5 6590bb396e8c640b2d8a18fd3da6c857
- SHA1 2fe25ed75e2bb4615c14ef91037b07767fc22831
- SHA512 fa68e314211d0ab789ee0d3c2c8ea4f2a00a908b381c0163b2e650b38b375bb7784ce52c4b606fb9e02231521381f5d357023125ca0a6e71b43b5204ab84d34f
- TLSH T1C3B012C2C2A60CC4C0C305350C33810D04747284C0F340082A0EC11C1512D137226809
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\cfg\dectcomp.dat
- Size 130B
- SHA256 6d3121cb0a05cb402bca329ea8cf13738ed4e5a797c2944a0324a5d8b4c6f5f8
- MD5 556408916baec20c52f0cc958756bcb3
- SHA1 6c9e45b12cf5a1d31c6813e934e9aca7f3e45d77
- SHA512 0dd0d41c3faa0c58798e998c17be15dedfb80dbf398915fd8ac630211eed1e1486175be297b78d0d9fa17eb08a86507ec13b42a170e38b30964ea9c5ede87f9e
- TLSH T197C092A14AA340C2C1C300050C37BC8188AC7D87C4E7400F3E1FE1B05602D26C16CDE5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\cfg\dectcomp.dat
- Size 130B
- SHA256 cb71a6f602bb1d0582574bd2a2e29821364ef15ee303effbeb2c92510a942526
- MD5 bc6f869458b1f293a242ed073db1f080
- SHA1 1e9629f4dd7043574d6377899429001eaf55b2ad
- SHA512 f0e1ad99b3843873910f30b2cded6810b421468b9383bf3192e2f7c250e84b13076c98a23804e24abb44ab043660ddb3f5a821c14416454599858eb04f640fe7
- TLSH T15AC092C286AA0C94C0C205350C378D8E44746A87C4F7400B2A1FD1386612D23726A8A9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\cfg\dghmpg.ini
- Size 23B
- SHA256 2140e3eb93139cdb57836e5ddabbdce2e31b529dabefa77657835b012cc9189e
- MD5 bf38d64a730963042f5a30570240f0a1
- SHA1 8c5b09825c7d7c39988d0a64c96ff3b027aa936b
- SHA512 a65e6b8d19aad7ab6e527cde4ff4009fe12dc70a59ba47a50c738c33da60c33993a0a50e71e559cceb69acd63fcbd169bcdbc4ac18f77ea05ceac708b1f3febd
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\cfg\dghwtool.ini
- Size 57B
- SHA256 e8d1ef42985d678ed5e0a00292f2bbcecb677657a40098737e719cea6621968d
- MD5 9c2c270adfc28180883c41cac1257ae9
- SHA1 08e8c8fa80d7a4c2524899dddf8da6308ee08a68
- SHA512 c13ab5b9837530ac3e98947494810f2119345e9ec5b78a4f795e81e5d63023526b9a98596d0bbb6cdfea3e8cfdc2a9231cbcf447f1622a571b9436246239f839
- TLSH T1B89002FB8D52A44781985020007911C070C9012458848210D10A546D8FA26D70BDA1E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\cfg\dgspcfg.ini
- Size 17B
- SHA256 1dda0e0605ebbf18d2cf81b52730c994135c5fa6e6da617f1309147e03a7aa51
- MD5 653b3de17dfff505ea5e9808c572b8b2
- SHA1 ee190169b14d0d2f0580ff412e2e90f0f5df504f
- SHA512 247eb21f59acd9adc3930d2431fdcf401661dfa7a587b707b40a11e5adcc4d1ffc393b4b1998217a4270136c6dca7d47e15b5d69fe2d4db0b90a493941b0d48c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\cfg\hdinfo.ini
- Size 166B
- SHA256 c9b15eea0f89e87824b6f223c46cd4577ffb6851d48908d699bb0a1b075cff89
- MD5 7c2c7c333dd07b712afe88e15528cd3c
- SHA1 f6be5e883c299f9dacfe7440d2564e43394b39b9
- SHA512 1d813b674188eca5a2f04d3e68c5184fae741a0a3f335763fd02c1eccec3c8787db775219731ba3933889a80cb9321111e46f5c1750d7463d5f9e34263d2b43b
- TLSH T13DC08C9173EC84C820563E70A210C9843ADBC5218162847928AEA04F6B488C474AC0C0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\cfg\kccfg.ini
- Size 40B
- SHA256 f00f6e1904145df1725eaf37ad33c78ce3f4cb9868fc4dd4c28c8dd0e3c9b8e6
- MD5 ad6f4fae6a1ae1256ce9f4845729a1b1
- SHA1 702d49764ebd9747a7ee3640ee3f64dc70e86847
- SHA512 44659c07e53708a17e721ee395b5377ee5b488dd343702f4a2e54338e917617528d57ef83c3f8a1edfc9d23af8effb6a0627b4d029564f9ecdf5e0a549404ab1
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\config.ini
- Size 1KB
- SHA256 6db6cc34521f83ef3f006ff1b3ecede1b8b987f88cfbe16448d7363d83b1b14c
- MD5 99d982e0436e8fab42b56e3c589cef21
- SHA1 c64e6b1871ea17cd3f04844eae3cb3d285b19750
- SHA512 ba825e5df236d96b34ea6ecba72e419d8cb891ebb82c25643502fac66a065436984e116c86087fb965ae0a891fe364a541cfe295bb6629c6d9f43ca36d9864f5
- TLSH T1122112681D24CD9D597475C824B3108D4FD76E49A07082AD37BCD4899F9D83F275D07B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\config.ini
- Size 1KB
- SHA256 7ef8a6f195ac5814c829a98dad8c69d09cf6fb6010ec6f54be8a45c07e5da797
- MD5 b6f7a7f4e21062983c8c0440fded06c8
- SHA1 63feedad2062ff4e0c30a2482ba60939efde5520
- SHA512 9aa1a2afec7989556f5db4859694e4ff093c5721585ff9402f107ad691d483e1a38d5a1a65405aa1da12d019079d4a0fa3c93de6a12b205565500a9c2c613980
- TLSH T1BA2144680C34CD9D497475C461B2014D5FD76E85E4B081A837BCD4899F9DC3F165D0B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\config.ini
- Size 1KB
- SHA256 7acdafb9137cf349f3860c0cd6813d7efdac41f4dbee82876e705ffaed61ccb5
- MD5 9a738fca5f04baadb4b047d4f63f6c81
- SHA1 2b7d63f2dff777c6e98158e5718ff0a1d858e148
- SHA512 200fae925b6a405d4a473f5c1168057db30a32f79adece9d3b1b56c309442b4bbb8ab01a015e136027f9613095833ca93265ecf8e3580e20f35164a7495827fb
- TLSH T1DF2174680C34CE9D097475C860B2014C5FDB6E85E4B081AC33BCE48A9F9CC7F265D0BA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\config.ini
- Size 1KB
- SHA256 73bb1c2d45213e8b83a9230536824fff4dcc493e706830e92e0cc8c3652131ae
- MD5 2895a6a5e2f3e11cab93fefbd08ee052
- SHA1 6f5bfbd9c88e703c1613601fb2cab6094cef8290
- SHA512 969dc7459cbb372c00558e4f4d4ae1695952480c427d2ed422770cfeb56669c03898806575a083b2b84efd554bbf977527ef109052f9a5334b1d635faf76e998
- TLSH T1A02174680D34CEAD4A7475C420B2018D5FD76E85E4B081A837BCE8899F9CC3F2A5D0B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\config.ini
- Size 1KB
- SHA256 3440a092096a201f2bb403123a46489db17aaaec4978985e90353b8c0c985ebe
- MD5 71bb0ece05dce1dd649dd2f02ab7c27d
- SHA1 1b3f6b30dc78339fca8ef4fed6e70fe876848f61
- SHA512 ba7f259119af3a459774b12b291c6709f741776a0e257c3496e083ba718d519cba058c0bd5c6cacc4ddf1e744761307ee6f460eb7633237dbe7eebb536ebb2a1
- TLSH T18E2172680D25CEAD497474D421B2018D5FD66B85A07081A837BCE8898FEDC3F2A5D0BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\config.ini
- Size 1KB
- SHA256 5f24e3b9ae87bdf2dfb163c45b24323e029ac49495395636e74496e3dc45767f
- MD5 3df0d5d3316b01d08eed208c022b4017
- SHA1 e3f96a23f39efdfcba1f5f0be43a6acf9c43a10f
- SHA512 8d9001edb659f53f2c55fab5ca2f28098ab08e138c407ee9902b8bf38c45fc7ed11371a32257620ba88097372316a66bb9604d8e4c8bcb16d1a49cb50bf5ad39
- TLSH T1172153780D25CD6D497475D821B3018DABD65A8590B081A837BCE8899FADC3F2A4D0BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\config.ini
- Size 1KB
- SHA256 8c6366bff87fdea8125332dad34bbf889cee940fe02a4f9585f6e5465deb2132
- MD5 f5459a9dd7c9e074b25407331318683a
- SHA1 7e5057f6d96566ab725d8290348f9bb51b88be03
- SHA512 753dbe7b3cd8fc404be120a5ec4cf3a9126d08e87de4009e6239d4f380e55e118f7e6a1f3b66850748cd6751feae5cdf23186e2789ca9aa31af82cfa094d73d5
- TLSH T1BC3163780D29CD6D493475D821B3018CAFDA5B8594B081A837BCA8899FEDC3F2A4D07B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\config.ini
- Size 1KB
- SHA256 5c4e4168709b0d7c300cf063c31dc435b43e5e8a311e8a96387ad256c81e94dd
- MD5 f33ab47fbfa2f2f50a9021baee8d285c
- SHA1 81fb01989d61449cec19d4d27d72a40cdfb41491
- SHA512 d2d47d2aab543bb8b9a772db3d603fe7974159543e8b74d66848965bdc48c62660892b2a066f9b6a02280f4a478e99da7e5275a4a94338dd2c64ab7b2b1dc790
- TLSH T1EF3144780D25CD6D4974B5D82172018CABD65B8594B081A837BCE8899FEDC3F2A4D0BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\config.ini
- Size 1KB
- SHA256 6be3d82cd2f3d7abf5dfc2c2cc6d90fd7687a09d78381a0488c39801fd7702bc
- MD5 aaecb440fb48cbe8a2f5e8fcaa896431
- SHA1 b4e4514bfa8cf88f95b189a325688fddae4e341d
- SHA512 cd7587602c83cd4fb8c388b72cca44065b36bd5d1cf70af3024cadd93e7f967cdc38ab63ad34c08a0b1ad15ae0eee345eb6e4da3a62e298400be4429773c59b6
- TLSH T1773154780E29CD6D4974B5D8217201CCABD65B85A5B0416833BCE8895FADC3F1A4D0BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\config.ini
- Size 1KB
- SHA256 d859154dc8873634e8d871cb896793fba3043a0818feb6c95f77a4e7f9da34bd
- MD5 b90947a5d14c4d64d4dff225a45747b1
- SHA1 4e4abb1581db2d31160d1533c21319aab3b47c1d
- SHA512 18ce0bcab1d2a464ad52be3d73d5ad8a3c1533a1a2ff20f9ca6fcdcda776b1764ee73c34d399a1d1c65955a83892929b0e2190e00796ff42a9954bbf1503994c
- TLSH T1BE3172784E25C96E84B0B9E821B202CC9BCA6B41A170417437EDB88E4FAC87E154E0B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\config.ini
- Size 1KB
- SHA256 6d63c2fd10670273e53775272eaf7f779afccdbc88e51a71b6e7d779afe7b60c
- MD5 d3802212ac3d5cc37f8b532e839c60b4
- SHA1 b0657759224fac9465c5fd0ab09a015683294b0c
- SHA512 6a2c2015da1f36c01c5a0fee67660100d807c40f3376c4b61af30a8ee06123d72bed5e847a182f3819e27c1e8eb1136753914dd0d1fcbfe4a6e4a2c1612a0edf
- TLSH T18041A5784E25C9AE8470B5E821B302DC5BCA5B41B570417433EDB88E4FAC97E154E0B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\data\gp.dat
- Size 493KB
- SHA256 b2e4d01d21dbe9ad54225338fb0c034420822c4ac42105fa90d4af2fee24e3f8
- MD5 08084f985368236f13e0576bdf894004
- SHA1 ec664537add725da5077e664754064b757dcae2f
- SHA512 a36a2560f9caea51092d6c42c313f94dd4860e3d95d852e48f5d1e14df007cd331d3c39913a85de820f851d23c3cd992b4bd2b518d16c14af3dee1e6bf51f03f
- SSDEEP 1536:iRCXmvM/AP7gWsTHjoEvKRu9eZgs3vhIpSpXp:ivAAX+kEvKRpgs/hIM
- TLSH T1E0B48F27C5585C5924B5A2543A542B03F8E79F1F82811D2B3DFC87AC5F3DE29818AF2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\data\icon\21.png
- Size 17KB
- SHA256 e081878f328b1c75f69f52e763a9d94c477db3edfd61c6145b8cc1f15b98b86c
- MD5 4e458cfc7ae156204cbdc5b227b53662
- SHA1 01df213c05fc5c89be35b29d0a7d2fd9a3d7f2b2
- SHA512 f0861ea7bf313afa68d3323491f1ae459eb3607e853b7d0505aeea5ac6502aae9552e7a63bf98939431d94ee54881993182c626953d9a00ef5eab04e62ec3127
- SSDEEP 96:A3kEWRGxNXBvvFCcXpt3J9gkB71u7dzayM02kOKoasU4jtHc:A3ktcvLtMQBuNayM02kOisJc
- TLSH T128821760ECF1BA209009E136BED06941A9730A43C9E15D82F6CE9C577F10BAA8C4F747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\data\icon\60.png
- Size 3KB
- SHA256 a16bdb6ebfe4b5a00568fcdd5ad6eaf9ebb848b2fc247009ec668cba182b7577
- MD5 8f11e102423496d2d796eba1dc52ff84
- SHA1 327568d40347d9bdc48e63825fcf799b1bf8e590
- SHA512 caa8c686f1aaf1f79a4b01e18645ec2d98a2fa35ec932803f8c6998e091b0492c83f28feb3dd0b162d933d1a022466129fbb718132db822fa67171d622d4d2a5
- TLSH T1D3815BEB98A132A2FDC81D71D52062BEF4ABF0E0869DC1B730A111F244A9247275AB51
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\data\icon\61.png
- Size 2KB
- SHA256 897b917d4c75b357153def80b46daf8da254bf10440902ba02df0f771669fb03
- MD5 8fed0c0ae658aa5fbb8468a532476b66
- SHA1 c1f9daf4e571fad4f5c9ff9d4d36f8633b9cf473
- SHA512 a62ed122a75c0cd127fdafc725e5a84583655de36ecf8aa31cafa74d70c42950bc668a6529254e7dd652ee4b51e4e95bfb2e9a3647ed038dd2a5b40355e4aed7
- TLSH T1C5413AF3F2AEBD66DC2195B1E83C6C406A306738F491D3A22E20AA30D0BDA01665F351
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\data\ksyscfg.ini
- Size 143B
- SHA256 6fcb114f8ea588936a3bf7cb74026c61161b6ccf544ee18b2ae67657308ea908
- MD5 9314778026cf676c671fc11dd7438133
- SHA1 c536bd5520f8e97096404023b4809a486d7658ed
- SHA512 06f7cd0fc2ebe6c1d3a99ad7d0052d83cc99ec7a39b49a16f59ba81bacaf8ed0f4da008c3b7d5615b887fb5008f028f713eb6efbdeb2428892f864fee858db55
- TLSH T15DC08C9A8F8EF258C121BCC80EB909C9600007C17B0244240E0221182D30028660DA1F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\data\magiccube_version.dat.tmp
- Size 124B
- SHA256 78d26edd18cd50813dd81ab45161d0e227511d792db1088eecc629ed3a93f2dc
- MD5 e66880aba3af9167ac14667d2446f7c0
- SHA1 9e80cab1b3336a5aeb2e0491431617d312f27e56
- SHA512 58f5db86d1848bfcb9d5cab3e3c17aff4191ce8b98c1e470d8cae92f0198882b697d8210c727102eac1fe4f5bb1893e8aaec4ef5bc14c1420f5280efc6b7e82a
- TLSH T1B7B02B72124D140C07981D310CE22CE8386A8E03AD30CD43D21C49DF40000060100A0E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\data\raw_record.dat.tmp
- Size 3KB
- SHA256 ddd17d6e7057de30c678b1e446231a73babc0a185fbf61d3dc7727cef6010e09
- MD5 dc1d7f8b49e02c94ceb2e9137bb50e94
- SHA1 64cd926780a7ef6e6405be2770d70a525dedfdde
- SHA512 a3119f05b0dbec8b35e07157194abb5cf24d5dd9ec88f595664a979dbada68a88886638ced8c40a92bfc026ea6efa74a0aed51ed25b7642a7229575efa26b05c
- TLSH T14181478BD1D1C791481CC66C4BB99BD99338AFD7680E9B6EFC076CDA1643614A078427
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\data\rule.dat
- Size 47KB
- SHA256 0bf1fc7c13ce5f665e9bde7d57b2a3f19c1a6c3b1f4afd7324c687832762690c
- MD5 0731c4a1c81c22d5a2958a10bde82f0b
- SHA1 2a6e0c45b673a309393395417e7a8982f7866308
- SHA512 fdd2832e1f157704661f8a22656c4ac7be5c597883a6d87c3cfbef9834fb96155d0109a58ff0114e3da46ddec55d54110ca27b2e6e726947f5f35f6896a34083
- SSDEEP 768:8jAfN6sOMJVR4L9KCNspvqJCUqQBvrRdcpaiQ4aBvt:8jenJVR4ZHNspvqJCUqQogt
- TLSH T1FE23EB00A7E56A4BF3B26EB65EB8D7547737F8F64852E32E022084791D36A91DC71332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\data\switch_record.dat
- Size 1KB
- SHA256 7e138d4d6ee050a7a8a10352acdd5e8f3f3ef679ab81d7953720d86308538419
- MD5 3cce9bc8792600e7576fac12ddaff02c
- SHA1 1090582c0defe67e49c60e1d4bddf858800989b3
- SHA512 2efb97e732c6f780518cd1f9dbeee5e12855bd0eea1ee9a67475b576b20911345c13f8f82f5a96a86c5ab814a2c8eea9f59225bc5c70cef12371db096edb334b
- TLSH T14F21458BD1C1C6914C0E8F2C8AB87B988368AF57242F9F2BBC4B5CDA16437569138433
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\dgdectrl.dll
- Size 634KB
- SHA256 234a0bee1fee8d5e8547f8f449d7fd21d556bc9d7edf5c1bb23aa0a524b68f94
- MD5 fa8f1a7bbedc27ad56efa6fb4785f5bf
- SHA1 03774a8d7707efd0204c9c638648cd23c1e2540f
- SHA512 c40d7752ba9ef70cdc0fa3d86559a8fc375625464c7cc04da736515a72b64f517a8760797546ca22b0ad062f4189f68b82016249016fc0ebe98b902aee406e20
- SSDEEP 6144:sstH3O+ap5AB3N0oP5N9QME//9wCpuLbXOxWIG87UdRktR9ipLvMriKFAlMcJ/xB:ztXO+aps3N3N2MuKkuL4WdM2vLZIvRL2
- TLSH T1DCD48D63B3D5C03AF19E02756D65A73DA2F6B4B04E368D5B67E90A4E1E30583CE38712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\dgroutemsg.dll
- Size 242KB
- SHA256 8f50c3de41e8735f278a9437695e6214ae7b72d23d7867d2e971f4f6d7969c49
- MD5 e25c90af74b9ca07ab5c782bc5d233ae
- SHA1 6d372693c700b977631d7473dc596a66de848c68
- SHA512 e81ad2611bb5bf0b031e9ba2bfcb646a18fac7e02067f7f5d97b3a3b4a454ac62bf0bf92ac79c2054be8b43e033d2d08bbad8c8acf2c23308d28e9c32ebaecf6
- SSDEEP 3072:YhHjGmNn7xJU6g3T0xbmsoeg4Z/PXkaB47X7JJoGqVjwr738c0/+2Jto5TlQET:Y9jXh3U6CT0xbHoeX/HKT7wTPJtG
- TLSH T1E1346C1176D0C076D2AF027548A7872867BABC508FB5C6CB6FC4BE4E5E309D29E39352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\dgservice.exe
- Size 371KB
- SHA256 93a4b6fda28214cb221c87d7092361239598391293d97de4cc824954914cf0a6
- MD5 138ec1e2b465d17bca5ec98d4aad4b96
- SHA1 76f6e34561bdd12acad47b60b068ef712400c574
- SHA512 638948eb7b11638e282701eae287f817e942f346c920fc96bf7db8f89f5e2d75f601db64290bcacfa1e37f999d6c64c4fb48bf5ae0be801da053c12e57ff854d
- SSDEEP 3072:BOIXZl+YYnKjKwhsuEFl1LfebI00f7YjfUqoclO2kWsAdXpXFBHtj+HB2f26b94X:8ffe8qtDXp/26b9PaeUqifH8t8/LZVT
- TLSH T1F8849D11BBD5C073D64700B789A6C72E7676F941271558C7B7E82E8EDE303D2AA3A381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\drivergenius.exe
- Size 5.0MB
- SHA256 988a4f76504a6f83b0686b5768dc4e6292075af1640479d9b28f112b41ab9144
- MD5 648e0fc06176236c29e7e910ce598808
- SHA1 b644ff1c0c15902b41f9719ab153ba96eba05842
- SHA512 dbf8bf1a9ffaebb1a14ce5f221d4d6ddd716d49f0293f33d43cb95ad11199dd3a1bd7f6562621ad19a12320b45ce8c9f39f0b20e228607f987e661f220114c6b
- SSDEEP 49152:eiWZJpyURMvqq+ygmreuGgd/azWw1RA5MH5cPWkc+NAP1g12uORICz16EC8EzLoD:aJEURMvqq+ygmreuddy5MOguoETIMUPc
- TLSH T1C1360B11A702812AF9B305F3CABD5AAE5518BF711B1050D3E3C83D9F6AF2AD1793161B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\kadblock\kadblockcfg.ini
- Size 69B
- SHA256 536ad1032746f5125cb2e7cff99a42f0af1e96ed727c68e8024a2a6c224f7f7a
- MD5 b62a8a310c4d88d06b6469edaf9edb78
- SHA1 ee0106fb57240187141ee874bc6e8f7c5bd479c3
- SHA512 5aa03cc9f0e76fa377b667e15e2203f559f25449b874d6ff974c318e9f490f03e67b2ba714dc62593c88bb2f98d87a0693d720158af58a74f542e630f53e352f
- TLSH T174A0021B41108BFD70EF550DEB1DC0F0635493750031261D5AD09855FE4800D063814B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\kdump.dll
- Size 285KB
- SHA256 e3a2b33a035ec21bcad3263078b6358d1428cb295b0083a498f24ee6df808426
- MD5 7a060e14ca7d69984e98411f3f5f4ef8
- SHA1 4793266571a7524be3ee55781357d634847cf686
- SHA512 63b497c649ff8c57d345a34e0c14afeb4585d462d27f3e63b6ac46c7e68813d326d584e71d5251261e17b7ca8e4512f2cacb0f7331c7006f3f4235b7babd9d2f
- SSDEEP 3072:S7mAEEnp4XUXzNBAoAuCRdM9ZR6ZjmDhTTBOFkDydWJS9IZtorYQiUepGSt:S7mA1ksBouCY9Z8Z0OLde9
- TLSH T133549E2239C5C871E5BF02769909E72863F979309670C613BBDC0E4DAE76683AE35347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\kdumpcfg.dat
- Size 573B
- SHA256 f9dac6bba56ac537340ba39d9103dc7d2d46c46d0099f57086b14d45a18563e4
- MD5 290aed123062235b2f84f0764187aee1
- SHA1 4429910278b62420e017f879b85fd51dec7b0b40
- SHA512 a3166b28e7e5a641fae3068193598228e17f62269f2bb826f6bc752d5239474e5de0360855cf41cfdb1138d087061c121a41e0f00bb092c07b5fb8793035701d
- TLSH T1EDF0C0AFE5685931FA5012DC1E5C5931540742D022C7B0715C7028C0F7E0A0B9EDFDDA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\ksapi.dll
- Size 215KB
- SHA256 ffc67f8f07e4f99a3b35e6f52f8d377e90ceb5a7d6374de7415939105e892c23
- MD5 9ad48b5803cb70dfa691a14aa0886405
- SHA1 1ee4cc6ad2357bb2c7ed7b5c918e3e97281c6fe5
- SHA512 5d66ab546e60052d72f7849fed90fc31b15fa8302da1ff7bb771aa974f0892afba8bcab08e7c511d479974c2d8a7ade845a3746daaed8e4de63bf94dc75e7754
- SSDEEP 3072:1tGkTAeNSPkeYDvNvLaMoP/+/rQZcZ1exj2rHPL8Ol2XZn3abRIxnTZl+ea6Nyxn:rFHMkNv+zP/12rHZ2XFzNdIQySy
- TLSH T186249E517AC1D472EAFF193049BFAF2A16BDE6644B3889CB13A40DF90E601C39734967
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\ksapi64.dll
- Size 210KB
- SHA256 64b2980ef476a8e294b5491c534dc3172dc5f4810f2c41cfd65ab1df9aa4e9d2
- MD5 0e3f8bb7960df9e9d38ab8fa9c2424a5
- SHA1 4c32c1c697bd4723483211c60d2997315d3b269b
- SHA512 0a2ee93c74a6cb92a781e69375a262cdc36fa27c9c0b4c271cdcd360cba3e4b9a3e943a50d5f9ae009b2b8bf7761475757abc9c158ac2bc6ce4e00165e5c9fcf
- SSDEEP 3072:6+/SVm1WEpGOd/HKOgZwI1fwHrfN8JWX+pHqC+Mu/5HQe7cqYNFG+y9a+Ym2BuK2:9yEpGOdvqOoHnu/fYFNFSG91mLyF
- TLSH T1EC247D50B8C2D0F2E9FF053045BF9F2A16FDF7645B248CCB63945E991E602C1A638E66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\ksapi64_ev.sys
- Size 104KB
- SHA256 0db5ed4bbeb89cf938e5f69db089d07cfdf66f3701a6ca2379def4a0401690cd
- MD5 9fd136634e9ad983eb8a4d9f3f48f236
- SHA1 b3611428f17cd9ab05369dc9b9a4522b6f4cc351
- SHA512 c91e682c5b80e4cd2ef509e6ecca90bd50673fc61048ae07188614fd89e9848268992e53099370406eb41dd09c2d9e9e5811d38d28b01e3eff218138a2aa3005
- SSDEEP 1536:5ydYHDzUspcDamoQuXyCAVnZoGfKk8I1XilHaAh9BghXzxFGD9:6Y/UspcDYQKyCOZvHiHhh9SJjo9
- TLSH T1BEA37D43F3A406EAE5BECAB1C59A9623EBB0B845176197CF0360C8591F137A07E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\data\img_btn_rcmd_green_default.png
- Size 13KB
- SHA256 54da1c749a7b4f2615ae18c33a7b610a96209da56690621dd9e1ee2d2a2a72c8
- MD5 f5761ae722343b1efeec416fc5ac434c
- SHA1 1f54d8dcd6e4bb3adbc542f2e93cd355215d3357
- SHA512 2b342a9d5dc519696ea6bf0fe33135b54b6f17eb0268ee0225559126a8c059e4bc6ebdc8522109a160010201ae9ac24b1e1d307d05fe75e346a71ebdcdb27103
- SSDEEP 384:xNjfBxcI855YYOUvicmHmZg4wEfBctsPBQ/HmJEn8y:xHx07HIcmmZgh85JUHIEL
- TLSH T13952BF87E0B3567C4ACF4F495882549C9F0201D091A1AF61FCE9F72E14B66F66C68663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\kinfoc.dll
- Size 429KB
- SHA256 abf154a8ccabbae313248d723181e08b4d14f833155dcc521bcff2961b5635c8
- MD5 5ee1c685e1adf3d9352b6bfa5fdd1695
- SHA1 b269343f34950646862ac63e8e9ec000227ea0f2
- SHA512 c067762d4611cfc1fde37e7cf2877f2a39a034f00d1e25f307357c1defac496bb6b8d062ea7950d1c82977644ec767c67cc67ac8543050c176a57f38ffee9c59
- SSDEEP 12288:Kbh2SNvpLEU4DtQGcph2aFA5QVJm1WCXI19q:6WUMtFcH2YA5QVJwW519q
- TLSH T1D394BF7277E1C076DD7F113224968B3A76F5B5A06B398483A3C80A8D7F306D2BB35646
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\microsoft.vc80.crt.manifest
- Size 1KB
- SHA256 d736c413543b6b168dc59769840ae95b5726d428f69a23af1659dea8fb4236c8
- MD5 89ca53ae1155058a5f93234b13b17c7d
- SHA1 19dcabde08615877b189fc9988b0f90ef1d9f075
- SHA512 fdc2d720cade768f0a519223da86c05fd43387e3fc9cc02c421048d85fcec17fc5eb181d102137b96e3185c9567bd7aadbbde60568ad5c98e8a51826aab349d4
- TLSH T1EE31AD908C856C16D302D0D4FEF1E92970423F6700BE46EB6DE11DFF6D8248992C63BA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\msvcp80.dll
- Size 322KB
- SHA256 6b0b72e59e3cc3737b43b863ab399cef5f405f9fa1bfa9c9f3b4e72607e40138
- MD5 2b2df50d36c5c716c56e3f0a42298b87
- SHA1 9c27941ffc60ce2816da92a64be84eac1ceb1138
- SHA512 f20caa2ce9a6018b4656bfd7ac09c124a5287139fdf48c717f3ae539a6773ec4c6782979c0de73cac682f6316f2c45ef77b2dcba0e825ce2188e6dfd232bded7
- SSDEEP 6144:3tOUz6eTU55EDoSB1R3LhUgiW6QR7t5j3Ooc8NHkC2ex:3tvue6GoSB1lhUgiW6QR7t5j3Ooc8NHZ
- TLSH T1AC64332337470EF2A595B3C076C5433297F1BC5A8655B36392DFE0651F9A38C62A3AE0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\ksoft\msvcr80.dll
- Size 243KB
- SHA256 91f4e7a3b3bd1e481f9b16ba0a5e14d2deb1f5490a3b22da8576e418bac2a526
- MD5 9094f737d955b9c289bf38805bc0530c
- SHA1 e32c3c2038f26695a7afdc78f799b12645889c61
- SHA512 b8937624a157a7353a2e24c778f62ac19d5cce123bf7b588ae7526959fdee049c13f176a8407bd6498fd0b06e1ae932e627bd64581e61d2b8a1e668523c520f5
- SSDEEP 6144:m2IFT+HTdOSOyGL4GitfNVYWGXmz3KghkAqoSdCArDZdGJCJLuEyKIqqOmiqsjZS:GTMTsSOj4bfEWWmz3HkBoSXBmYyYc
- TLSH T18F341208EB6F3C16C8C75732E967C7A6896E665007E3BF9B03134E1C05883F52E21E69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\kxebase.dll
- Size 63KB
- SHA256 df1dde424ec68bb481f3cdbed66a52c92325134b084c6bd1ad013c3ba0ac3780
- MD5 943e99cf9c0e96a31abb7325558371d8
- SHA1 3188bb90f16c14b03e0d09e244ecaa9d2285be78
- SHA512 de3047ee0c70adb15a1ffe25e3f21b832ad9b1152d6e3ec3f54ae33e5f8f70d614b9cfff28d9645ddb850a6fb0d71b0a43d96be07857841fd6f37813793f6757
- SSDEEP 768:gegwepKWcwOarXTKkfcbsPsLcgvSoNL9/gkW1bp+eLYIIL:gegVK73azT1f6zFB9/gvV+eE
- TLSH T192535B033BA581F3CACB1730BAAEA77997B4A5640ED11527477393CD2D72617F62320A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\security\ksde\deconfig.ini
- Size 120B
- SHA256 a960f08db1c41b133055d50449eef19b1c5a1f9741b14bfe14576c8530a8d7ac
- MD5 11323d800fa8322ac01e389d006f6a38
- SHA1 bef3a71f9f5a3090ee2812f0f118ad8d1830047d
- SHA512 a861dd41984dba3ce03491b93c03169f4b3d1ef7ddfc17de85c5ae432a366ccf67486e6af6d67fd7f0d27061f2c04f8880d72e5afd4d9fe264ab9c6a8d319f6b
- TLSH T1FAB0122052B9986F20E9D20E660A4F8138E583743DACC0C288B0AFE65F5CC4C641D366
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\security\ksde\dgmctrl.dll
- Size 190KB
- SHA256 a681f562d79ab975a7c97a34545464d27ab4af533cecce7d985d56d2cd068af9
- MD5 302fdcb4495a1ab64dc7934e0794e662
- SHA1 283f4d26be4822c927317ad0fd7db3142e952515
- SHA512 a590b0cbd5ebf1a163a078bb57204669a3dd4fa0b807bc947d29fc01ca4ddcb7a30647caf7b06e1b32141451d94d0c877aababcf0daee485aa6ca6369d0ee986
- SSDEEP 3072:XnNosFlseU/5dEugYDzsDE3alnqq2CczSmEac9aFQVU6W4z:3NouVU/DFzWeDEacFK4z
- TLSH T17D14AE11B5C5C0BFEA5F027704F78B3A573A79514B3489C3BB849D998E221D1BE3A34A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\security\ksde\dgsafe64_ev.sys
- Size 304KB
- SHA256 c01f2a31e0e654aa3eaa5d434dfa4adc295774062e39f12f77e584bea6729feb
- MD5 31acfe6012a07d3350e178624d558b89
- SHA1 acae848995851491a47dbc09b305d4e80d4737d5
- SHA512 77e8d333eaf3be359f1227838046ab704b2d211e79a007ec3a50447c9409b8d328a5e452602926d6229e22e7f4ae70e9c53324a3c2dbadcb3d55a17264d078a9
- SSDEEP 6144:xm2eBXFPU9THMa0MBJoP98zjut1c00D+h0DhGw:xOBXFPU9dBJx6tKHDND3
- TLSH T1F5646A8BE2A51CC8F277D1B9C753D917E6B678140311AADF0660CBA61B23BE4B93D344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MyDrivers\DriverGenius\uplive.svr
- Size 38B
- SHA256 47fda5d1b50dc6433fdd1a03dd675217e68b11c054e22730ee8d8ceb7e71b409
- MD5 5e24b7fb5782c4284e144aaf31014d55
- SHA1 cc6016f0e5320842a101eac8fcfc3aa556591b06
- SHA512 376fa8ec37b4d407b30387bdb32ee669d4a4ea48148169618ab97f9bac0a7efb174b0116c8cce7304505d40e9ef2a375b7740cc4c5d20ce904c5de105937a39e
- MD5 SHA1 SHA512
- Path C:\ProgramData\Microsoft\DeviceSync\.hwid
- Size 32B
- SHA256 948e81d37180470203f473812bcaddb3705baee469308c8572eb16c7a28d67a7
- MD5 5eed831a3396cd71b3a01ecb65311b9b
- SHA1 5c069dc373e1465a64bd55aff1b5f3fe377d4ce1
- SHA512 db5899be27d77c5ecc0e9e77c217aeb118eb1d6e192eab70e3efefc8cb98380dd64037dd29da129742954dcbf4e95901fac764f6c03e0df4f0fafd0ef35ebec0
- MD5 SHA1 SHA512
- Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
- Size 13.0MB
- SHA256 a17bae359e6e8842109459e39aaaee85de046e7d2de406d74f62eb541e670b72
- MD5 acb56f0f40ebe7f4d55614789c982192
- SHA1 6c9a369d748223d7e307187125c815015b8af5a6
- SHA512 2c39765c2a9ebdce232edb0ea5015977364718ced31dedd959da9d2bc639372e1d813254e5628bf37991f1944a6f3ddf424a4435aba201e0ca36a767abf5c359
- SSDEEP 196608:sGJZF9Md5tV6rwHKOKmbzn19Gni1tJQFI+sul/PsM90KRgbK+964Ts:s025zswXz19jtD+sw3NA2+E
- TLSH T104D67384F713BB24D761F93D00277BCD4D8E14D3EF01E8F8E86A75B529A86E009AA157
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\DeviceSync\cache\openh264.dll
- Size 963KB
- SHA256 b3e3d5a65616fe26ee8659a22f5b52cbaea8025031e59bfd3f1cbe489e832e69
- MD5 12121eee8a509dc3b5871b2c042a0075
- SHA1 aa960a6d52d2fdcb677a6eb5b7924f4810cd1121
- SHA512 1c33f18f95918c6941cac1db8ab04b01409cfd8fb74743c507bf28924413161d72c2d7f3e88b6ca3e6b1a03d2664e81082ae88aa60dd086b4c2c59c73a9cf134
- SSDEEP 24576:R8QYo8QiMF8/wMv06D3ekuJX0V6iLr9JuW+aWJw7C7:R8QNVF93yFLr9RFWJL7
- TLSH T1EF259E46E26601E8E87BD074C97A8627F7B9305E13208AEB19E0C7552F23BE4573FB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\DeviceSync\settings.dat
- Size 161B
- SHA256 fc79991a5946179b30c325fe1fb4a97e5c15f0b671c33c0acdaec06053f65a9c
- MD5 5d615454f7fd8bc5dde83aaa84165903
- SHA1 5c8b3c314b6dba17d6b0d79c814e4da1faa933c3
- SHA512 e4ffb3b965962f422c9c46ed0a4211c1d18e3a49404d672fbe09153ef7f4892df4a4c535e1182d7a82ec9580c98b028a2f82ff3a09f83443bf6c1ef1bbc8f8b3
- TLSH T17AC0805A4B4111D4F9CD25131639171515075719740CF6A8F554224DD654590495DD8F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\DeviceSync\settings.dat.bak
- Size 151B
- SHA256 800d60fa8884fff5b87e575daf68711df60b7c2bc3bd4fee75af79cd1175debf
- MD5 b768d82ff83498e242b4f1db46db345f
- SHA1 5e382630a8a10b8f9841c4edb92c6786f5074ee1
- SHA512 d4082d9474da3e311549d4f78851744cc4bb7ee3a2579b6036610916b77161117fe603203ca17ac9513d3284fe184c2229d6e33c7c9161ad7eabb15687e3bfaf
- TLSH T1C2C08C80A2A0803FA9D828A702E28E070F1AEF8B20213444DF4B2C8040A983291A2C0F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dgcloudconfig.ini
- Size 6KB
- SHA256 c2a7d02f9821e6a858535894615ee6eb6f9c33d69660ec43244cae7a1e436784
- MD5 82fc9aa09bc710aabbfba06aa300e32b
- SHA1 a3f8e4f8c215a1da241b5054abc09631c777756c
- SHA512 14ba390cbfacf5d0e7e46f6d0e2689f2a1f831240412be7fed6ceb0106f92221abb0af430a234d3e8046ae289868674f1b93ccf193abeb0a8822ddc7042611c1
- SSDEEP 96:rb+ht/gRsgHNj8JExi9UHiq5Exi9ohjQLg2Ri8lqU/znFw4KdKToXiWEEjk2KKlF:mht8oF9PSF9oivQJk23LzuOqwR
- TLSH T1D1D1F256BBF92224F6F38BD5EBF525624E7E7DA2A80DC15C11D0024D48F2E409872BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\kdrivergenius\kdgsetup.log
- Size 5KB
- SHA256 3e24584874111c5de3cd5957e48ac659ad655a5e4d93fe7c13e48628d4d81887
- MD5 4d70918a6c2d963c81859c0da10c8ff5
- SHA1 67be2c3611398c4c4aa41ee98e39dad1d8da8a17
- SHA512 ddfe44ddc395d0884cbf39c207aa6708ba31ea4067a4376f27f5099bd07aaff08d87caf89d71cf99e0c0bca7d00069b8a5209d1061219a9e6f1e3d9a8ab721f3
- SSDEEP 96:W2TWlFOoP8sc01rMYoMc7lplpU8x8nY+/tg:/TUjc0SYoYtg
- TLSH T14DC1BADCC4B6B0843DD763804752CF09672F8EC1387CE41573B5FDA8A00A959EFA9899
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\kdrivergenius\~e58c29f\config.ini
- Size 948B
- SHA256 e0e0db6e0f48410be47c3b34dc5d8278c77ec9caefa4b00fdd05bb670c922d0d
- MD5 60d5c7c8c39ee47b5462beb6dd68444b
- SHA1 443609cd6f82ecb1c7808955ad77c249050fc50b
- SHA512 d6a500f6700a51507b63001bf13faf4829d4dcfc301bcea744a4036d47321e6deee9d5118305d713cf75bfe5dcb233445d1c969fbfe7f18643155e2aac1b029f
- TLSH T1C81140551C39CEAC497869C824B3118D1FEBBE89F45081E907BCA48E8DED87F276D076
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\kdrivergenius\~e58c29f\l_main.xml
- Size 2KB
- SHA256 1bee669cd5a696186f1782a5f6551fc978fc2f858767e4dbf8c66f3262bbbe58
- MD5 647f4db8d0e4344aec9f6e3aed7b69ce
- SHA1 d58b4bfa78b27f032ba5fa2480a12a6309ee5ee7
- SHA512 da12bbf974131cc0e7d54bd56ae41ed927ac568359aa731fde9d254d0004279e147d32f566bffe3fc29606097e00a5ce4c52f9c3b02ef0526d6c10240f0981ac
- TLSH T18351038A1F3C5E3178470965D90D2B34FA3F52CCBD654E660F3BC65C126223A9EAF489
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSIB94A.tmp
- Size 155KB
- SHA256 85898668df3634a10c79b2085d14731ccbe36c42b0c107b3d97420d88617e24d
- MD5 22a8269930591a8db4ea0383833b1119
- SHA1 f56b21a6a70f8cba7e558f8a33285e04f6e411af
- SHA512 4db1555434f66776c5c186d63375ec5a3814821d28e854b43d0a5143557cab121010b9bf9b6f8f4018572e1185d68589f44935d4846ab8002f0948bfc05fb3e0
- SSDEEP 3072:JohRqQd+2j0Q6Hudtg7sA8w/ipIZDrDgel+1iJrR2HMzU3LP:JqFh6H2Usw/QIZDrFGMU3
- TLSH T1F3F39E02B5805073D6FF093A943096715F3FFA30DB9449DF539489B9AE602C1AE76B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIB9E8.tmp
- Size 340KB
- SHA256 dc4dc1f8584146b789110d12fddb9e15a60bf3a243ca02793f08c4a65a6c5234
- MD5 f718935631eaf0584c7cdb1642ff365d
- SHA1 b7c92d32038d92098f89bffa98260080d3298d5a
- SHA512 1ce45826d71bea583c6704b15002df62ae0dedef8986ca5d696d739a9ed98e2485539c1bd74b840fefa00f5c817a27abc8f6d2aa0e22e8855bfdede13cac95c9
- SSDEEP 6144:9soO0Ey21WJC/3kZTDOR2R7MY9AgMMh3HO9NM:9z6R1WJ+ITDOgZ9AgMkuM
- TLSH T1FC744B35A456303BE6F90D32F568CB706D3CB61827D894AE83D0984E3C245E36AF771A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\bootsafe64.sys.tmp_0
- Size 118KB
- SHA256 b66d07c065c88a374adf2c4e416ed8be36adb476e8d5282edb1659e8a13bba92
- MD5 0ce795d04fd30b214859409c7bf7f664
- SHA1 83979f55ba1369af779e6e8b87378835461a401c
- SHA512 0a74e5bc66d847a781feea93bbae8b7ba28c2efd3bbf3ef30aa230fd8424eaad0edb1e5f5fd7184d3fec357ec7dda54b61a7b6d1e62a233489b572c874485bc8
- SSDEEP 1536:biE/RJD8dwTz5Q3bi9oNUvWkuxZO8xAD2wpHbcU27lHPzQnG4dkzSGHkU:bnRWooNUviNAD2UHAhRPMnmGyz
- TLSH T192C36C45A2E810D4E7BAE2F9CAE38313EA767404472147EF02748AA50F137D5BD3E769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\kavbootc64.sys
- Size 61KB
- SHA256 bec8fd08d8a56d2f913665d24239af37adcada3f2e7eb2ead2439d549b989aa7
- MD5 54d923c0c7b48896d2c1ffb481d197c8
- SHA1 ea97b6d32408ec53669c88ecc79ae10edcb6343d
- SHA512 84109cefb5f3371720944497e9741e7c0c01a79be44f1b2a930b03306c4026d1f4cfc4b7b102e9251ed0d28d4bbbba579bbe8b5b52e67e49bfb10e70c1c801ad
- SSDEEP 768:gcD3GGc4EUjtWBmWkmuf6/3dxKOQ7o9uIfQJkn23+zjs0u3P:gcD3GGcKjtWMjm3Veo9EX2yf
- TLSH T11B535B8757280086EA97D97892D5DA63EF72B69257A007CF0638C5680F93BC07B3D72D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-18\desktop.ini
- Size 129B
- SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
- MD5 a526b9e7c716b3489d8cc062fbce4005
- SHA1 2df502a944ff721241be20a9e449d2acd07e0312
- SHA512 d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
- TLSH T169B09B0A41476664B05ED15DAC60E147117D547A4D14A2008EF0B345D1A33550778D69
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 80cfe7d8e062644f51f7dbb737ec0c2541aedd885267df67f7bf3b2d8d8bdb70
- MD5 f5a278fdf21b43249f26ec365de047e6
- SHA1 b3341bbb4de35ea638c382ca254973073f3dd2b3
- SHA512 a6499148fc47b1bdd9250f7625c73abe47b8174c76dc52d290d4830f3ede9a0de7a4253d5b31d6ad9a80cfce4bb18e4d12859e96a1bf430f0efb7e1d6cfdb8ab
- SSDEEP 24576:h2gmSp1tdoO/vvTLB2q+RknK/qpBA4eA22p9XpEqzRaIE2OvYR7d7nANh:F
- TLSH T1C047C22436F92210E7F79E3CA8F0AA234D3A7D5B9C15DE8D05411B4E0961FB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{0dc89376-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8f41ce62-98a8-4754-a1f0-dba13dfa2409}_OnDiskSnapshotProp
- Size 6KB
- SHA256 30772c23d27b564b8957bcedfa50a39ec80ccc7874271202427ec6101bd011c5
- MD5 c72496e2c8fefe48134564523f43bfce
- SHA1 9069f78bbf873885553cf0de92cd00a8be5b6ca6
- SHA512 35f451eb7bc35c7a234da147e2f7c3799e4a14c1ca8a4325be45ca26cab1ae3ba4ca944e796b4226f4e4189c5ad33bc44f3f51353f9215b99b0c4b86866d9cd6
- SSDEEP 96:FT+zwUvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:ROb++ZVm
- TLSH T197D179185AF54711E2B3AB3128F18557A877B911EF33CB8E0298638E6670910F875F5B
- MD5 SHA1 SHA512 SSDEEP TLSH