Analysis
- user interaction
yes - max time kernel
11s - max time network
11s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 08:16
Behavioral task
behavioral1
Sample
SetupExitLag_v4286 [PeskTop.com].exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target SetupExitLag_v4286 [PeskTop.com].exe
- Size 20.1MB
- Sample260808-j6bbwsce33
- SHA256 77fc1102262f289fa67f215ae0958c3743bc12e4b584aa6ecb3c4709a22aad3b
- MD5 9f9b861c55ed61b91c3f4e4c327e0728
- SHA1 5ff07b4227f22b439973fe68020934c4568769f9
- SHA512 eab42fd76b64847871a2c59e7c9d60cad101684b6b1fa296dc65b98461d7189870c067a648dcb2466bbf1d73a16352ebc0853306e4c79ba8cdbcdb2606a6c3f8
- SSDEEP 393216:ZOKwdj3OwcloOVb5D8HrjzfOxNNVQAAASMjPoYgLO:Z5wdbOwcloub5mPfOxNNsAS6n7
- TLSH T1FE27333BB258653EC45E0A3E45FF92109A7B7A62B416CC1E17F0384FCF620611E7A65B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 5988 SetupExitLag_v4286 [PeskTop.com].tmp 1544 DriverCacheCleaner.exe 2820 snetcfg.exe - Drops file in System32 directory 26 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\wfpcapture.PNF snetcfg.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{bcee30b5-a058-764f-b7a5-7e64046d3720}\ndextlag_lwf.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{bcee30b5-a058-764f-b7a5-7e64046d3720}\ndextlag.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ndextlag_lwf.inf_amd64_17444b81168ee7c2\ndextlag.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ndextlag_lwf.inf_amd64_17444b81168ee7c2\ndextlag_lwf.inf DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{bcee30b5-a058-764f-b7a5-7e64046d3720} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_9ab9cf10857f7349\c_netservice.PNF snetcfg.exe File created C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_7d294c7fa012d315\netpacer.PNF snetcfg.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{bcee30b5-a058-764f-b7a5-7e64046d3720}\SET6C42.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{bcee30b5-a058-764f-b7a5-7e64046d3720}\SET6C43.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{bcee30b5-a058-764f-b7a5-7e64046d3720}\SET6C53.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{bcee30b5-a058-764f-b7a5-7e64046d3720}\SET6C53.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ndextlag_lwf.inf_amd64_17444b81168ee7c2\ndextlag.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_c5e19aab2305f37f\netvwififlt.PNF snetcfg.exe File created C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_a009d240f9b4a192\ndiscap.PNF snetcfg.exe File created C:\Windows\System32\DriverStore\FileRepository\ndextlag_lwf.inf_amd64_17444b81168ee7c2\ndextlag_lwf.PNF snetcfg.exe File created C:\Windows\System32\DriverStore\Temp\{bcee30b5-a058-764f-b7a5-7e64046d3720}\SET6C42.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_73adce5afe861093\netserv.PNF snetcfg.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{bcee30b5-a058-764f-b7a5-7e64046d3720}\SET6C43.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{bcee30b5-a058-764f-b7a5-7e64046d3720}\ndextlag.sys DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\netbrdg.PNF snetcfg.exe File created C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_7f701cb29b5389d3\netrass.PNF snetcfg.exe File created C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_a2bfd066656fe297\netnwifi.PNF snetcfg.exe File created C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_0dc913ad00b14824\netnb.PNF snetcfg.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log snetcfg.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SetupExitLag_v4286 [PeskTop.com].exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SetupExitLag_v4286 [PeskTop.com].tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DriverCacheCleaner.exe - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral1/memory/4660-0-0x0000000000400000-0x00000000004E6000-memory.dmp innosetup behavioral1/memory/4660-89-0x0000000000400000-0x00000000004E6000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeAuditPrivilege 5816 svchost.exe Token: SeSecurityPrivilege 5816 svchost.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4660 wrote to memory of 5988 4660 SetupExitLag_v4286 [PeskTop.com].exe 87 PID 5988 wrote to memory of 1544 5988 SetupExitLag_v4286 [PeskTop.com].tmp 89 PID 5988 wrote to memory of 2820 5988 SetupExitLag_v4286 [PeskTop.com].tmp 91 PID 5816 wrote to memory of 3176 5816 svchost.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\SetupExitLag_v4286 [PeskTop.com].exe"C:\Users\Admin\AppData\Local\Temp\SetupExitLag_v4286 [PeskTop.com].exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\is-8GR7J.tmp\SetupExitLag_v4286 [PeskTop.com].tmp"C:\Users\Admin\AppData\Local\Temp\is-8GR7J.tmp\SetupExitLag_v4286 [PeskTop.com].tmp" /SL5="$502FA,20195266,887296,C:\Users\Admin\AppData\Local\Temp\SetupExitLag_v4286 [PeskTop.com].exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\is-D4KS3.tmp\DriverCacheCleaner.exe"C:\Users\Admin\AppData\Local\Temp\is-D4KS3.tmp\DriverCacheCleaner.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1544
-
-
C:\Users\Admin\AppData\Local\Temp\is-D4KS3.tmp\WinpkFilter\lwf\win10\amd64\snetcfg.exe"C:\Users\Admin\AppData\Local\Temp\is-D4KS3.tmp\WinpkFilter\lwf\win10\amd64\snetcfg.exe" -v -l ndextlag_lwf.inf -c s -i nt_ndextlag3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2820
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2b0dcf12-a3cb-244b-ba1e-6744202fb7b0}\ndextlag_lwf.inf" "9" "4bf63e1ef" "0000000000000140" "WinSta0\Default" "0000000000000158" "208" "C:\Users\Admin\AppData\Local\Temp\is-D4KS3.tmp\WinpkFilter\lwf\win10\amd64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3176
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\is-8GR7J.tmp\SetupExitLag_v4286 [PeskTop.com].tmp
- Size 3.1MB
- SHA256 cb54f93756504ef792e534b77689d62c0a3722fee283d3c43da6518d8596d53a
- MD5 96f6c91e0ae4d5a3c5a0db76771d0eca
- SHA1 ed65ecce25973e4f471312d9e8093e438247e8cf
- SHA512 97d144f87ea259480a4ac193b6436a6b58fa7c639bbb5f05ea9de2cdd6db28d394f00d5ba0f09f4e0049cceffdc2e2ddd50e0299037108a69fe5847030c2ed43
- SSDEEP 49152:hWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTb0333TV:jtLutqgwh4NYxtJpkxhGr333R
- TLSH T10FE55B17F28C713ED06B3A3A4AB781909837F6616912CC2797FC794C8F365942A3E647
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-D4KS3.tmp\DriverCacheCleaner.exe
- Size 200KB
- SHA256 0bf38436e43ab87ae7a0317ff164b42623296321d07f7b6141277ebbcccfe05b
- MD5 25cc15669ea9e8587ca89d011d77d435
- SHA1 ea1a32dfc61412accdefaf2a03faf3666cb4f7f8
- SHA512 247465a3b0ac4e1deaec7060e18e8d3e520fb987183f678291b12fc9434406df74c3a828e3b7080cd73827b789d78962e0368040ec50101cacc9b72e4dde9fb1
- SSDEEP 3072:jBzhgug0mncSYsdVKu9HzNJfhvuCxlt4KWempGeqkECUk38OAg0Fuj0sXrNalzCc:1zh6HVP9/fkCtFWZpfqkFAOZRaI83
- TLSH T111147D50B4D1C473D533053108F8E6B85A7EFD614A619ABB67D84B7E0F34381EA31AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-D4KS3.tmp\WINPKF~1\lwf\win10\amd64\ndextlag.cat
- Size 11KB
- SHA256 476005d1e2be816c06cf62fa18715dd50d9a09bc7984d0ae33cf917288174917
- MD5 41ce1b9d8fb8432898d8b086753139a9
- SHA1 88fa6a06942242d3f05ff316e444efa4734bcb47
- SHA512 73bb5d2893cea2f421cf32245a822728f7bd42924bb0f78099c0893fd67d6be868932848d77c1edb0e1f9992a6ea3703788e9ceeccbbe9152b6137d7d3e1ffc6
- SSDEEP 192:uoT9HAJCL2XJEwiSpJhI1hYCTQxey60ODX01k9z3Ar3bh8O:9AZxXhI1h3036zR9zq3dh
- TLSH T12D3229A29A6D4182FCB7BCA053F8ED473C3977CB680056AA629EF6240C573C4E72417D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-D4KS3.tmp\WINPKF~1\lwf\win10\amd64\ndextlag.sys
- Size 58KB
- SHA256 70013fcd32f4745347cbd45c1cc911c0d6939048727f1c8dbcc1da36edf20fa9
- MD5 4bbbac5d7cb5e2e65ac400f01bf267fd
- SHA1 318a2b1dfb4871c72ec27fffafe8488b7f0453a5
- SHA512 86aa1a9ff8f0df4feec57f4d2d1572a4e0fbea0de5cafc88c728a5737c77d80ad98926ab9d3c5cd5817dbf9f49e63179895fd1d6199a72996783b65505f1b6b0
- SSDEEP 1536:3tEjCJyzRVEOAARIUfFWFRZ8rfvbKtKXRM2z4q:3tEjCSmOfK2FWOfvbVXH
- TLSH T11B439E925AB404C3FA56CC74C2F2E647FEB1B986171856DF6320D1261F6B7D06A3A32C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-D4KS3.tmp\WinpkFilter\lwf\win7\i386\ndextlag_lwf.inf
- Size 2KB
- SHA256 b75793dc1c6665778a2371e2c5ee57052d61a94ce6163103fb3867b710f9b12a
- MD5 f37e8cc0eabac5e065277ba82818bd44
- SHA1 4b0d23da6f357406ed21187a99462fde36e36b40
- SHA512 c31a5c2c4bae9e07fbf4de18c94196c1f81969d4e46dd03a35db948fad2f287ae4528f051a3f1ab1639093076e983795ace8a19475d65cb049706bf8aa4c7467
- TLSH T1475155840ED9873036F7D3997B062CE3E33C2544959C41F8F2ECA2A357C689C721D969
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-D4KS3.tmp\WinpkFilter\tools\amd64\snetcfg.exe
- Size 15KB
- SHA256 516c5643cf378bdbc28191db75f85aed6988f21fe176c6d198ec21e76540c944
- MD5 58266a610bbc7c7eb924c6918edea151
- SHA1 d247099c5f3c9ad0b16f6ecbebcd8b1e54bcdd5f
- SHA512 99bfe3856e27afe1c966342ec05fb4f59941207fb6c3235d95095cf340fd31f9fc8f9999585c512f2afa1c6cf57a9416d2b835dc121b5dd44001d465a26a216c
- SSDEEP 192:EzcBX7QcEks4EvZHLTCcmelUzAuQ7tdx4HlwBzxVR8fG2:wcx7QcEksHBHLTCxzYtdx4HKxVRqG2
- TLSH T1A0627151E3F90228F1F2AE7459F21121CA7B3C50EA70DBCF019554092EF6A90DEB9F62
- MD5 SHA1 SHA512 SSDEEP TLSH