Overview

overview

8

Static

static

8

JOEKNAUERB...5g.exe

windows10-2004-x64

8

JOEKNAUERB...5g.exe

windows11-ltsc_2024-x64

8

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDIR/INetC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ay.dll

windows10-2004-x64

3

$PLUGINSDI...ay.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ON.dll

windows10-2004-x64

3

$PLUGINSDI...ON.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...rk.dll

windows10-2004-x64

3

$PLUGINSDI...rk.dll

windows11-ltsc_2024-x64

3

$TEMP/Inte...er.exe

windows10-2004-x64

1

$TEMP/Inte...er.exe

windows11-ltsc_2024-x64

1

$TEMP/RMM....er.exe

windows10-2004-x64

1

$TEMP/RMM....er.exe

windows11-ltsc_2024-x64

1

ArpLookup.dll

windows10-2004-x64

1

ArpLookup.dll

windows11-ltsc_2024-x64

1

Cloud.Back...IO.dll

windows10-2004-x64

1

Cloud.Back...IO.dll

windows11-ltsc_2024-x64

1

CronExpres...or.dll

windows10-2004-x64

1

CronExpres...or.dll

windows11-ltsc_2024-x64

1

Elasticsearch.Net.dll

windows10-2004-x64

1

Elasticsearch.Net.dll

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    165s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 23:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    JOEKNAUERBAND_rmm_v2.5.0.68_oid3194489f-d085-4291-8d78-656ac55707f3_bidYSHwnSuiR0OuVI-TFmGn5g.exe
  • Size 17.1MB
  • Sample260810-274zps1cmd
  • SHA256 6f35b915daa5c635f6a05e04cdb9b4aa5c682262139316df3ddd6cd412b18eb4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 29 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 45 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JOEKNAUERBAND_rmm_v2.5.0.68_oid3194489f-d085-4291-8d78-656ac55707f3_bidYSHwnSuiR0OuVI-TFmGn5g.exe
    "C:\Users\Admin\AppData\Local\Temp\JOEKNAUERBAND_rmm_v2.5.0.68_oid3194489f-d085-4291-8d78-656ac55707f3_bidYSHwnSuiR0OuVI-TFmGn5g.exe"
    1⤵
    • Downloads MZ/PE file
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3296
    • C:\Windows\SysWOW64\EVENTCREATE.EXE
      "C:\Windows\system32\EVENTCREATE.EXE" /T INFORMATION /L APPLICATION /ID 100 /SO "MSP360 RMM Agent installer" /D "Begin installation."
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4864
    • C:\Windows\SysWOW64\CMD.EXE
      "C:\Windows\system32\CMD.EXE" /C move /y "C:\Users\Admin\AppData\Local\Temp\RMM Agent\install.log" "C:\Program Files\RMM Agent\"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:5952
    • C:\Windows\SysWOW64\CMD.EXE
      "C:\Windows\system32\CMD.EXE" /C dotnet --list-runtimes 1> C:\Users\Admin\AppData\Local\Temp\nsj8D63.tmp 2>&1
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • System Time Discovery
      • Suspicious use of WriteProcessMemory
      PID:4640
      • C:\Program Files\dotnet\dotnet.exe
        dotnet --list-runtimes
        3⤵
        • System Time Discovery
        PID:5432
    • C:\Windows\SysWOW64\CMD.EXE
      "C:\Windows\system32\CMD.EXE" /C copy "C:\Program Files\RMM Agent\install.log"+C:\Users\Admin\AppData\Local\Temp\nsj8D63.tmp "C:\Program Files\RMM Agent\install.log"
      2⤵
      • Drops file in Program Files directory
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:5768
    • C:\Users\Admin\AppData\Local\Temp\nsuA66C.tmp
      C:\Users\Admin\AppData\Local\Temp\nsuA66C.tmp /passive /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Windows\Temp\{9F9FC846-C4F1-4266-B140-4C2C1B9D96E9}\.cr\nsuA66C.tmp
        "C:\Windows\Temp\{9F9FC846-C4F1-4266-B140-4C2C1B9D96E9}\.cr\nsuA66C.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsuA66C.tmp" -burn.filehandle.attached=752 -burn.filehandle.self=756 /passive /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1784
        • C:\Windows\Temp\{6127F11F-3D20-4657-8C62-8DA73BAE03DC}\.be\windowsdesktop-runtime-8.0.22-win-x64.exe
          "C:\Windows\Temp\{6127F11F-3D20-4657-8C62-8DA73BAE03DC}\.be\windowsdesktop-runtime-8.0.22-win-x64.exe" -q -burn.elevated BurnPipe.{C0CFC6E1-923D-4E3C-988C-F4ECB39B90F0} {34B82BAC-36D4-4921-A3DB-51AC58D12B9A} 1784
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:2928
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1244
          4⤵
          • Program crash
          PID:2140
  • C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe
    "C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe
      "C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260811002028.log"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe
        "C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260811002028.log"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:5956
        • C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe
          "C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" -q -burn.elevated BurnPipe.{3A936B3C-C2AB-4B81-BD5A-6CF27A33E8E8} {17F82CC8-7CCA-4231-AFB8-BF45AB6A3947} 5956
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:5844
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 1076
          4⤵
          • Program crash
          PID:4696
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4060
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F72B217DCE08F9DCBC985B1890D534A5
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5716
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D567E27DF46F7A906F24EA34EA09B8F9
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4232
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 94A747F3CA788B15C4EDFABEF37A22AC
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4384
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1784 -ip 1784
    1⤵
      PID:4396
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5956 -ip 5956
      1⤵
        PID:5384

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5a1b6c.rbs
            • Path C:\Config.Msi\e5a1b6c.rbs
            • Size 48KB
            • SHA256 2a2bf9273e6e149a081859d8200f12bbdc5332d26c4d5556f2d1d148458af99d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a1b71.rbs
            • Path C:\Config.Msi\e5a1b71.rbs
            • Size 9KB
            • SHA256 5026997a175d10574ce9ecee2329ca61fe379f58717614f578c2054ce5ad3e2c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a1b76.rbs
            • Path C:\Config.Msi\e5a1b76.rbs
            • Size 11KB
            • SHA256 dfc7a2a3e6de6023fa8d955500fe2507f8d4d661dd8d67e20943bc6784725e53
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a1b7b.rbs
            • Path C:\Config.Msi\e5a1b7b.rbs
            • Size 8KB
            • SHA256 2405cb3fe5c61847ec4602743219b692bcf8d55f7719db690e3f24a34a907d8e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a1b7c.rbf
            • Path C:\Config.Msi\e5a1b7c.rbf
            • Size 143KB
            • SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a1b7d.rbf
            • Path C:\Config.Msi\e5a1b7d.rbf
            • Size 3B
            • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
            • MD5 SHA1 SHA512
            Submit Download

            install.log
            • Path C:\Program Files\RMM Agent\install.log
            • Size 9KB
            • SHA256 0984b6f925faff3ad8dcbf2f2568f18d03aef99b8a47f0201af31ae2a29a951b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            install.log
            • Path C:\Program Files\RMM Agent\install.log
            • Size 9KB
            • SHA256 bd34cc6a97a7c35c39e0a42bb4c587b2b2ae6530cab0554035b6d30c1c7c7be9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            state.rsm
            • Path C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\state.rsm
            • Size 908B
            • SHA256 bb402a2751cf0f19d750a23ca052053d37efb46ef976c79f6dade365af642f41
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260811002028.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260811002028.log
            • Size 10KB
            • SHA256 b21956ef4522fd0f60e84471c92454644edd545eb6d5d50a2a9c30b4e897e10a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260811002028_000_dotnet_runtime_8.0.22_win_x64.msi.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260811002028_000_dotnet_runtime_8.0.22_win_x64.msi.log
            • Size 3KB
            • SHA256 e41fa0223cf24087bfdb55f6f1d574b368af2945a85cc8062dbf0b27d2ad91ef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            install.log
            • Path C:\Users\Admin\AppData\Local\Temp\RMM Agent\install.log
            • Size 8KB
            • SHA256 83f7a7a65f74af81ce8c9f8f60fd5af46818e62558ccebe1bba3ec33d40f2975
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            INetC.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsj5A9A.tmp\INetC.dll
            • Size 21KB
            • SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsj5A9A.tmp\System.dll
            • Size 10KB
            • SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UAC.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsj5A9A.tmp\UAC.dll
            • Size 17KB
            • SHA256 e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            modern-wizard.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\nsj5A9A.tmp\modern-wizard.bmp
            • Size 150KB
            • SHA256 bfb254c0cbb17a4350a312e79dcccda1beef44701b03e014841d367557840509
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsArray.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsj5A9A.tmp\nsArray.dll
            • Size 12KB
            • SHA256 81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsj5A9A.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsExec.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsj5A9A.tmp\nsExec.dll
            • Size 6KB
            • SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            processwork.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsj5A9A.tmp\processwork.dll
            • Size 231KB
            • SHA256 27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsj8D63.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\nsj8D63.tmp
            • Size 552B
            • SHA256 3a540187aba2047118a389c22152a488c215f21766cd75e59c187f7c414bddb1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSI2ED2.tmp
            • Path C:\Windows\Installer\MSI2ED2.tmp
            • Size 219KB
            • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bg.png
            • Path C:\Windows\Temp\{6127F11F-3D20-4657-8C62-8DA73BAE03DC}\.ba\bg.png
            • Size 4KB
            • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{6127F11F-3D20-4657-8C62-8DA73BAE03DC}\.ba\wixstdba.dll
            • Size 190KB
            • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_host_8.0.22_win_x64.msi
            • Path C:\Windows\Temp\{6127F11F-3D20-4657-8C62-8DA73BAE03DC}\dotnet_host_8.0.22_win_x64.msi
            • Size 708KB
            • SHA256 41bee98f21575992e7a5ae1e0e499881117e62f46d722fe183016338c025ee32
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_hostfxr_8.0.22_win_x64.msi
            • Path C:\Windows\Temp\{6127F11F-3D20-4657-8C62-8DA73BAE03DC}\dotnet_hostfxr_8.0.22_win_x64.msi
            • Size 776KB
            • SHA256 5348ead3f40fbede2047d43c8303e20b12bfc2e0bdf5ebf5020ebc3b311b28d4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_runtime_8.0.22_win_x64.msi
            • Path C:\Windows\Temp\{6127F11F-3D20-4657-8C62-8DA73BAE03DC}\dotnet_runtime_8.0.22_win_x64.msi
            • Size 26.3MB
            • SHA256 efab95895aa3d5dee85b686cef9a81c613cd8bdc1cadcc9ecfe248804e96b4fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            windowsdesktop_runtime_8.0.22_win_x64.msi
            • Path C:\Windows\Temp\{6127F11F-3D20-4657-8C62-8DA73BAE03DC}\windowsdesktop_runtime_8.0.22_win_x64.msi
            • Size 29.1MB
            • SHA256 4605b47ecf5e0512c595e2ea514985f0187765b4d80eca72c95bba40c61c38a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.wxl
            • Path C:\Windows\Temp\{6DE73143-DD33-4D42-87EF-25F8974DE62D}\.ba\1033\thm.wxl
            • Size 5KB
            • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsuA66C.tmp
            • Path C:\Windows\Temp\{9F9FC846-C4F1-4266-B140-4C2C1B9D96E9}\.cr\nsuA66C.tmp
            • Size 608KB
            • SHA256 daa2e35615ad3b138003d150096c27dd03bd754c434657031e64c33376eddb40
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3296-34-0x0000000002900000-0x0000000002941000-memory.dmp
            Download

            memory/4060-481-0x000002A1556A0000-0x000002A156044000-memory.dmp
            Download

            memory/4060-541-0x000002A1556A0000-0x000002A156044000-memory.dmp
            Download