Overview

overview

7

Static

static

5

TouchEn_nx...94.exe

windows10-2004-x64

7

TouchEn_nx...94.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    48s
  • max time network
    36s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/10/2026, 03:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TouchEn_nxKey_Installer_32bit_MLWS_v1.0.0.94.exe
  • Size 21.5MB
  • Sample261014-ebezdafs2t
  • SHA256 718caf7e95d438f8348b61c87ce9637a9d060ea8682c335a5338122598a7ca9a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutioninstallerpersistencespywarestealerthemidatrojanupx

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 36 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 17 IoCs
  • Executes dropped EXE 14 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 3 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 3 IoCs
    installer
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\TouchEn_nxKey_Installer_32bit_MLWS_v1.0.0.94.exe
    "C:\Users\Admin\AppData\Local\Temp\TouchEn_nxKey_Installer_32bit_MLWS_v1.0.0.94.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Modifies trusted root certificate store through registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Windows\SysWOW64\CKSetup32.exe
      C:\Windows\system32\CKSetup32.exe /install appm
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3764
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Create /TN "RaonSecure\TouchEnNxKeyManifestSelfHeal" /XML "C:\Users\Admin\AppData\Local\Temp\SHTD2FB.tmp" /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3264
      • C:\Windows\SysWOW64\CKSetup64.exe
        "C:\Windows\SysWOW64\CKSetup64.exe" /update CKAgentNXE
        3⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4624
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /Create /TN "RaonSecure\TouchEnNxKeyManifestSelfHeal" /XML "C:\Users\Admin\AppData\Local\Temp\SHTD5F8.tmp" /F
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1832
      • C:\Windows\SysWOW64\CKSetup64.exe
        "C:\Windows\SysWOW64\CKSetup64.exe" /update CKAgent
        3⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3792
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /Create /TN "RaonSecure\TouchEnNxKeyManifestSelfHeal" /XML "C:\Users\Admin\AppData\Local\Temp\SHTEB65.tmp" /F
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4824
    • C:\Users\Admin\AppData\Local\Temp\NXKEY_{94096B2E-4B4E-4627-811E-220F69C243F4}\raon_touchenex_Install.exe
      "C:\Users\Admin\AppData\Local\Temp\NXKEY_{94096B2E-4B4E-4627-811E-220F69C243F4}\raon_touchenex_Install.exe" /S
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:4348
    • C:\Users\Admin\AppData\Local\Temp\NXKEY_{94096B2E-4B4E-4627-811E-220F69C243F4}\CrossEX_LocalService_Install.exe
      "C:\Users\Admin\AppData\Local\Temp\NXKEY_{94096B2E-4B4E-4627-811E-220F69C243F4}\CrossEX_LocalService_Install.exe" /S
      2⤵
      • Adds Run key to start application
      • Checks computer location settings
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.exe
        "C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3804
      • C:\Windows\SysWOW64\sc.exe
        sc create "CrossEX Live Checker" binpath= "\"C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe\"" start= auto
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2868
      • C:\Windows\SysWOW64\sc.exe
        sc description "CrossEX Live Checker" "checking live status of CrossEXService"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:980
      • C:\Windows\SysWOW64\sc.exe
        sc start "CrossEX Live Checker"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4228
    • C:\Users\Admin\AppData\Local\Temp\NXKEY_{94096B2E-4B4E-4627-811E-220F69C243F4}\FFCert.exe
      "C:\Users\Admin\AppData\Local\Temp\NXKEY_{94096B2E-4B4E-4627-811E-220F69C243F4}\FFCert.exe" -noces
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3704
      • C:\Users\Admin\AppData\Local\Temp\ffcert_raon\Firefox_CertUtil.exe
        C:\Users\Admin\AppData\Local\Temp\ffcert_raon\Firefox_CertUtil.exe "C:\Users\Admin\AppData\Local\Temp\NXKEY_{94096B2E-4B4E-4627-811E-220F69C243F4}\FFCert.exe" -noces
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1792
        • C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe
          "C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe" -A -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release" -i "C:\Program Files (X86)\iniLINE\CrossEX\crossex\rootCA.crt" -n "iniLINE CrossEX RootCA2" -t "CT,C,C"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4908
        • C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe
          "C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe" -L -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4308
  • C:\Windows\SysWOW64\CKSetup64.exe
    C:\Windows\SysWOW64\CKSetup64.exe
    1⤵
    • Executes dropped EXE
    PID:1036
  • C:\Windows\SysWOW64\CKSetup32.exe
    C:\Windows\SysWOW64\CKSetup32.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3364
  • C:\Windows\system32\JRSKD24.SYS
    C:\Windows\system32\JRSKD24.SYS
    1⤵
    • Executes dropped EXE
    PID:4260
  • C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe
    "C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:4256

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        System Services

        1
        T1569

        Service Execution

        1
        T1569.002

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Modify Registry

        3
        T1112

        Subvert Trust Controls

        2
        T1553

        Install Root Certificate

        2
        T1553.004

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        3
        T1012

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        TKMain.dll
        • Path C:\Program Files (x86)\RaonSecure\TouchEn nxKey\TKMain.dll
        • Size 2.7MB
        • SHA256 3f66eef65b216f3779ad20f87caba86fbbfa74cd6c2ee2b6a0739033f60e4381
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CrossEXProtocol.dll
        • Path C:\Program Files (x86)\RaonSecure\bridge\CrossEX\touchenex\1.0.1.1643\CrossEXProtocol.dll
        • Size 2.5MB
        • SHA256 38d95ff02716f32813b9bd684f1e8cf0a757d03b8bf3eb6f6ba7f340839be621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CrossEXService.exe
        • Path C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.exe
        • Size 4.6MB
        • SHA256 10b3f8a17fce15b1f928019d1ad674e239c9ff87c78f6a911789bd3de8920ed6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ObCrossEXService.exe
        • Path C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe
        • Size 106KB
        • SHA256 1a3c00738af028e2732c9ff07ad891946a19241f72ac3aa9e23b1f73766f526b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rootCA.crt
        • Path C:\Program Files (x86)\iniLINE\CrossEX\crossex\rootCA.crt
        • Size 1KB
        • SHA256 a938612c2c61b4dca94d64c7aae466b66114f67e0116d0104e1c2e34c10ae782
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CrossEX_LocalService_Install.exe
        • Path C:\Users\Admin\AppData\Local\Temp\NXKEY_{94096B2E-4B4E-4627-811E-220F69C243F4}\CrossEX_LocalService_Install.exe
        • Size 2.4MB
        • SHA256 d27f8b9796e4ea74ce9371c2802619f4320272783a708d54090dfab7d61a20f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FFCert.exe
        • Path C:\Users\Admin\AppData\Local\Temp\NXKEY_{94096B2E-4B4E-4627-811E-220F69C243F4}\FFCert.exe
        • Size 1.9MB
        • SHA256 b42802a1fbce0d7c761693d86813f04a13386d8b05eb3f49d2f8c8ebcea6f1f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _Chunk.zip
        • Path C:\Users\Admin\AppData\Local\Temp\NXKEY_{94096B2E-4B4E-4627-811E-220F69C243F4}\_Chunk.zip
        • Size 24.6MB
        • SHA256 69c59068c2e57aade7a8ff79d34a4f0baf32a86cfd4b2adaaee89820e9068897
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _Install.ini
        • Path C:\Users\Admin\AppData\Local\Temp\NXKEY_{94096B2E-4B4E-4627-811E-220F69C243F4}\_Install.ini
        • Size 374B
        • SHA256 fa93929cb19b477a2dc4a81f28f2ab4f0c44c94931b560c681d4e606d80d4700
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        raon_touchenex_Install.exe
        • Path C:\Users\Admin\AppData\Local\Temp\NXKEY_{94096B2E-4B4E-4627-811E-220F69C243F4}\raon_touchenex_Install.exe
        • Size 2.6MB
        • SHA256 194d8309dcbc22754ec5566b05fe797666255bd9e7a2421a31184aa994f34985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SHTD2FB.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\SHTD2FB.tmp
        • Size 2KB
        • SHA256 362b122726e14122139932d9591cf0d8b1011499d7fdce872ee5b608931efc02
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SHTD5F8.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\SHTD5F8.tmp
        • Size 2KB
        • SHA256 2633eeac3af6573b1a0dd011c47e1706808cdb9d273fc85c4386f81fd615fb5f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        etilqs_HU1iFAHc84neEJYUqZt5
        • Path C:\Users\Admin\AppData\Local\Temp\etilqs_HU1iFAHc84neEJYUqZt5
        • Size 2KB
        • SHA256 6cb28c61eb47e467d0153190b9ba88ac59265c44db782d274ea0d88e3930e5a1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Firefox_CertUtil.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ffcert_raon\Firefox_CertUtil.exe
        • Size 253KB
        • SHA256 e1b358325eb3d27395db248bc6a2bcc3f310c91e6d3ca9accefa50f41db62499
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        certutil.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe
        • Size 101KB
        • SHA256 5950722034c8505daa9b359127feb707f16c37d2f69e79d16ee6d9ec37690478
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        freebl3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\freebl3.dll
        • Size 217KB
        • SHA256 ffc7558a61a4e6546cf095bdeabea19f05247a0daa02dca20ea3605e7fc62c77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libnspr4.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\libnspr4.dll
        • Size 195KB
        • SHA256 1c158e680749e642e55f721f60a71314e26e03e785cd92e560bf650b83c4c3c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libplc4.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\libplc4.dll
        • Size 14KB
        • SHA256 751c2156dc00525668dd990d99f7f61c257951c3fad01c0ee6359fcdff69f933
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libplds4.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\libplds4.dll
        • Size 12KB
        • SHA256 38a906373419501966daf6ec19ca2f8db7b29609128ae5cb424d2aa511652c29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcr100.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\msvcr100.dll
        • Size 755KB
        • SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nss3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\nss3.dll
        • Size 780KB
        • SHA256 3f997d3f1674de9fd119f275638861bc229352f12c70536d8c83a70fcc370847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nssutil3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\nssutil3.dll
        • Size 91KB
        • SHA256 1af1ac51a92b36de8d85d1f572369815404912908c3a489a6cd7ca2350c2a93d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        smime3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\smime3.dll
        • Size 95KB
        • SHA256 aba2732c7a016730e94e645dd04e8fafcc173fc2e5e2aac01a1c0c66ead1983e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        softokn3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\softokn3.dll
        • Size 168KB
        • SHA256 22ecece561510f77b100cff8109e5ed492c34707b7b14e0774aaa9ca813de4ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\sqlite3.dll
        • Size 414KB
        • SHA256 00db98ab4d50e9b26ecd193bfad6569e1dd395db14246f8c233febba93965f7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsrFA0C.tmp\System.dll
        • Size 12KB
        • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyFF5B.tmp\nsExec.dll
        • Size 7KB
        • SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CKSetup32.exe
        • Path C:\Windows\SysWOW64\CKSetup32.exe
        • Size 4.7MB
        • SHA256 c57577898f805800cc59a344727b3aaae177105122786095bc208cfc61278789
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CKSetup64.exe
        • Path C:\Windows\SysWOW64\CKSetup64.exe
        • Size 2.1MB
        • SHA256 d5bf7118e1a07bdc7855550d28e392f0855be47a8e2d0849560e8889dcced711
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CKAgent.exe
        • Path C:\Windows\System32\CKAgent.exe
        • Size 182KB
        • SHA256 45b8a1c99edf246bc241ffcd8dc2deabcf8475ca4179735a318b526522680d77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CKAgentNXE.exe
        • Path C:\Windows\System32\CKAgentNXE.exe
        • Size 240KB
        • SHA256 3a3dbd5a26c0e08ccb19183ec814a0b24675aaa8982e020f25fc92d4c58a67f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        JRSKD24.SYS
        • Path C:\Windows\System32\JRSKD24.SYS
        • Size 155KB
        • SHA256 c765b554a8fdc21c201678d26e32394ca3b69757add643af1ebf8a744871ab32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        JRSUKD25.SYS
        • Path C:\Windows\System32\JRSUKD25.SYS
        • Size 150KB
        • SHA256 1322d3b236314e5e58e7497f5398c530a422b32a0eb07e733b8520758ae33c8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2876-0-0x0000000000930000-0x0000000002527000-memory.dmp
        Download

        memory/2876-76-0x0000000000930000-0x0000000002527000-memory.dmp
        Download

        memory/2876-1-0x0000000002526000-0x0000000002527000-memory.dmp
        Download

        memory/2876-324-0x0000000000930000-0x0000000002527000-memory.dmp
        Download