Overview

overview

7

Static

static

5

2026-10-14...ry.exe

windows10-2004-x64

7

2026-10-14...ry.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 14:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-14_ac44c48a9952b3cccd3a0acb121c2f3c_coinminer_darkgate_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe
  • Size 3.6MB
  • Sample261014-rygspsts9q
  • SHA256 05559b51393341fe71beab20daf010e7695a7e9eb91b59e01e9cad58f243565f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutioninstallerpersistence

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 29 IoCs
  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 32 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:828
      • C:\Users\Admin\AppData\Local\Temp\2026-10-14_ac44c48a9952b3cccd3a0acb121c2f3c_coinminer_darkgate_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-14_ac44c48a9952b3cccd3a0acb121c2f3c_coinminer_darkgate_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4964
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4280
          • C:\Users\Admin\AppData\Local\Temp\@AE2987.tmp.exe
            "C:\Users\Admin\AppData\Local\Temp\@AE2987.tmp.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2336
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
              5⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:416
              • C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe
                "C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1812
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
                  7⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:896
                  • C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe
                    "C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe" /i 1812
                    8⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:944
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "
                      9⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2456
                      • C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe
                        "C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe"
                        10⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5032
                        • C:\Users\Admin\AppData\Roaming\injector_s.exe
                          "C:\Users\Admin\AppData\Roaming\injector_s.exe"
                          11⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1468
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a0x.bat" "C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe" "C:\Users\Admin\AppData\Local\Temp\a0x.bat""
                          11⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          PID:4148
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
              5⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:3508
          • C:\Users\Admin\AppData\Local\Temp\2026-10-14_ac44c48a9952b3cccd3a0acb121c2f3c_coinminer_darkgate_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-10-14_ac44c48a9952b3cccd3a0acb121c2f3c_coinminer_darkgate_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:804
            • C:\Users\Admin\AppData\Local\Temp\is-N5NMV.tmp\2026-10-14_ac44c48a9952b3cccd3a0acb121c2f3c_coinminer_darkgate_elex_gcleaner_nymaim_rhadamanthys_wannacry.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-N5NMV.tmp\2026-10-14_ac44c48a9952b3cccd3a0acb121c2f3c_coinminer_darkgate_elex_gcleaner_nymaim_rhadamanthys_wannacry.tmp" /SL5="$7027A,1851337,785920,C:\Users\Admin\AppData\Local\Temp\2026-10-14_ac44c48a9952b3cccd3a0acb121c2f3c_coinminer_darkgate_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:3448
              • C:\Program Files\Tenda\win10_x64\DPInst64.exe
                "C:\Program Files\Tenda\win10_x64\DPInst64.exe" /A /SW /SA
                6⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                PID:4712
              • C:\Windows\system32\sc.exe
                "C:\Windows\system32\sc.exe" create AicWifiService start= auto binPath= "C:\Program Files\Tenda\AicWifiService.exe"
                6⤵
                • Launches sc.exe
                PID:4544
              • C:\Windows\system32\sc.exe
                "C:\Windows\system32\sc.exe" start AicWifiService
                6⤵
                • Launches sc.exe
                PID:4664
              • C:\Windows\system32\sc.exe
                "C:\Windows\system32\sc.exe" failure AicWifiService reset= 3600 actions=restart/60000/restart/120000/restart/120000
                6⤵
                • Launches sc.exe
                PID:5608
              • C:\Program Files\Tenda\tool\devcon.exe
                "C:\Program Files\Tenda\tool\devcon.exe" /rescan
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:5360
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{013c484f-3bfd-324c-a01e-9ecc8fc85c0f}\aicusbwifi.inf" "9" "4e7ef493b" "0000000000000178" "WinSta0\Default" "0000000000000170" "208" "c:\program files\tenda\win10_x64"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4956
    • C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe
      "C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4672
    • C:\Program Files\Tenda\AicWifiService.exe
      "C:\Program Files\Tenda\AicWifiService.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Reads the TCP/IP host and domain name from the registry
      PID:3332

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          2
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AicWifiService.exe
          • Path C:\Program Files\Tenda\AicWifiService.exe
          • Size 33KB
          • SHA256 130cb55502e91a6e488d4ced8ee2c55855d27b193f7d9074425e7a86be2c4612
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          devcon.exe
          • Path C:\Program Files\Tenda\tool\devcon.exe
          • Size 81KB
          • SHA256 40ac07fec5d9204cbb87d52bce95aaec67d37233bc3ffd9e9baf02d0b55ab912
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unins000.exe
          • Path C:\Program Files\Tenda\unins000.exe
          • Size 3.0MB
          • SHA256 9be4c36261e444e2e0107248cdca69da47f7fea72ac300aeeba1629741f85df0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-8KRUM.tmp
          • Path C:\Program Files\Tenda\win10_x64\is-8KRUM.tmp
          • Size 664KB
          • SHA256 b6bae3bb8fe8dee5db004965bbea0466bab7bb4b4193e8fa544abf47f03562a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-1BE7F.tmp
          • Path C:\Program Files\Tenda\win10_x86\is-1BE7F.tmp
          • Size 539KB
          • SHA256 0af038b08f84604d2805202b5429210c5ef37f23623b8dae2bd8921e4e76a0c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-URNF3.tmp
          • Path C:\Program Files\Tenda\win7_x86\is-URNF3.tmp
          • Size 10KB
          • SHA256 ba6ee26b3c8bcf8d722c5108e3ff86a3ec0b245828894d46e01415eebd5092e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-10-14_ac44c48a9952b3cccd3a0acb121c2f3c_coinminer_darkgate_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-10-14_ac44c48a9952b3cccd3a0acb121c2f3c_coinminer_darkgate_elex_gcleaner_nymaim_rhadamanthys_wannacry.exe
          • Size 2.6MB
          • SHA256 00339dadb73dec757cf8c584b25277c45704afc8a9ced8dba8f9ffe91532745d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          @AE2987.tmp.exe
          • Path C:\Users\Admin\AppData\Local\Temp\@AE2987.tmp.exe
          • Size 965KB
          • SHA256 2a1395cf4ed05c3136dd4c405c3cd3da2030bce667cb8ba10e0e7259d5e26d44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Se3178.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\Se3178.tmp
          • Size 768B
          • SHA256 301a9064fe6952d3319f23593287b6144c0d278cad9085c63fc697792d082338
          • MD5 SHA1 SHA512
          Submit Download

          a0x.bat
          • Path C:\Users\Admin\AppData\Local\Temp\a0x.bat
          • Size 44B
          • SHA256 b1e4990bf84c402594a53a2a98011b8880239e790872de1f6c7b8b9cd1005cf5
          • MD5 SHA1 SHA512
          Submit Download

          botva2.dll
          • Path C:\Users\Admin\AppData\Local\Temp\is-G8V6O.tmp\botva2.dll
          • Size 37KB
          • SHA256 450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          innocallback.dll
          • Path C:\Users\Admin\AppData\Local\Temp\is-G8V6O.tmp\innocallback.dll
          • Size 63KB
          • SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pbbg.png
          • Path C:\Users\Admin\AppData\Local\Temp\is-G8V6O.tmp\pbbg.png
          • Size 2KB
          • SHA256 443904c6db5ed717ed94e5229b332afbca9a4afc33a4efab7782e90bdba6b1eb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          pbfg.png
          • Path C:\Users\Admin\AppData\Local\Temp\is-G8V6O.tmp\pbfg.png
          • Size 409B
          • SHA256 c7f8e22f37156e5345ec3fbf45ff4c4dc8130dadee30dfcd5a2454bec7755533
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wifi.png
          • Path C:\Users\Admin\AppData\Local\Temp\is-G8V6O.tmp\wifi.png
          • Size 18KB
          • SHA256 1af2e133c6866c1dc02ac5e701a53bc9a24500ad3d996ade2797a8f5378ccf49
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-10-14_ac44c48a9952b3cccd3a0acb121c2f3c_coinminer_darkgate_elex_gcleaner_nymaim_rhadamanthys_wannacry.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-N5NMV.tmp\2026-10-14_ac44c48a9952b3cccd3a0acb121c2f3c_coinminer_darkgate_elex_gcleaner_nymaim_rhadamanthys_wannacry.tmp
          • Size 3.0MB
          • SHA256 6ca8c186a90d6c29517f895a4d65e67397919829518eec974a9f907e6940ec82
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tmp389A.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\tmp389A.tmp
          • Size 619KB
          • SHA256 5864a4bfc200c2d9aadfa8c9540da1af036c2c712309da9d88fa901e9582b950
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tmp38CA.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\tmp38CA.tmp
          • Size 121KB
          • SHA256 e1a25be30164e6aca9bf97454be217f2b49e6f65fa4d3ac710637f6ef8a213a0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tmp38DB.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\tmp38DB.tmp
          • Size 131KB
          • SHA256 ba6a7655e3860d01201ffbce06398dff71fd97acff99e95ac8cd2a3e3161d1c0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tmp38EB.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\tmp38EB.tmp
          • Size 99KB
          • SHA256 4a8ea33966592b337d31802f55ea7f901caec037b5b1bf18a9e2b6b044915781
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tmp390C.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\tmp390C.tmp
          • Size 172KB
          • SHA256 015caba690febdd5403ad86a04bb9763db7408a3b3f0be85f9c364580dac4649
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tmp390D.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\tmp390D.tmp
          • Size 76KB
          • SHA256 a1d30db63fcb26cfcc1e128f4b840ac1c822267a8f17de45cc2e2fc19147e41f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          aicusbwifi.sys
          • Path C:\Users\Admin\AppData\Local\Temp\{013c484f-3bfd-324c-a01e-9ecc8fc85c0f}\aicusbwifi.sys
          • Size 1.2MB
          • SHA256 b806f214ba851bad11849228b752e1725d5bc3f0ca58efcea531c590b54341db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WdExt.exe
          • Path C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe
          • Size 967KB
          • SHA256 da854ea650818ecef223b5103c16f75aa8f1152fec2c0ac198dc44f9b94c85af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          kb50145.exe
          • Path C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe
          • Size 76KB
          • SHA256 048655d212b269073107e4636125ceeea262acce1d364fc512a0cc8f4783dcf7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          module_launcher.exe
          • Path C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe
          • Size 172KB
          • SHA256 b4febd6c6fc42b7d86b575f6c44f0d49fbe9ec02e98d3be00cb26b3e32a3a6d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Admin0.bat
          • Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
          • Size 105B
          • SHA256 ff5e923c453d3d61a7989b2b0f978b0bba924a7052667311c9eed54852a20cfd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Admin1.bat
          • Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
          • Size 196B
          • SHA256 00587461ebb5832ce8474269f01cddab03cd7ef42bc32af061cec68398bb4cc0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Admin1.bat
          • Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
          • Size 122B
          • SHA256 9e124feb8a914c12ad5fb9e31c54b3f1caa336d9a98c501aa1b57b2dded979fd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Admin2.bat
          • Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
          • Size 107B
          • SHA256 bf1b95975082845d3d9d8948999d69d666dfe50d741a36cdf81fa180fa4c777b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          mydll.dll
          • Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
          • Size 382KB
          • SHA256 f0a24c3d4e5f5948dd84a9db1206e07b904c6c12ff9e20de2a2ad7d6b04c6946
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          injector_s.exe
          • Path C:\Users\Admin\AppData\Roaming\injector_s.exe
          • Size 188KB
          • SHA256 22c5c5bcb256c1dcaead463c92a70107ba1bac40564fe1e7d46594c6a3936778
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dberr.txt
          • Path C:\Windows\System32\CatRoot2\dberr.txt
          • Size 69KB
          • SHA256 895e797c22d69c39978f9bcf0d4e2b3f34ffdd6ba1022ab557e905e09ebfa921
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          aicusbwifi.inf_amd64_368627adf12b7810.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\aicusbwifi.inf_amd64_368627adf12b7810.ini
          • Size 430B
          • SHA256 c306a08a716294fae428a53debafc7964ea38c4590fc3442f699b5bd31bdd21f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          AICUSB~1.CAT
          • Path \??\c:\PROGRA~1\tenda\WIN10_~1\AICUSB~1.CAT
          • Size 12KB
          • SHA256 db830bff20f135c79cbd4c3cd71889abb8db86d3a3cb9f04788b7d59788f3ab9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          aicusbwifi.inf
          • Path \??\c:\program files\tenda\win10_x64\aicusbwifi.inf
          • Size 8KB
          • SHA256 31fa61c4a44f05c74cb5f347d4d12c5c14c0eb553b434769563f28859792df1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/804-22-0x0000000000400000-0x00000000004CD000-memory.dmp
          Download

          memory/804-302-0x0000000000400000-0x00000000004CD000-memory.dmp
          Download

          memory/2336-18-0x0000000010000000-0x0000000010015000-memory.dmp
          Download

          memory/3332-286-0x000001FD9EEF0000-0x000001FD9EEFC000-memory.dmp
          Download

          memory/3448-65-0x0000000004090000-0x000000000409F000-memory.dmp
          Download

          memory/3448-59-0x0000000003F70000-0x0000000003F85000-memory.dmp
          Download

          memory/3448-301-0x0000000000400000-0x0000000000708000-memory.dmp
          Download