Overview

overview

8

Static

static

3

clearcreek...qQ.exe

windows10-2004-x64

6

clearcreek...qQ.exe

windows11-ltsc_2024-x64

6

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDIR/INetC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

8

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...ay.dll

windows10-2004-x64

3

$PLUGINSDI...ay.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ON.dll

windows10-2004-x64

3

$PLUGINSDI...ON.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...rk.dll

windows10-2004-x64

3

$PLUGINSDI...rk.dll

windows11-ltsc_2024-x64

3

$TEMP/Inte...er.exe

windows10-2004-x64

1

$TEMP/Inte...er.exe

windows11-ltsc_2024-x64

6

$TEMP/RMM....er.exe

windows10-2004-x64

1

$TEMP/RMM....er.exe

windows11-ltsc_2024-x64

1

ArpLookup.dll

windows10-2004-x64

1

ArpLookup.dll

windows11-ltsc_2024-x64

1

Cloud.Back...IO.dll

windows10-2004-x64

1

Cloud.Back...IO.dll

windows11-ltsc_2024-x64

1

CronExpres...or.dll

windows10-2004-x64

1

CronExpres...or.dll

windows11-ltsc_2024-x64

8

Elasticsearch.Net.dll

windows10-2004-x64

1

Elasticsearch.Net.dll

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 18:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    clearcreekchiro_rmm_v2.5.0.67_oidbe8dee45-157a-4ffe-8d17-84b33f21ab62_bidc7LBGrp6ZUW9PSR!Yo1eqQ.exe
  • Size 17.1MB
  • Sample260706-wvsg9abs3x
  • SHA256 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 56 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\clearcreekchiro_rmm_v2.5.0.67_oidbe8dee45-157a-4ffe-8d17-84b33f21ab62_bidc7LBGrp6ZUW9PSR!Yo1eqQ.exe
    "C:\Users\Admin\AppData\Local\Temp\clearcreekchiro_rmm_v2.5.0.67_oidbe8dee45-157a-4ffe-8d17-84b33f21ab62_bidc7LBGrp6ZUW9PSR!Yo1eqQ.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4436
    • C:\Windows\SysWOW64\EVENTCREATE.EXE
      "C:\Windows\system32\EVENTCREATE.EXE" /T INFORMATION /L APPLICATION /ID 100 /SO "MSP360 RMM Agent installer" /D "Begin installation."
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1192
    • C:\Windows\SysWOW64\CMD.EXE
      "C:\Windows\system32\CMD.EXE" /C move /y "C:\Users\Admin\AppData\Local\Temp\RMM Agent\install.log" "C:\Program Files\RMM Agent\"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3352
    • C:\Windows\SysWOW64\CMD.EXE
      "C:\Windows\system32\CMD.EXE" /C dotnet --list-runtimes 1> C:\Users\Admin\AppData\Local\Temp\nsf9C67.tmp 2>&1
      2⤵
      • System Location Discovery: System Language Discovery
      • System Time Discovery
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Program Files\dotnet\dotnet.exe
        dotnet --list-runtimes
        3⤵
        • System Time Discovery
        PID:2644
    • C:\Windows\SysWOW64\CMD.EXE
      "C:\Windows\system32\CMD.EXE" /C copy "C:\Program Files\RMM Agent\install.log"+C:\Users\Admin\AppData\Local\Temp\nsf9C67.tmp "C:\Program Files\RMM Agent\install.log"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3440
    • C:\Users\Admin\AppData\Local\Temp\nsfB57F.tmp
      C:\Users\Admin\AppData\Local\Temp\nsfB57F.tmp /passive /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3640
      • C:\Windows\Temp\{89899D4D-9898-49F1-94CD-799D91C10BBB}\.cr\nsfB57F.tmp
        "C:\Windows\Temp\{89899D4D-9898-49F1-94CD-799D91C10BBB}\.cr\nsfB57F.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsfB57F.tmp" -burn.filehandle.attached=748 -burn.filehandle.self=752 /passive /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3556
        • C:\Windows\Temp\{79E9FAF9-B151-4B56-9A0B-F1C081223A4B}\.be\windowsdesktop-runtime-8.0.22-win-x64.exe
          "C:\Windows\Temp\{79E9FAF9-B151-4B56-9A0B-F1C081223A4B}\.be\windowsdesktop-runtime-8.0.22-win-x64.exe" -q -burn.elevated BurnPipe.{66E9D336-70BC-40F6-B395-1F662E3A5B0B} {87C29FB6-6CDD-47E9-8684-26F388BCD39A} 3556
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:5512
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 980
          4⤵
          • Program crash
          PID:1528
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 34D4073A16068B6358A6B007154BF09D
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5016
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 79BAE8E7A04D7B014CA7890A38071034
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:552
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 76B74EA5B508DF1667AD252B4163220F
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1496
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 2BFAD4350DF5ACBBD5A94EB630A82B34
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4692
  • C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe
    "C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4624
    • C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe
      "C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260706191648.log"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5980
      • C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe
        "C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260706191648.log"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:6012
        • C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe
          "C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" -q -burn.elevated BurnPipe.{24A58D7F-1CB7-4354-AFCD-EF0A9C05BD5F} {A81432C6-A983-4932-948D-F61F2CA151B8} 6012
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2400
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 6012 -s 1048
          4⤵
          • Program crash
          PID:3660
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 3556 -ip 3556
    1⤵
      PID:2584
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 6012 -ip 6012
      1⤵
        PID:1104

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e59db07.rbs
            • Path C:\Config.Msi\e59db07.rbs
            • Size 48KB
            • SHA256 c51f1003be5d6c5acda522448a02c99219422c2c8ec5a13885c4f1fa73324616
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59db0c.rbs
            • Path C:\Config.Msi\e59db0c.rbs
            • Size 9KB
            • SHA256 1114fdb0887935b751aa18a6baec8746e7578dffd67f8566fe197b5c9166789f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59db11.rbs
            • Path C:\Config.Msi\e59db11.rbs
            • Size 11KB
            • SHA256 90c6d52781618da99b3dcf6ca7acbfd4403694d087381cd10e5d19154db8a808
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59db16.rbs
            • Path C:\Config.Msi\e59db16.rbs
            • Size 8KB
            • SHA256 e0f9753b7d3b07146c41c4750febdf3c89538adc5cd5f3c5fea8d7aede6a32e4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59db17.rbf
            • Path C:\Config.Msi\e59db17.rbf
            • Size 143KB
            • SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59db18.rbf
            • Path C:\Config.Msi\e59db18.rbf
            • Size 3B
            • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
            • MD5 SHA1 SHA512
            Submit Download

            e59db1c.rbs
            • Path C:\Config.Msi\e59db1c.rbs
            • Size 87KB
            • SHA256 75e3d699730387443c1f7c935b83b3e6fda1083db8e41d827d8072315317f8a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            install.log
            • Path C:\Program Files\RMM Agent\install.log
            • Size 9KB
            • SHA256 60e4ae1cad971a44827cc7cc93cb155f317ca87e3fc0adbc17c20419dfe10022
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            install.log
            • Path C:\Program Files\RMM Agent\install.log
            • Size 9KB
            • SHA256 97dd3b8ca137765930ddf259305a7da3f1430942f68a5e689b9fb4db1bc49b58
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            state.rsm
            • Path C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\state.rsm
            • Size 908B
            • SHA256 2c5d736d9c9abe60494bed85f9913cbd865e51675bd435324e691c6bc3ab1c5d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260706191648.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260706191648.log
            • Size 10KB
            • SHA256 5c12759a29ff303cf31f80ee76cb4e8bca5f462fa54e484b0806d66665a76ce3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260706191648_000_dotnet_runtime_8.0.22_win_x64.msi.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260706191648_000_dotnet_runtime_8.0.22_win_x64.msi.log
            • Size 2KB
            • SHA256 8bc4b8098654a1d5f429549409d320c5ca7d490369424c446f6e5c77739c4bb2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            install.log
            • Path C:\Users\Admin\AppData\Local\Temp\RMM Agent\install.log
            • Size 8KB
            • SHA256 391c60a013a58e93e0e6fb05ed860f3c06988cb93af5220e4e36d5f85dc9378c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            INetC.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsc4935.tmp\INetC.dll
            • Size 21KB
            • SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsc4935.tmp\System.dll
            • Size 10KB
            • SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UAC.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsc4935.tmp\UAC.dll
            • Size 17KB
            • SHA256 e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsArray.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsc4935.tmp\nsArray.dll
            • Size 12KB
            • SHA256 81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsc4935.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsExec.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsc4935.tmp\nsExec.dll
            • Size 6KB
            • SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            processwork.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsc4935.tmp\processwork.dll
            • Size 231KB
            • SHA256 27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsf9C67.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\nsf9C67.tmp
            • Size 552B
            • SHA256 3a540187aba2047118a389c22152a488c215f21766cd75e59c187f7c414bddb1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSIEB02.tmp
            • Path C:\Windows\Installer\MSIEB02.tmp
            • Size 219KB
            • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bg.png
            • Path C:\Windows\Temp\{79E9FAF9-B151-4B56-9A0B-F1C081223A4B}\.ba\bg.png
            • Size 4KB
            • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{79E9FAF9-B151-4B56-9A0B-F1C081223A4B}\.ba\wixstdba.dll
            • Size 190KB
            • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_host_8.0.22_win_x64.msi
            • Path C:\Windows\Temp\{79E9FAF9-B151-4B56-9A0B-F1C081223A4B}\dotnet_host_8.0.22_win_x64.msi
            • Size 708KB
            • SHA256 41bee98f21575992e7a5ae1e0e499881117e62f46d722fe183016338c025ee32
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_hostfxr_8.0.22_win_x64.msi
            • Path C:\Windows\Temp\{79E9FAF9-B151-4B56-9A0B-F1C081223A4B}\dotnet_hostfxr_8.0.22_win_x64.msi
            • Size 776KB
            • SHA256 5348ead3f40fbede2047d43c8303e20b12bfc2e0bdf5ebf5020ebc3b311b28d4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_runtime_8.0.22_win_x64.msi
            • Path C:\Windows\Temp\{79E9FAF9-B151-4B56-9A0B-F1C081223A4B}\dotnet_runtime_8.0.22_win_x64.msi
            • Size 26.3MB
            • SHA256 efab95895aa3d5dee85b686cef9a81c613cd8bdc1cadcc9ecfe248804e96b4fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            windowsdesktop_runtime_8.0.22_win_x64.msi
            • Path C:\Windows\Temp\{79E9FAF9-B151-4B56-9A0B-F1C081223A4B}\windowsdesktop_runtime_8.0.22_win_x64.msi
            • Size 29.1MB
            • SHA256 4605b47ecf5e0512c595e2ea514985f0187765b4d80eca72c95bba40c61c38a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsfB57F.tmp
            • Path C:\Windows\Temp\{89899D4D-9898-49F1-94CD-799D91C10BBB}\.cr\nsfB57F.tmp
            • Size 608KB
            • SHA256 daa2e35615ad3b138003d150096c27dd03bd754c434657031e64c33376eddb40
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.wxl
            • Path C:\Windows\Temp\{E785B79F-C8D2-4865-92E5-F2D26F81721B}\.ba\1033\thm.wxl
            • Size 5KB
            • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4436-34-0x0000000002330000-0x0000000002371000-memory.dmp
            Download