Overview

overview

7

Static

static

3

BorisFX Mo....1.exe

windows10-2004-x64

7

BorisFX Mo....1.exe

windows11-21h2-x64

Analysis

  • user interaction
    yes
  • max time kernel
    109s
  • max time network
    143s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 04:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    BorisFX Mocha Pro 2025.5 Adobe v12.5.1.exe
  • Size 987.4MB
  • Sample260604-e266jshz2x
  • SHA256 ca20b267a2af456a55abef4ad3542207fc81e4dd9aae0347072a751b0a5b72a4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 24 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\BorisFX Mocha Pro 2025.5 Adobe v12.5.1.exe
    "C:\Users\Admin\AppData\Local\Temp\BorisFX Mocha Pro 2025.5 Adobe v12.5.1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5248
    • C:\Users\Admin\AppData\Local\Temp\is-G17E9.tmp\BorisFX Mocha Pro 2025.5 Adobe v12.5.1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-G17E9.tmp\BorisFX Mocha Pro 2025.5 Adobe v12.5.1.tmp" /SL5="$30248,1034167496,1015808,C:\Users\Admin\AppData\Local\Temp\BorisFX Mocha Pro 2025.5 Adobe v12.5.1.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5552
      • C:\Windows\system32\net.exe
        "C:\Windows\system32\net.exe" stop RLM-BorisFX
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4376
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop RLM-BorisFX
          4⤵
            PID:4696
        • C:\Users\Admin\AppData\Local\Temp\is-RMAHT.tmp\vc_redist.x64.exe
          "C:\Users\Admin\AppData\Local\Temp\is-RMAHT.tmp\vc_redist.x64.exe" /q /norestart
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5392
          • C:\Windows\Temp\{EBB44846-539A-4C29-8046-B8406C9DFC71}\.cr\vc_redist.x64.exe
            "C:\Windows\Temp\{EBB44846-539A-4C29-8046-B8406C9DFC71}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-RMAHT.tmp\vc_redist.x64.exe" -burn.filehandle.attached=740 -burn.filehandle.self=744 /q /norestart
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1968
            • C:\Windows\Temp\{39D19EAE-F1E4-4009-A4DC-21BBC3ED871A}\.be\VC_redist.x64.exe
              "C:\Windows\Temp\{39D19EAE-F1E4-4009-A4DC-21BBC3ED871A}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1889C181-041C-4A13-9630-998BC283D307} {E5266B56-DEA1-425F-8F63-2FD9EA9D38C8} 1968
              5⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1572
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={b49c10dd-4d54-45f8-ad13-fa25704456a4} -burn.filehandle.self=1028 -burn.embedded BurnPipe.{7FBDBC40-9B0C-4B53-90FE-772D6A02BD78} {B2B0132C-4027-419A-A515-13B67D2A8996} 1572
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1564
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={b49c10dd-4d54-45f8-ad13-fa25704456a4} -burn.filehandle.self=1028 -burn.embedded BurnPipe.{7FBDBC40-9B0C-4B53-90FE-772D6A02BD78} {B2B0132C-4027-419A-A515-13B67D2A8996} 1572
                  7⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1064
                  • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{384E22D2-0B71-4520-9402-28A84BBB385D} {F04C3D64-07B6-442A-B1A4-B149AAAA26A5} 1064
                    8⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:4060
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:5000
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3440
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5316
    • C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5868
      • C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260604053321.log"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3400
        • C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260604053321.log"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1044
          • C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{8BC9AC68-DDA6-4CCA-BEC7-106605232DF9} {0462C967-8BE2-4DF9-94CC-3386EC223D74} 1044
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:5880
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa39a3855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:5620

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5a5c11.rbs
          • Path C:\Config.Msi\e5a5c11.rbs
          • Size 19KB
          • SHA256 350758689bba24f41e4c9e4c350b444129bdb50f4a2c9a4f8960db8d5ffec879
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a5c1d.rbs
          • Path C:\Config.Msi\e5a5c1d.rbs
          • Size 19KB
          • SHA256 15b6cfa1058cf0cacff47c620f8b5cce2df476dc7794e175c09e67acf74fafce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a5c24.rbs
          • Path C:\Config.Msi\e5a5c24.rbs
          • Size 21KB
          • SHA256 a09dc763ded8b58d3268ecffc1637876e440c4a73a0c7c390c02d5afe0196068
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a5c33.rbs
          • Path C:\Config.Msi\e5a5c33.rbs
          • Size 21KB
          • SHA256 74dee1688232f04ed6b97276abd9867bfa2523a71f8b70056d84627076abbbdb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mochapro.exe
          • Path C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\mochaui\bin\mochapro.exe
          • Size 420KB
          • SHA256 361542fe4d6d2a3130ed285a4345b63fc8cc4f9e137c5c0b583168172e1c0895
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-OTTBP.tmp
          • Path C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\mochaui\bin\usd\usdShaders\resources\shaders\is-OTTBP.tmp
          • Size 1KB
          • SHA256 f200ce8c46927df71a168f06a8101b84fd4a698c244c8619c56f3d7636cd04cd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Mocha Pro Plugin Release Notes.pdf
          • Path C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\mochaui\help\Mocha Pro Plugin Release Notes.pdf
          • Size 2.0MB
          • SHA256 9e9ebc551351e394a3b62d4767175046fef0c52c148c68a661321af83355e9c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mocha Pro Plugin UserGuide.pdf
          • Path C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\mochaui\help\Mocha Pro Plugin UserGuide.pdf
          • Size 35.3MB
          • SHA256 c627324fc0b9cf4713e100003b23005cac315f835e781e2f3de7868332cf3018
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-TQ820.tmp
          • Path C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\mochaui\python\lib\site-packages\shiboken2_generator\is-TQ820.tmp
          • Size 2KB
          • SHA256 65a22e12f8fbbf806f27b0ace8a6b5267934408821084399eb0f1b258e4f7edc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          is-FJQDL.tmp
          • Path C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\mochaui\python\lib\test\cjkencodings\is-FJQDL.tmp
          • Size 1KB
          • SHA256 a6bbfb8ecb911d13581f7713391f8c0ceea1edd41537fdb300bbb4d62dd72e9b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          is-7ATFS.tmp
          • Path C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\mochaui\python\lib\test\test_importlib\builtin\is-7ATFS.tmp
          • Size 142B
          • SHA256 8962a375442bddd8d49865f3bf601c2c7a741fe947d8ec667358bb640cd0d19b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          is-52UDS.tmp
          • Path C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\mochaui\python\lib\test\test_importlib\is-52UDS.tmp
          • Size 58B
          • SHA256 cb9a3ce8f18e7d0a0cadb73cc9264772462de953499534736998d3c54f8c7c3c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          is-LR7TT.tmp
          • Path C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\mochaui\python\lib\test\test_importlib\namespacedata01\is-LR7TT.tmp
          • Size 4B
          • SHA256 054edec1d0211f624fed0cbca9d4f9400b0e491c43742af2c5b0abebf0c990d8
          • MD5 SHA1 SHA512
          Submit Download

          is-66AQR.tmp
          • Path C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\mochaui\qml\QtQuick\Controls.2\designer\is-66AQR.tmp
          • Size 2KB
          • SHA256 91d7772e4a193e91a093d59451508cdb89448eaffb4febda26789777afbacf3d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          is-RBAMA.tmp
          • Path C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\mochaui\qml\QtQuick\Controls.2\designer\is-RBAMA.tmp
          • Size 2KB
          • SHA256 a3fff66cd7217029792e7fce403cc658b0ea03b2d3a2860f57479c8ea6bc1372
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          is-L7GUQ.tmp
          • Path C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\ocio\default\luts\is-L7GUQ.tmp
          • Size 92KB
          • SHA256 cca228596b733b0c6815b33da62c6714d75c38e1514a3a548e1866c9a9373377
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          desktop.ini
          • Path C:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025\desktop.ini
          • Size 50B
          • SHA256 78f6dc976b708f4721d39fe40c47c9d171bdda11c28285b8b5fb4e9a5d4a88b1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{b49c10dd-4d54-45f8-ad13-fa25704456a4}\state.rsm
          • Size 980B
          • SHA256 f0d958142672376e3833dcc1be59a19cc9d8fd6b67924baa63ebe00cb558e276
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260604053321.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260604053321.log
          • Size 19KB
          • SHA256 64c5be2dbe1eb0413524e3acfced250d27bfe0b1034c1eae4287a60d9ea8d61d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_amd64_20260604053321_000_vcRuntimeMinimum_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260604053321_000_vcRuntimeMinimum_x64.log
          • Size 2KB
          • SHA256 735f71e73cb8bff5d8e518a20db7dc2556ba483cb1edbdc5af883475c5290599
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260604053321_001_vcRuntimeAdditional_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260604053321_001_vcRuntimeAdditional_x64.log
          • Size 3KB
          • SHA256 379e6dc75eb313e9175905267f320e1602e015cf8eeb82724dd0896928cc5f1e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          BorisFX Mocha Pro 2025.5 Adobe v12.5.1.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-G17E9.tmp\BorisFX Mocha Pro 2025.5 Adobe v12.5.1.tmp
          • Size 3.7MB
          • SHA256 0e88820b8a5b83889ec6d0b8a5e5bc324587123445b2b02604203b69b74bc910
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-RMAHT.tmp\VC_redist.x64.exe
          • Size 24.5MB
          • SHA256 8f9fb1b3cfe6e5092cf1225ecd6659dab7ce50b8bf935cb79bfede1f3c895240
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{39D19EAE-F1E4-4009-A4DC-21BBC3ED871A}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{39D19EAE-F1E4-4009-A4DC-21BBC3ED871A}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Path C:\Windows\Temp\{39D19EAE-F1E4-4009-A4DC-21BBC3ED871A}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Size 5.4MB
          • SHA256 910dd0eed2fe7fa527d07597538d6bee208a44af4647d92cc15a3a0c1eff1900
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab5046A8AB272BF37297BB7928664C9503
          • Path C:\Windows\Temp\{39D19EAE-F1E4-4009-A4DC-21BBC3ED871A}\cab5046A8AB272BF37297BB7928664C9503
          • Size 971KB
          • SHA256 53ad958fd0f76649c18823ec6881f74b97c2487c665a2bc04018a05622922c4a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x64
          • Path C:\Windows\Temp\{39D19EAE-F1E4-4009-A4DC-21BBC3ED871A}\vcRuntimeAdditional_x64
          • Size 208KB
          • SHA256 6e2cfac1c40130ae84eff9812a6b00c0a8a8369ab35fa930d7c787dadfa2331d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x64
          • Path C:\Windows\Temp\{39D19EAE-F1E4-4009-A4DC-21BBC3ED871A}\vcRuntimeMinimum_x64
          • Size 208KB
          • SHA256 ee7012b08160bf722e399a9b3b8c465f8939dea1f867c2cbd7a8f86e1f660c1e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{92F56175-0DE0-477E-B091-FDF2BDEF72A9}\.ba\license.rtf
          • Size 9KB
          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{92F56175-0DE0-477E-B091-FDF2BDEF72A9}\.ba\thm.wxl
          • Size 2KB
          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\Temp\{92F56175-0DE0-477E-B091-FDF2BDEF72A9}\.ba\thm.xml
          • Size 8KB
          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{92F56175-0DE0-477E-B091-FDF2BDEF72A9}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Windows\Temp\{EBB44846-539A-4C29-8046-B8406C9DFC71}\.cr\vc_redist.x64.exe
          • Size 670KB
          • SHA256 bd25d6a5c9ef835802ba25100ce66c9402dbca74d309db5fbaefa1532af31d5a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1064-9061-0x0000000000890000-0x0000000000907000-memory.dmp
          Download

          memory/1564-9062-0x0000000000890000-0x0000000000907000-memory.dmp
          Download

          memory/4060-9059-0x0000000000890000-0x0000000000907000-memory.dmp
          Download

          memory/5248-0-0x0000000000400000-0x0000000000506000-memory.dmp
          Download

          memory/5248-7-0x0000000000400000-0x0000000000506000-memory.dmp
          Download

          memory/5248-9087-0x0000000000400000-0x0000000000506000-memory.dmp
          Download

          memory/5316-9082-0x00000258A2260000-0x00000258A2D22000-memory.dmp
          Download

          memory/5316-9089-0x00000258A2260000-0x00000258A2D22000-memory.dmp
          Download

          memory/5552-1488-0x0000000000400000-0x00000000007BB000-memory.dmp
          Download

          memory/5552-1492-0x0000000000400000-0x00000000007BB000-memory.dmp
          Download

          memory/5552-5-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
          Download

          memory/5552-1490-0x0000000000400000-0x00000000007BB000-memory.dmp
          Download

          memory/5552-9-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
          Download

          memory/5552-9065-0x0000000000400000-0x00000000007BB000-memory.dmp
          Download

          memory/5552-1806-0x0000000000400000-0x00000000007BB000-memory.dmp
          Download

          memory/5552-3765-0x0000000000400000-0x00000000007BB000-memory.dmp
          Download

          memory/5552-1484-0x0000000000400000-0x00000000007BB000-memory.dmp
          Download

          memory/5552-9084-0x0000000000400000-0x00000000007BB000-memory.dmp
          Download

          memory/5552-9086-0x0000000000400000-0x00000000007BB000-memory.dmp
          Download

          memory/5552-8892-0x0000000000400000-0x00000000007BB000-memory.dmp
          Download

          memory/5552-8-0x0000000000400000-0x00000000007BB000-memory.dmp
          Download