Overview

overview

7

Static

static

3

Audja-Setu....1.exe

windows10-2004-x64

7

Audja-Setu....1.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/06/2026, 12:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Audja-Setup-1.0.0-beta.1.exe
  • Size 47.2MB
  • Sample260626-p4sfaact7p
  • SHA256 eff07895b3f834235d8da83d36eb5faa7e1f2a9159820fca81c83097647cf969
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 50 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Audja-Setup-1.0.0-beta.1.exe
    "C:\Users\Admin\AppData\Local\Temp\Audja-Setup-1.0.0-beta.1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Users\Admin\AppData\Local\Temp\is-R9MY6MJFL8.tmp\Audja-Setup-1.0.0-beta.1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-R9MY6MJFL8.tmp\Audja-Setup-1.0.0-beta.1.tmp" /SL5="$D0142,47994533,885248,C:\Users\Admin\AppData\Local\Temp\Audja-Setup-1.0.0-beta.1.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4372
      • C:\Users\Admin\AppData\Local\Temp\is-SIJ40PYZGL.tmp\vc_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-SIJ40PYZGL.tmp\vc_redist.x64.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3260
        • C:\Windows\Temp\{9B31A204-EC3B-4D47-98F1-BEC4D83F486F}\.cr\vc_redist.x64.exe
          "C:\Windows\Temp\{9B31A204-EC3B-4D47-98F1-BEC4D83F486F}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-SIJ40PYZGL.tmp\vc_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /install /quiet /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2492
          • C:\Windows\Temp\{C04FBAAB-707E-4CD3-B32A-B7BC1EA88F7B}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{C04FBAAB-707E-4CD3-B32A-B7BC1EA88F7B}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BD4AE402-CF32-4177-8722-9E1B6DA2B8C4} {8CC11578-FC93-400A-9E3B-28E09169F9B5} 2492
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3964
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=1176 -burn.embedded BurnPipe.{012F78B2-0640-4F1D-A659-565CF427FA3E} {A879866F-5ED6-4764-A4B3-8A3094AAAB33} 3964
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3296
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=1176 -burn.embedded BurnPipe.{012F78B2-0640-4F1D-A659-565CF427FA3E} {A879866F-5ED6-4764-A4B3-8A3094AAAB33} 3964
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1932
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{EB98A5AC-FAD4-49B5-9AFD-499D8405E274} {4BE61B2E-CD60-43B1-AFAD-178F514C56DD} 1932
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4776
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:416
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:1508
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1296
    • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5084
      • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260626135414.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4024
        • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260626135414.log" /install
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4452
          • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5DE53466-2092-4350-AD07-96DEC3B1323A} {DB5BEA1D-F187-4D7F-AB8D-31F2E97A810F} 4452
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:5048
    • C:\Program Files\Audja\Audja.exe
      "C:\Program Files\Audja\Audja.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:2368

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e598383.rbs
          • Path C:\Config.Msi\e598383.rbs
          • Size 19KB
          • SHA256 4690953d5797ab7de5a140025de504f0c17eb98bd317a49fce7727d6aeed9168
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e59838f.rbs
          • Path C:\Config.Msi\e59838f.rbs
          • Size 19KB
          • SHA256 153a3ac80239a5cc9b380bb2c0b3d2d31b3de588c0263560b211c97967639323
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e598396.rbs
          • Path C:\Config.Msi\e598396.rbs
          • Size 21KB
          • SHA256 eb868672be95ea2a7e35fc01314e1aa6698cca8417a635a345c5d2663028a864
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5983a5.rbs
          • Path C:\Config.Msi\e5983a5.rbs
          • Size 21KB
          • SHA256 bfca96586e75cfb41731ae0a194896abc65b9a722f5d3aa3a7e38c7a3b77afd1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Audja.exe
          • Path C:\Program Files\Audja\Audja.exe
          • Size 3.4MB
          • SHA256 67f62d0eb8e35c03ee020932bd1fea7340b2d6c73a7a19fc6de56da6a9688d8a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AudjaIcon.ico
          • Path C:\Program Files\Audja\AudjaIcon.ico
          • Size 45KB
          • SHA256 f7b3cd7f9e86b007507eb5cf11b1d6ec88376804786b48c3bab5b785d7d62719
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MRMesh.dll
          • Path C:\Program Files\Audja\MRMesh.dll
          • Size 5.4MB
          • SHA256 ef741d44a9459ec58e6b2b4606a7b54934f4f68ef381581fd7adc7f5f4e2269a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MRVoxels.dll
          • Path C:\Program Files\Audja\MRVoxels.dll
          • Size 3.8MB
          • SHA256 4e0ef44a48eba2ab92fbdbaf1f28191ac47c3afc5fbdd72ce882e16f17f00b6d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MTRLogo.png
          • Path C:\Program Files\Audja\MTRLogo.png
          • Size 11KB
          • SHA256 912ad66cd3d5d0792031b2cd9e9e67c4f8982b1d7c3136564605d1bc48876771
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          assimp-vc143-mt.dll
          • Path C:\Program Files\Audja\assimp-vc143-mt.dll
          • Size 5.2MB
          • SHA256 a813ed72c9063ef7328ca8f38102f7eff11c5d364cae05989135d2f897fefbf4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fluid_prints_logo.png
          • Path C:\Program Files\Audja\fluid_prints_logo.png
          • Size 1.0MB
          • SHA256 753b7caaee334d9ca010eac42e2408e260461f27ff36bfd9fca74c6bbb30ac7c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fmt.dll
          • Path C:\Program Files\Audja\fmt.dll
          • Size 129KB
          • SHA256 16a197565a58342ff6ad1f9da2ab5f3b023239cf8c5ca0971cbe3ccbc873ea4a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          freetype.dll
          • Path C:\Program Files\Audja\freetype.dll
          • Size 670KB
          • SHA256 fe75338fd8e1c59a7538f2830eb6f6c7c005ffc7ab7abde82b21262e68c4fb4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          gdcmMEXD.dll
          • Path C:\Program Files\Audja\gdcmMEXD.dll
          • Size 488KB
          • SHA256 3a04c2ec62a2f471fbf169c9a7b3cf07c41068eb78568b2544624bd77525b349
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          gdcmMSFF.dll
          • Path C:\Program Files\Audja\gdcmMSFF.dll
          • Size 1.3MB
          • SHA256 d7336cb7acdf6f04a6c1bbdbb515a66a006b1ac13e7027f2bfbcf6f427657178
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          glfw3.dll
          • Path C:\Program Files\Audja\glfw3.dll
          • Size 226KB
          • SHA256 c61aef58697272cced3e13851c6ef1d1ccd7e577fcffc6450517253cb0a83dde
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          gtest.dll
          • Path C:\Program Files\Audja\gtest.dll
          • Size 417KB
          • SHA256 3c7bfc4d97c2737c40eac114bc04d889ae005a4b4427bb7c8934fd8a5d48273b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icon.png
          • Path C:\Program Files\Audja\icon.png
          • Size 203KB
          • SHA256 ab6f435b5247f2cb7a9abfdcdce3221fa80e031ee7ffe90a6149fa0c3e0e09ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          imgui.dll
          • Path C:\Program Files\Audja\imgui.dll
          • Size 1.1MB
          • SHA256 31f1347806a08ebf228b7899544c9457450c08b62f6570a82c28dafb50d9b3ff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jsoncpp.dll
          • Path C:\Program Files\Audja\jsoncpp.dll
          • Size 196KB
          • SHA256 9a48f695b1ca21a94b48404f6fd2728cd077f6f77a8534f4c1e1138255b6a485
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Program Files\Audja\logo.png
          • Size 2KB
          • SHA256 44359961bcd6e0f70cd57d559c31a4ea630ff75a72bc87ce6a8e359c6908583e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          openvdb.dll
          • Path C:\Program Files\Audja\openvdb.dll
          • Size 3.0MB
          • SHA256 1a3581871eacfcc34683e77fde725f0e614f60119f29c18b860dda197910d50d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spdlog.dll
          • Path C:\Program Files\Audja\spdlog.dll
          • Size 265KB
          • SHA256 9fe8bd8dc6b3b6c5eaf6eb42a8ff09c2c32aabd2f9ee95b5b2d215d431f08666
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          splash.png
          • Path C:\Program Files\Audja\splash.png
          • Size 2.0MB
          • SHA256 58ffd6fab832f197c3cd710954609cc7e457eb11d1c97373d8d853828b67a3d4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tbb12.dll
          • Path C:\Program Files\Audja\tbb12.dll
          • Size 322KB
          • SHA256 f859710a2a036eca9b1d533d75637e6aa144835dcc6e94f1f98e8e711a1233c3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tiff.dll
          • Path C:\Program Files\Audja\tiff.dll
          • Size 455KB
          • SHA256 babcd188d27bf7089b4f1ff074c030e6cfea7116623443de5ae669e0135f5bb2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zip.dll
          • Path C:\Program Files\Audja\zip.dll
          • Size 107KB
          • SHA256 e39ea9b8c92a2083a2fe49b66affc98ee0f4bd894a62109aa9bcd32c1fb431e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zlib1.dll
          • Path C:\Program Files\Audja\zlib1.dll
          • Size 87KB
          • SHA256 4858962be02dce7a002cec0c1ed50de8c6e1412e8dad7fb54fd7faa42dcfc532
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\state.rsm
          • Size 980B
          • SHA256 3974d4f391167717636803b9e6740c7b21ae0fad14c09b0f88fc1e931c2073f7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260626135414.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260626135414.log
          • Size 12KB
          • SHA256 672e8fb3bcb8e07dba458d8404f6412c7efa628a80b289650517c87f8eefd716
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_amd64_20260626135414_000_vcRuntimeMinimum_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260626135414_000_vcRuntimeMinimum_x64.log
          • Size 2KB
          • SHA256 3b9188e636cf37fa66ff014c0e353e4fd59023a6030e93c5bc9a4087eaf2540e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260626135414_001_vcRuntimeAdditional_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260626135414_001_vcRuntimeAdditional_x64.log
          • Size 2KB
          • SHA256 59568862597a83c5f417376d1acdb1f1421cd8fa9676d8aaf6126b628e0b7e70
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Audja-Setup-1.0.0-beta.1.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-R9MY6MJFL8.tmp\Audja-Setup-1.0.0-beta.1.tmp
          • Size 4.7MB
          • SHA256 1beb191cdf633db54d1c8bf7e9261c9b6b9481397901dc7c94b3b474b03e9a6d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-SIJ40PYZGL.tmp\vc_redist.x64.exe
          • Size 17.7MB
          • SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140.dll
          • Path C:\Windows\System32\msvcp140.dll
          • Size 540KB
          • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140.dll
          • Path C:\Windows\System32\vcruntime140.dll
          • Size 120KB
          • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140_1.dll
          • Path C:\Windows\System32\vcruntime140_1.dll
          • Size 46KB
          • SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{03E5FFF9-AE76-499E-9D64-B3BD7EE2BA1B}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Windows\Temp\{9B31A204-EC3B-4D47-98F1-BEC4D83F486F}\.cr\vc_redist.x64.exe
          • Size 615KB
          • SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{C04FBAAB-707E-4CD3-B32A-B7BC1EA88F7B}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{C04FBAAB-707E-4CD3-B32A-B7BC1EA88F7B}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Path C:\Windows\Temp\{C04FBAAB-707E-4CD3-B32A-B7BC1EA88F7B}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Size 5.4MB
          • SHA256 62a859b0db8bca416c7b6ad2ad5d2c84a4890a39e5d45cbec75f90a2fd328749
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab5046A8AB272BF37297BB7928664C9503
          • Path C:\Windows\Temp\{C04FBAAB-707E-4CD3-B32A-B7BC1EA88F7B}\cab5046A8AB272BF37297BB7928664C9503
          • Size 967KB
          • SHA256 c346d91193246b18301cce532f2ae784fb377cb068d77bd22edec238e5746aa7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x64
          • Path C:\Windows\Temp\{C04FBAAB-707E-4CD3-B32A-B7BC1EA88F7B}\vcRuntimeAdditional_x64
          • Size 208KB
          • SHA256 275d770dc4332bf6f3eae9ebc544ed07e3b169de791ba3d20ad50f04d9d222df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x64
          • Path C:\Windows\Temp\{C04FBAAB-707E-4CD3-B32A-B7BC1EA88F7B}\vcRuntimeMinimum_x64
          • Size 208KB
          • SHA256 57d65221ca418dabfcc6320215b2c05eec907690aa4f93384f2007eb9e1394b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/624-483-0x0000000000870000-0x0000000000957000-memory.dmp
          Download

          memory/624-7-0x0000000000870000-0x0000000000957000-memory.dmp
          Download

          memory/624-1-0x0000000000870000-0x0000000000957000-memory.dmp
          Download

          memory/1932-458-0x0000000000C10000-0x0000000000C87000-memory.dmp
          Download

          memory/3296-459-0x0000000000C10000-0x0000000000C87000-memory.dmp
          Download

          memory/4372-482-0x0000000000A80000-0x0000000000F69000-memory.dmp
          Download

          memory/4372-464-0x0000000000A80000-0x0000000000F69000-memory.dmp
          Download

          memory/4372-259-0x0000000000A80000-0x0000000000F69000-memory.dmp
          Download

          memory/4372-8-0x0000000000A80000-0x0000000000F69000-memory.dmp
          Download

          memory/4372-9-0x0000000003660000-0x0000000003661000-memory.dmp
          Download

          memory/4372-480-0x0000000000A80000-0x0000000000F69000-memory.dmp
          Download

          memory/4372-5-0x0000000003660000-0x0000000003661000-memory.dmp
          Download

          memory/4776-456-0x0000000000C10000-0x0000000000C87000-memory.dmp
          Download