Overview

overview

8

Static

static

3

Spotube-wi...up.exe

windows10-2004-x64

8

Spotube-wi...up.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 15:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Spotube-windows-x86_64-setup.exe
  • Size 36.5MB
  • Sample260727-tbcatahn6v
  • SHA256 e5641f3841ec724fcb5e00a22d980f410ee507fdd00669b86db0c29f9b741162
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 30 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Spotube-windows-x86_64-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Spotube-windows-x86_64-setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4660
    • C:\Users\Admin\AppData\Local\Temp\is-MNFZ0099IS.tmp\Spotube-windows-x86_64-setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-MNFZ0099IS.tmp\Spotube-windows-x86_64-setup.tmp" /SL5="$502FA,37068857,893952,C:\Users\Admin\AppData\Local\Temp\Spotube-windows-x86_64-setup.exe"
      2⤵
      • Downloads MZ/PE file
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5600
      • C:\Users\Admin\AppData\Local\Temp\is-BA37YBN6X7.tmp\vcredist2022_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-BA37YBN6X7.tmp\vcredist2022_x64.exe" /passive /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4512
        • C:\Windows\Temp\{FE9EB812-F184-4AB6-AC97-F893546BDABE}\.cr\vcredist2022_x64.exe
          "C:\Windows\Temp\{FE9EB812-F184-4AB6-AC97-F893546BDABE}\.cr\vcredist2022_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-BA37YBN6X7.tmp\vcredist2022_x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /passive /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2176
          • C:\Windows\Temp\{69A8A1CD-D7E7-4E83-A2F3-128D2B4296AD}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{69A8A1CD-D7E7-4E83-A2F3-128D2B4296AD}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6F1BE928-C785-4DC4-85BA-BFD76E849B67} {D44BF622-187A-4A74-A958-4FC30F2E595A} 2176
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5440
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{FBFC2857-3452-4D01-A1FA-95A844872D75} {EA06C5D6-371A-4383-919A-5F9901AC6E49} 5440
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:6076
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{FBFC2857-3452-4D01-A1FA-95A844872D75} {EA06C5D6-371A-4383-919A-5F9901AC6E49} 5440
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3608
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{2E4EA090-B343-4DC4-B0AD-D173B8548312} {C071A769-C85A-4E1F-99EE-61029328C251} 3608
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4616
      • C:\Program Files\Spotube\spotube.exe
        "C:\Program Files\Spotube\\spotube.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:5572
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2080
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:5972
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2716
    • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1076
      • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260727165355.log"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5748
        • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260727165355.log"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3452
          • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{349D9841-3A15-447E-A556-D83228E9C311} {21266F2D-0295-4214-B3B4-7BF113AD22E0} 3452
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:5304
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService
      1⤵
        PID:1780

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e597942.rbs
            • Path C:\Config.Msi\e597942.rbs
            • Size 19KB
            • SHA256 7f9fa051b7f0c2aa0c3a35e712c77394119d3e18015bf15c7047229da0ee9020
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59794e.rbs
            • Path C:\Config.Msi\e59794e.rbs
            • Size 19KB
            • SHA256 2a83095f940998bb9bd93903ece7ae69641d29d79f4f838522a505af146b2a0c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e597955.rbs
            • Path C:\Config.Msi\e597955.rbs
            • Size 21KB
            • SHA256 d9ab075181bd6edd9d41052c7f69fc516af7403d862941670169366848ed3f79
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e597964.rbs
            • Path C:\Config.Msi\e597964.rbs
            • Size 21KB
            • SHA256 f6c3a2ae887636ec8aac27d82da5828401e738d5afe0ad84c8de01570d1a66e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            app_links_plugin.dll
            • Path C:\Program Files\Spotube\app_links_plugin.dll
            • Size 136KB
            • SHA256 09b7972ab04ff5b3331f2bfe10a8b08c51d37071968285f2ae46b1583c30aa70
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bonsoir_windows_plugin.dll
            • Path C:\Program Files\Spotube\bonsoir_windows_plugin.dll
            • Size 211KB
            • SHA256 95c7d2b03ae3f606857baacfb6ad27c0a01bb343195b485c6214230eceff05a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            connectivity_plus_plugin.dll
            • Path C:\Program Files\Spotube\connectivity_plus_plugin.dll
            • Size 97KB
            • SHA256 2ebd130ca581a938459279bb35753e488a59553127d3be5be1ed6c5d44f5c92d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-B5EQ4H8OWS.tmp
            • Path C:\Program Files\Spotube\data\flutter_assets\packages\country_flags\res\si\is-B5EQ4H8OWS.tmp
            • Size 173B
            • SHA256 50bdf1f79d20003d6fd36715918d340384e19aea4d79240980dfc21875419eb3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            is-I7XS8B5E2T.tmp
            • Path C:\Program Files\Spotube\data\flutter_assets\packages\country_flags\res\si\is-I7XS8B5E2T.tmp
            • Size 34KB
            • SHA256 bc0ae11b614339ce70976762c29059fe8b9bbf3ef810f05fe2862ab6d787b3dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-WESSDUNZ6C.tmp
            • Path C:\Program Files\Spotube\data\flutter_assets\packages\country_flags\res\si\is-WESSDUNZ6C.tmp
            • Size 173B
            • SHA256 5448eb004a2d751685a6e2157fad9bc3fdd6fb7a603703201f4dbcd550fb9186
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            desktop_webview_window_plugin.dll
            • Path C:\Program Files\Spotube\desktop_webview_window_plugin.dll
            • Size 195KB
            • SHA256 468b630a79f23af6c8e0b17eb6bfb2451fe33848f72ab4191f734230d3b71033
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            file_selector_windows_plugin.dll
            • Path C:\Program Files\Spotube\file_selector_windows_plugin.dll
            • Size 109KB
            • SHA256 b19a5957badd6a877d2a909c2e7205abc008ecd60fb37065ca8b1558b48ae5e5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            flutter_inappwebview_windows_plugin.dll
            • Path C:\Program Files\Spotube\flutter_inappwebview_windows_plugin.dll
            • Size 945KB
            • SHA256 fd811345f3984d2a2cccb2accd15d0ec37023ec6c8d3cb3d8facfd7f41838b4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            flutter_new_pipe_extractor_plugin.dll
            • Path C:\Program Files\Spotube\flutter_new_pipe_extractor_plugin.dll
            • Size 87KB
            • SHA256 fe97f8493387b9ae7fe9e885e8cdee9d230a7e3bcd1c445596f64917ff62dd37
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            flutter_secure_storage_windows_plugin.dll
            • Path C:\Program Files\Spotube\flutter_secure_storage_windows_plugin.dll
            • Size 156KB
            • SHA256 e12a1324086e167d86bced14460be107bfb1c80b7221ea59066b8fe9ee91c30f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            flutter_timezone_plugin.dll
            • Path C:\Program Files\Spotube\flutter_timezone_plugin.dll
            • Size 81KB
            • SHA256 c62349285b1bca0c8481f66694eaf86c373f1aaad40d05f9b3297b694463d868
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            flutter_windows.dll
            • Path C:\Program Files\Spotube\flutter_windows.dll
            • Size 18.2MB
            • SHA256 dd156c0e10ca662e10d7a556fc0c0efd4603c27f36980a5d9130fd3a3dc6ad95
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            local_notifier_plugin.dll
            • Path C:\Program Files\Spotube\local_notifier_plugin.dll
            • Size 161KB
            • SHA256 d7eede45d2cc0fba24910bf26ef1b6af00089c2abe3d3cffb5613a62a53008c7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            media_kit_libs_windows_audio_plugin.dll
            • Path C:\Program Files\Spotube\media_kit_libs_windows_audio_plugin.dll
            • Size 12KB
            • SHA256 fd11cc7eee3f8ede48fb2c2c93f032f21bfa2f3bcffcb12d7b91297db0495b38
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            permission_handler_windows_plugin.dll
            • Path C:\Program Files\Spotube\permission_handler_windows_plugin.dll
            • Size 117KB
            • SHA256 764f9ed20ddb807b75a01259a99d4066084fe4f3d19ee81f075e3c63f99f3bf2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            screen_retriever_windows_plugin.dll
            • Path C:\Program Files\Spotube\screen_retriever_windows_plugin.dll
            • Size 116KB
            • SHA256 c6b6c1174c893b58b9166d696c2c6b47fbcfc7623a6062694982113e67bda12a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            spotube.exe
            • Path C:\Program Files\Spotube\spotube.exe
            • Size 263KB
            • SHA256 72c4e3316de8f6ff40a4d8ad6172c904bebc70ee71a61fc0528a4d954da23f3c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sqlite3_flutter_libs_plugin.dll
            • Path C:\Program Files\Spotube\sqlite3_flutter_libs_plugin.dll
            • Size 9KB
            • SHA256 3f2169f32e11cabbc48256a1280c3b4d6c53a5ee8f38f9c64a4a5d0e9a644d9a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tray_manager_plugin.dll
            • Path C:\Program Files\Spotube\tray_manager_plugin.dll
            • Size 104KB
            • SHA256 75acdc2aab56448a1ed09f8b9f193c194c073b7e088de6b5ed4426b8b97618d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            url_launcher_windows_plugin.dll
            • Path C:\Program Files\Spotube\url_launcher_windows_plugin.dll
            • Size 96KB
            • SHA256 ec9664e1bd9a98adb275aadc2072e3e9f6237eca40d93b4e6b3f0ee4865fe773
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            window_manager_plugin.dll
            • Path C:\Program Files\Spotube\window_manager_plugin.dll
            • Size 127KB
            • SHA256 29de02bcfb8a458845c81da1f9abafe02abe2caab744b82c63f40c9336f368c7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            state.rsm
            • Path C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\state.rsm
            • Size 986B
            • SHA256 65fb4173da2af6bd261e173a456544abe074b899f40bc5498579642f90c6cdb0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            NewPipeCLI.exe
            • Path C:\Users\Admin\AppData\Local\Temp\NewPipeCLI.exe
            • Size 26.1MB
            • SHA256 9d7b8ded7b0a186ddc4be656d56669dfa26484e6172468ac6362e78008ee1e43
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dd_vcredist_amd64_20260727165355_000_vcRuntimeMinimum_x64.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260727165355_000_vcRuntimeMinimum_x64.log
            • Size 2KB
            • SHA256 6db0cd9881dadf196d98fc91789fd509dd0ae7323377220d7c79b884c92bba9b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dd_vcredist_amd64_20260727165355_001_vcRuntimeAdditional_x64.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260727165355_001_vcRuntimeAdditional_x64.log
            • Size 2KB
            • SHA256 2a051a100889dcb245cb62f23d6cade77d737cf69b705b4598b3cd84c21cc173
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            vcredist2022_x64.exe
            • Path C:\Users\Admin\AppData\Local\Temp\is-BA37YBN6X7.tmp\vcredist2022_x64.exe
            • Size 17.9MB
            • SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spotube-windows-x86_64-setup.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\is-MNFZ0099IS.tmp\Spotube-windows-x86_64-setup.tmp
            • Size 4.2MB
            • SHA256 eddc8fc43fd99b209d08ec8200de806c6dbc6b6d18217380d71f0140b98f7717
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            plugin.out
            • Path C:\Users\Admin\AppData\Roaming\oss.krtirtho\spotube\metadata-plugins\Kingkor Roy Tirtho-Musicbrainz and Listenbrainz-1.0.0\plugin.out
            • Size 67KB
            • SHA256 23dfae30350842c1b6f60da4ccea096e4c1e2dd0fb22063ef324dc55ba9fa9a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Windows\SYSTEM32\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcp140.dll
            • Path C:\Windows\System32\msvcp140.dll
            • Size 628KB
            • SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{3992A870-CA17-49B4-8D18-B38B0E540161}\.ba\wixstdba.dll
            • Size 191KB
            • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo.png
            • Path C:\Windows\Temp\{69A8A1CD-D7E7-4E83-A2F3-128D2B4296AD}\.ba\logo.png
            • Size 1KB
            • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{69A8A1CD-D7E7-4E83-A2F3-128D2B4296AD}\.ba\wixstdba.dll
            • Size 215KB
            • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab2C04DDC374BD96EB5C8EB8208F2C7C92
            • Path C:\Windows\Temp\{69A8A1CD-D7E7-4E83-A2F3-128D2B4296AD}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
            • Size 5.4MB
            • SHA256 19c0cdc59ae89d0491c025a966f6d40515adc2449af40f2c6c6f52e2f293ad1c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab5046A8AB272BF37297BB7928664C9503
            • Path C:\Windows\Temp\{69A8A1CD-D7E7-4E83-A2F3-128D2B4296AD}\cab5046A8AB272BF37297BB7928664C9503
            • Size 1.0MB
            • SHA256 6e8ee73933678c55973e83366e48e948b394c7a36743a36b7224c95de979b13f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeAdditional_x64
            • Path C:\Windows\Temp\{69A8A1CD-D7E7-4E83-A2F3-128D2B4296AD}\vcRuntimeAdditional_x64
            • Size 208KB
            • SHA256 476427800c1c958dc4e71d9a0f2f3983b2608da70835db9ee5f3b8ac387e9617
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeMinimum_x64
            • Path C:\Windows\Temp\{69A8A1CD-D7E7-4E83-A2F3-128D2B4296AD}\vcRuntimeMinimum_x64
            • Size 208KB
            • SHA256 bab5d0257e6a18a4a008e683442e3077b38172dd61af3cb1c588b46724a714e2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcredist2022_x64.exe
            • Path C:\Windows\Temp\{FE9EB812-F184-4AB6-AC97-F893546BDABE}\.cr\vcredist2022_x64.exe
            • Size 615KB
            • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3608-243-0x0000000000C20000-0x0000000000C97000-memory.dmp
            Download

            memory/4616-240-0x0000000000C20000-0x0000000000C97000-memory.dmp
            Download

            memory/4660-1-0x0000000000B80000-0x0000000000C69000-memory.dmp
            Download

            memory/4660-7-0x0000000000B80000-0x0000000000C69000-memory.dmp
            Download

            memory/4660-1358-0x0000000000B80000-0x0000000000C69000-memory.dmp
            Download

            memory/5572-1349-0x000002333B3B0000-0x000002333B3B1000-memory.dmp
            Download

            memory/5572-1350-0x000002333B420000-0x000002333C451000-memory.dmp
            Download

            memory/5572-1409-0x0000023340D80000-0x00000233411A5000-memory.dmp
            Download

            memory/5572-1352-0x000002333B420000-0x000002333C451000-memory.dmp
            Download

            memory/5572-1351-0x000002333B420000-0x000002333C451000-memory.dmp
            Download

            memory/5572-1353-0x000002333B3C0000-0x000002333B3C1000-memory.dmp
            Download

            memory/5600-13-0x0000000000D60000-0x00000000011AB000-memory.dmp
            Download

            memory/5600-8-0x0000000000D60000-0x00000000011AB000-memory.dmp
            Download

            memory/5600-9-0x0000000000D30000-0x0000000000D31000-memory.dmp
            Download

            memory/5600-1300-0x0000000000D60000-0x00000000011AB000-memory.dmp
            Download

            memory/5600-1357-0x0000000000D60000-0x00000000011AB000-memory.dmp
            Download

            memory/5600-17-0x0000000000D60000-0x00000000011AB000-memory.dmp
            Download

            memory/5600-19-0x0000000000D60000-0x00000000011AB000-memory.dmp
            Download

            memory/5600-76-0x0000000000D60000-0x00000000011AB000-memory.dmp
            Download

            memory/5600-5-0x0000000000D30000-0x0000000000D31000-memory.dmp
            Download

            memory/5600-907-0x0000000000D60000-0x00000000011AB000-memory.dmp
            Download

            memory/6076-244-0x0000000000C20000-0x0000000000C97000-memory.dmp
            Download