Overview

overview

10

Static

static

1

LicenseSupport.exe

windows10-2004-x64

10

LicenseSupport.exe

windows11-ltsc_2024-x64

4

Analysis

  • user interaction
    yes
  • max time kernel
    298s
  • max time network
    277s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/08/2026, 03:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LicenseSupport.exe
  • Size 158.5MB
  • Sample260814-dkqa2aeh27
  • SHA256 4e0cdc90819279924c3391e5ed088a51e36243c8d2870793e65187f835eba09b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 1 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Badlisted process makes network request 6 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 28 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 60 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 47 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 56 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\LicenseSupport.exe
    "C:\Users\Admin\AppData\Local\Temp\LicenseSupport.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3288
    • C:\Windows\TEMP\{987A3DD4-21C8-4561-83E2-14B4537ED9F0}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{987A3DD4-21C8-4561-83E2-14B4537ED9F0}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{BC49098D-56E3-47F1-9BB8-457C391A98AF} {4455B52F-FDCD-4731-BD83-EAEB50B182B4}
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      PID:1068
    • C:\Windows\TEMP\{987A3DD4-21C8-4561-83E2-14B4537ED9F0}\.be\LicenseSupport.exe
      "C:\Windows\TEMP\{987A3DD4-21C8-4561-83E2-14B4537ED9F0}\.be\LicenseSupport.exe" -q -burn.elevated BurnPipe.{59C4CEEA-1691-46C2-80BF-CE864E30330D} {E7798614-69A4-4CA0-9D39-D5540D02C150} 3288
      2⤵
      • Adds Run key to start application
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1616
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4888
      • C:\ProgramData\Package Cache\2FDA8ABC77B6ED9E98A2B120628E4E3B9458F2B18998C836EEC1DE82642244FE\VC_redist.x86.exe
        "C:\ProgramData\Package Cache\2FDA8ABC77B6ED9E98A2B120628E4E3B9458F2B18998C836EEC1DE82642244FE\VC_redist.x86.exe" /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3712
        • C:\Windows\Temp\{1455E75D-EBE6-4611-B65D-02B6E5C17214}\.cr\VC_redist.x86.exe
          "C:\Windows\Temp\{1455E75D-EBE6-4611-B65D-02B6E5C17214}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\2FDA8ABC77B6ED9E98A2B120628E4E3B9458F2B18998C836EEC1DE82642244FE\VC_redist.x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3348
      • C:\ProgramData\Package Cache\8A050EBD392654CE5981AF3D0BF99107BFA576529BCE8325A7CCC46F92917515\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\8A050EBD392654CE5981AF3D0BF99107BFA576529BCE8325A7CCC46F92917515\VC_redist.x64.exe" /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5084
        • C:\Windows\Temp\{1A20E466-940A-4D63-9ED7-07AC7517E4EB}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{1A20E466-940A-4D63-9ED7-07AC7517E4EB}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\8A050EBD392654CE5981AF3D0BF99107BFA576529BCE8325A7CCC46F92917515\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=556 /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4672
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:5072
  • C:\ProgramData\Package Cache\{2B4E4AF7-91AD-4551-ABF1-118B57CA676C}\LicenseSupport.exe
    "C:\ProgramData\Package Cache\{2B4E4AF7-91AD-4551-ABF1-118B57CA676C}\LicenseSupport.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3508
    • C:\ProgramData\Package Cache\{2B4E4AF7-91AD-4551-ABF1-118B57CA676C}\LicenseSupport.exe
      "C:\ProgramData\Package Cache\{2B4E4AF7-91AD-4551-ABF1-118B57CA676C}\LicenseSupport.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\PACE_License_Support_20260814040528.log"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4240
      • C:\Windows\TEMP\{3F0B67E3-43C0-4D8D-B9BD-70C60070C0FB}\.ba\wixstdba.exe
        "C:\Windows\TEMP\{3F0B67E3-43C0-4D8D-B9BD-70C60070C0FB}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{0EEF05FA-1B9D-44C2-92F0-B5B35F98FBD9} {FF13EE73-F567-4D00-81B6-556872BA18E7}
        3⤵
        • Executes dropped EXE
        PID:4376
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Loads dropped DLL
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding F9D1A4D90F9B5375CD5C78BDB7F42709
      2⤵
      • Loads dropped DLL
      PID:3504
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding CEAECF28A5C09FCA5BCDCADA6E319094
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4908
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 68A49EF6999C5EDF08CD41C0D4E9CCD5 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4300
    • C:\Windows\System32\MsiExec.exe
      "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
      2⤵
      • Loads dropped DLL
      PID:2632
    • C:\Windows\syswow64\MsiExec.exe
      "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4716
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 5996474EF8E105F63DB1A7EDCDDDB674
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3904
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI3C4B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240729218 49 runScript!runScript.CustomActions.PaceNop
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        PID:4292
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI3DE2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240729578 53 runScript!runScript.CustomActions.SetPropertyRunningOnARM
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1040
        • C:\Windows\system32\reg.exe
          "reg" query "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v Identifier
          4⤵
          • Checks processor information in registry
          PID:3776
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI3F3B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240729953 60 runScript!runScript.CustomActions.SetCompatibleOSVersion
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        PID:3332
      • C:\Windows\System32\taskkill.exe
        "taskkill.exe" /F /IM PACEEdenExperienceProxy.exe
        3⤵
        • Kills process with taskkill
        PID:2756
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 029DDEB97280005EC45703E268319D2D
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1896
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 1B4FAA781ACA91DCFECB5038A64D466C E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4596
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI4970.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240732578 80 runScript!runScript.CustomActions.RemoveSharedDllRegistryKeys
        3⤵
        • Loads dropped DLL
        PID:3748
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI710F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240742671 86 runScript!runScript.CustomActions.InstallIlokDriverPackage
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4964
        • C:\Windows\system32\reg.exe
          "reg" query "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v Identifier
          4⤵
          • Checks processor information in registry
          PID:1832
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Windows\Installer\SFXCA6347A23A8A418C1BCAFC4BDBA14542C6\iLokPnputil.bat" --install EV"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3244
          • C:\Windows\System32\pnputil.exe
            C:\Windows\System32\pnputil.exe -i -a "C:\Program Files (x86)\Common Files\PACE\iLokDriverPackages\EV\iLokDrvr64.inf"
            5⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            PID:2716
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 3E27304B87B870F94410F53BB460B2BF E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3192
  • C:\Program Files\Bonjour\mDNSResponder.exe
    "C:\Program Files\Bonjour\mDNSResponder.exe"
    1⤵
    • Modifies firewall policy service
    • Executes dropped EXE
    PID:5016
  • C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe
    "C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe" -u https://activation.paceap.com/InitiateActivation
    1⤵
    • Drops file in System32 directory
    • Executes dropped EXE
    • Loads dropped DLL
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:556
    • C:\Program Files (x86)\Common Files\PACE\Proxy\PACEEdenExperienceProxy.exe
      "C:\Program Files (x86)\Common Files\PACE\Proxy\PACEEdenExperienceProxy.exe" \\.\pipe\7920b0fd-ad8c-4c43-91dd-80be5c5f9d1b 0
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4372
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{210a899e-6bfc-904c-bee4-dcd8404c7494}\iLokDrvr64.inf" "9" "4e4857d87" "0000000000000138" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Common Files\PACE\iLokDriverPackages\EV"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4728
  • C:\Program Files\iLok License Manager\iLok License Manager.exe
    "C:\Program Files\iLok License Manager\iLok License Manager.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2836
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1688

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          2
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          5
          T1012

          System Information Discovery

          5
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e58ce4b.rbs
          • Path C:\Config.Msi\e58ce4b.rbs
          • Size 126KB
          • SHA256 01e32186216b8fb91f6568e855837f81a8550c4acbbb9899f870054d5705ddbc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e58ce51.rbs
          • Path C:\Config.Msi\e58ce51.rbs
          • Size 729KB
          • SHA256 662710700fa26f352033260033ae8a92ee4dc486691d95bde5d2d323ad153489
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mDNSResponder.exe
          • Path C:\Program Files (x86)\Bonjour\mDNSResponder.exe
          • Size 381KB
          • SHA256 10f21999ff6b1d410ebf280f7f27deaca5289739cf12f4293b614b8fc6c88dcc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mdnsNSP.dll
          • Path C:\Program Files (x86)\Bonjour\mdnsNSP.dll
          • Size 118KB
          • SHA256 5d40fd92da5ca59c1badb58ad509db6a6d613f18660a9a270a53eca85d34c3a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mDNSResponder.exe
          • Path C:\Program Files\Bonjour\mDNSResponder.exe
          • Size 451KB
          • SHA256 17bffc5df609ce3b2f0cab4bd6c118608c66a3ad86116a47e90b2bb7d8954122
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mdnsNSP.dll
          • Path C:\Program Files\Bonjour\mdnsNSP.dll
          • Size 129KB
          • SHA256 d0a918ad60221623bb0278ea94cd6938744617fdbb2054968afafc2940648f02
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dns_sd.jar
          • Path C:\Program Files\Java\jre-1.8\lib\ext\dns_sd.jar
          • Size 16KB
          • SHA256 3818abdee5b1d3d77ae4a5ace25a638b2d7d624605f8e8ce14dd6d4c6639c00c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{2B4E4AF7-91AD-4551-ABF1-118B57CA676C}\state.rsm
          • Size 986B
          • SHA256 3eb1d048805dc8c6e1cddbd7481b7c27a80c386e5c1aae310fb081fa0b9351f6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          rundll32.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
          • Size 312B
          • SHA256 6f27d4b9eb4c47f40f0914a0c37778cdfa9f517c2e181aad67fe67943832c245
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          PACE_License_Support_20260814040528_000_Bonjour64.msi.log
          • Path C:\Users\Admin\AppData\Local\Temp\PACE_License_Support_20260814040528_000_Bonjour64.msi.log
          • Size 3KB
          • SHA256 caedcc5970ecec37f3ddabc45c2186892bd1cce6cd9db80ead6be29679e8f303
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          PACE_License_Support_20260814040528_003_LicenseSupport.msi.log
          • Path C:\Users\Admin\AppData\Local\Temp\PACE_License_Support_20260814040528_003_LicenseSupport.msi.log
          • Size 1KB
          • SHA256 45ef176ff9a2c284987c790ae77c575f11a770d88e3b1fa8963a78ef769d0490
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Bonjour64.msi
          • Path C:\Users\Admin\AppData\Local\Temp\{987A3DD4-21C8-4561-83E2-14B4537ED9F0}\Bonjour64.msi
          • Size 2.6MB
          • SHA256 53be81cc6e2dc95a1041e8f3d8f500fad4259ab20a1aac151b5fc7a64d354a93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\{987A3DD4-21C8-4561-83E2-14B4537ED9F0}\VC_redist.x64.exe
          • Size 14.4MB
          • SHA256 40ea2955391c9eae3e35619c4c24b5aaf3d17aeaa6d09424ee9672aa9372aeed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x86.exe
          • Path C:\Users\Admin\AppData\Local\Temp\{987A3DD4-21C8-4561-83E2-14B4537ED9F0}\VC_redist.x86.exe
          • Size 13.7MB
          • SHA256 e59ae3e886bd4571a811fe31a47959ae5c40d87c583f786816c60440252cd7ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI167C.tmp
          • Path C:\Windows\Installer\MSI167C.tmp
          • Size 75KB
          • SHA256 8764d060558a9d4ef24adb43201d5178033171a649ad497f79ce3b6cc8eda98a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI18E1.tmp
          • Path C:\Windows\Installer\MSI18E1.tmp
          • Size 75KB
          • SHA256 2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI3C4B.tmp
          • Path C:\Windows\Installer\MSI3C4B.tmp
          • Size 331KB
          • SHA256 e48aa658681495c64a9e2d47640af619539bc2b73ae8b3083958aaaa1f843a9c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CustomAction.config
          • Path C:\Windows\Installer\SFXCA92D807C0F5489A9BD749CB9C5FDE7040\CustomAction.config
          • Size 221B
          • SHA256 c22b30e9fe5bec4ad5af30111bf00d262af572a567b695d830c366b0833d23ea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          WixToolset.Dtf.WindowsInstaller.dll
          • Path C:\Windows\Installer\SFXCA92D807C0F5489A9BD749CB9C5FDE7040\WixToolset.Dtf.WindowsInstaller.dll
          • Size 197KB
          • SHA256 a2e2a61d4350c76cc7f4e1d48d69b0edffc37c9074ef8445acdc3735209b1962
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          runScript.dll
          • Path C:\Windows\Installer\SFXCABFEDD0C16F455FD99856ABC4DD697C01\runScript.dll
          • Size 27KB
          • SHA256 efa7765d666024d2088c39d7b2b69cef6bf551bdbffe54c66598459ab8e9a250
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          iLokLicenseNotificationAgentStartMenuIcon
          • Path C:\Windows\Installer\{A292CF9D-6241-4ADA-AEF7-4340174E7F8B}\iLokLicenseNotificationAgentStartMenuIcon
          • Size 66KB
          • SHA256 dbe37649f6ab5e7be8af170ac2aff8b875bd770546399a03a6c26dd7854cd8dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SET72D5.tmp
          • Path C:\Windows\System32\DriverStore\Temp\{3378c754-8eaa-5744-a219-af3b617c81fc}\SET72D5.tmp
          • Size 12KB
          • SHA256 40923381251f077564371863fa29c7f75a78aaa788e815e68514ee929441ce7a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SET72E5.tmp
          • Path C:\Windows\System32\DriverStore\Temp\{3378c754-8eaa-5744-a219-af3b617c81fc}\SET72E5.tmp
          • Size 1.4MB
          • SHA256 d78e3b22e503c8027c4ceb2a2a5b3d6799fb170e83d3a9a6f1fdffc3ef795514
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SET72E6.tmp
          • Path C:\Windows\System32\DriverStore\Temp\{3378c754-8eaa-5744-a219-af3b617c81fc}\SET72E6.tmp
          • Size 37KB
          • SHA256 1945f59b1b24dde5ddd6d5d49130912ea41337d35d78fc9f6e89944dd85a83cb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SET72E7.tmp
          • Path C:\Windows\System32\DriverStore\Temp\{3378c754-8eaa-5744-a219-af3b617c81fc}\SET72E7.tmp
          • Size 3KB
          • SHA256 aab280a100264d30d8722e5ac29fde91e5b935ea21ccb3ed89ac5deca297846e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          BootstrapperApplicationData.xml
          • Path C:\Windows\TEMP\{987A3DD4-21C8-4561-83E2-14B4537ED9F0}\.ba\BootstrapperApplicationData.xml
          • Size 6KB
          • SHA256 3e9da8513303318fc7a7499e9df6cf09a02af479a3e0f8060e51522887c97329
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\TEMP\{987A3DD4-21C8-4561-83E2-14B4537ED9F0}\.ba\license.rtf
          • Size 11KB
          • SHA256 93b71e98b0ac813fbf2ebd34c03347f23173c874ba433c7c2f25f930fa34e34e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\TEMP\{987A3DD4-21C8-4561-83E2-14B4537ED9F0}\.ba\logo.png
          • Size 1KB
          • SHA256 4f1c6ff4a00190802558d79b591c3b12db5051be89501baa6353fa16dd1386c1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\TEMP\{987A3DD4-21C8-4561-83E2-14B4537ED9F0}\.ba\thm.wxl
          • Size 5KB
          • SHA256 c59d91c5e1b5026c3b5a2da110f824f3896606b8bd984fa8b583604c49004f91
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\TEMP\{987A3DD4-21C8-4561-83E2-14B4537ED9F0}\.ba\thm.xml
          • Size 9KB
          • SHA256 e922d2c823be9a81b72a3d026bd5435f6da406b3349332e000f1f9c312443acd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x86.exe
          • Path C:\Windows\Temp\{1455E75D-EBE6-4611-B65D-02B6E5C17214}\.cr\VC_redist.x86.exe
          • Size 632KB
          • SHA256 4b1bf90a0e4e3a628613c2fe42ddba589ee6303e37ccc70cf99ddc92dde03b0b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Windows\Temp\{1A20E466-940A-4D63-9ED7-07AC7517E4EB}\.cr\VC_redist.x64.exe
          • Size 632KB
          • SHA256 de1acbb1df68a39a5b966303ac1b609dde2688b28ebf3eba8d2adeeb3d90bf5e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.exe
          • Path C:\Windows\Temp\{987A3DD4-21C8-4561-83E2-14B4537ED9F0}\.ba\wixstdba.exe
          • Size 489KB
          • SHA256 e05dda0c23421cfc7a2a39b91074928605e1e69ad5f0a2a4e230ed5996fe2ff9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LicenseSupport.exe
          • Path C:\Windows\Temp\{987A3DD4-21C8-4561-83E2-14B4537ED9F0}\.be\LicenseSupport.exe
          • Size 1.1MB
          • SHA256 faba91f395dbcb4eeda0b2c8e311876f86278fb3b31d29cab37417f75e9b4e98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{C685C7BE-972E-47B8-8C98-1C94D5254F04}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{C685C7BE-972E-47B8-8C98-1C94D5254F04}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.1MB
          • SHA256 09a6f0b27ab46035f57753565f4f5b58e1f9183d5c9516b7ddd347cb55c63eb5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {301297d1-8804-44fc-a89e-d77ea8eb4c88}_OnDiskSnapshotProp
          • Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{301297d1-8804-44fc-a89e-d77ea8eb4c88}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 571e10392b415a00926edcedb799e8e9ca5e7c46bc19922a3ec50ed3c755fe21
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2836-600-0x00007FF802E30000-0x00007FF803369000-memory.dmp
          Download

          memory/2836-601-0x00007FF79D460000-0x00007FF79E460000-memory.dmp
          Download

          memory/2836-624-0x0000024264460000-0x000002426462E000-memory.dmp
          Download

          memory/4292-304-0x000001740ED70000-0x000001740ED7C000-memory.dmp
          Download

          memory/4292-299-0x000001740EEA0000-0x000001740EED4000-memory.dmp
          Download

          memory/4292-300-0x000001740ED50000-0x000001740ED6A000-memory.dmp
          Download

          memory/4372-605-0x0000021149D30000-0x000002114A269000-memory.dmp
          Download

          memory/4372-608-0x0000021149D30000-0x000002114A269000-memory.dmp
          Download