Overview

overview

6

Static

static

1

lghub_installer.exe

windows10-2004-x64

6

lghub_installer.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 14:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    lghub_installer.exe
  • Size 67.1MB
  • Sample260823-sapdbaxfme
  • SHA256 4b2f9903b27c8434afcd52fe65845632fcae47cc50432fb6b3b1637144e811e1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistenceransomware

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 49 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Windows directory 25 IoCs
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\lghub_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\lghub_installer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5724
    • C:\Users\Admin\AppData\Local\Temp\ghub-d55c-d7ea-a26e-5642-966e\lghub_setup.exe
      "C:\Users\Admin\AppData\Local\Temp\ghub-d55c-d7ea-a26e-5642-966e\lghub_setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5644
      • C:\Users\Admin\AppData\Local\Temp\ghub-tvepmhks.js0\vc_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\ghub-tvepmhks.js0\vc_redist.x64.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1656
        • C:\Windows\Temp\{697CC616-B892-45A9-B1F1-4D1B1E2BED69}\.cr\vc_redist.x64.exe
          "C:\Windows\Temp\{697CC616-B892-45A9-B1F1-4D1B1E2BED69}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\ghub-tvepmhks.js0\vc_redist.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /install /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4168
          • C:\Windows\Temp\{71E6452E-7AD3-4D14-A164-5274FFAC113C}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{71E6452E-7AD3-4D14-A164-5274FFAC113C}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1E246E63-AC3F-46CD-82B7-F19A0B8D41F6} {07D34CAA-48CB-4AFB-A631-9BB3FDAA36AA} 4168
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4696
      • C:\Users\Admin\AppData\Local\Temp\ghub-tvepmhks.js0\vc_redist.x86.exe
        "C:\Users\Admin\AppData\Local\Temp\ghub-tvepmhks.js0\vc_redist.x86.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1996
        • C:\Windows\Temp\{A47AFE72-8DB2-4C32-B9C9-D3E8754CFF10}\.cr\vc_redist.x86.exe
          "C:\Windows\Temp\{A47AFE72-8DB2-4C32-B9C9-D3E8754CFF10}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\ghub-tvepmhks.js0\vc_redist.x86.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /install /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2412
          • C:\Windows\Temp\{4F2AD787-BF14-47FC-9317-E2C12AC51E0C}\.be\VC_redist.x86.exe
            "C:\Windows\Temp\{4F2AD787-BF14-47FC-9317-E2C12AC51E0C}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{44A47223-45D8-41E1-B49B-A912BEFC705C} {6A8FCC75-16E4-4751-8B71-6832337656C8} 2412
            5⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:1384
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 980
            5⤵
            • Program crash
            PID:3944
      • C:\Users\Admin\AppData\Local\Temp\ghub-tvepmhks.js0\vc_redist.arm64.exe
        "C:\Users\Admin\AppData\Local\Temp\ghub-tvepmhks.js0\vc_redist.arm64.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Windows\Temp\{C8E0B72C-BB28-48F9-B642-6FB5C040BB1E}\.cr\vc_redist.arm64.exe
          "C:\Windows\Temp\{C8E0B72C-BB28-48F9-B642-6FB5C040BB1E}\.cr\vc_redist.arm64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\ghub-tvepmhks.js0\vc_redist.arm64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /install /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:296
          • C:\Windows\Temp\{3E1CF678-F6AB-4E71-94CF-12E02A451CEE}\.be\VC_redist.arm64.exe
            "C:\Windows\Temp\{3E1CF678-F6AB-4E71-94CF-12E02A451CEE}\.be\VC_redist.arm64.exe" -q -burn.elevated BurnPipe.{1055E3C4-5468-41F7-BE94-FCAF1BECA850} {005D30EC-B4E8-4C6E-ABD6-64FA46E52963} 296
            5⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:5864
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:5820
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5904
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4244
  • C:\ProgramData\Package Cache\{ba10fda9-f731-441f-a999-000bbb7ceec2}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{ba10fda9-f731-441f-a999-000bbb7ceec2}\VC_redist.x86.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\ProgramData\Package Cache\{ba10fda9-f731-441f-a999-000bbb7ceec2}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{ba10fda9-f731-441f-a999-000bbb7ceec2}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823155627.log" /install
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2408
      • C:\ProgramData\Package Cache\{ba10fda9-f731-441f-a999-000bbb7ceec2}\VC_redist.x86.exe
        "C:\ProgramData\Package Cache\{ba10fda9-f731-441f-a999-000bbb7ceec2}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{ba10fda9-f731-441f-a999-000bbb7ceec2}\VC_redist.x86.exe" -burn.filehandle.attached=568 -burn.filehandle.self=588 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823155627.log" /install
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2052
        • C:\ProgramData\Package Cache\{ba10fda9-f731-441f-a999-000bbb7ceec2}\VC_redist.x86.exe
          "C:\ProgramData\Package Cache\{ba10fda9-f731-441f-a999-000bbb7ceec2}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{5E5B28EC-CD02-42E3-A08A-162F45BDF45D} {AFF242D6-5953-4F16-B49F-0E8F83880AFD} 2052
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3928
          • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
            "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={ba10fda9-f731-441f-a999-000bbb7ceec2} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{D2D1440A-1AF9-468E-BBC4-EA9C02C2AF47} {E65FF6D2-A959-446C-A322-13D43A8C3346} 3928
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2560
            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 -uninstall -quiet -burn.related.upgrade -burn.ancestors={ba10fda9-f731-441f-a999-000bbb7ceec2} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{D2D1440A-1AF9-468E-BBC4-EA9C02C2AF47} {E65FF6D2-A959-446C-A322-13D43A8C3346} 3928
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2860
              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{5BA65CE5-22B3-4A13-AA5F-2352F4BA2954} {39B9E82E-8789-46F2-8A82-169CA87C4070} 2860
                7⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:4560
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 244 -p 2412 -ip 2412
    1⤵
      PID:2380
    • C:\ProgramData\Package Cache\{f4fca927-ceb7-4549-8782-5835bd91078c}\VC_redist.arm64.exe
      "C:\ProgramData\Package Cache\{f4fca927-ceb7-4549-8782-5835bd91078c}\VC_redist.arm64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3016
      • C:\ProgramData\Package Cache\{f4fca927-ceb7-4549-8782-5835bd91078c}\VC_redist.arm64.exe
        "C:\ProgramData\Package Cache\{f4fca927-ceb7-4549-8782-5835bd91078c}\VC_redist.arm64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_arm64_20260823155635.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3360
        • C:\ProgramData\Package Cache\{f4fca927-ceb7-4549-8782-5835bd91078c}\VC_redist.arm64.exe
          "C:\ProgramData\Package Cache\{f4fca927-ceb7-4549-8782-5835bd91078c}\VC_redist.arm64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{f4fca927-ceb7-4549-8782-5835bd91078c}\VC_redist.arm64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_arm64_20260823155635.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1136

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e599100.rbs
          • Path C:\Config.Msi\e599100.rbs
          • Size 16KB
          • SHA256 b5ed14c1bb68df824f9b357f01163819c216ec82d4a17b5f878631b6d564e80e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e599105.rbs
          • Path C:\Config.Msi\e599105.rbs
          • Size 18KB
          • SHA256 d370bdaf0a04aa94f2ebc279ec8ef254f18ee1fc1e658c01eecea8cf46746d34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e599112.rbs
          • Path C:\Config.Msi\e599112.rbs
          • Size 20KB
          • SHA256 5eb227db0f5084af2c88628f2c06d09b1056ac4ef445ed1fdd5985b0799e995c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e599121.rbs
          • Path C:\Config.Msi\e599121.rbs
          • Size 19KB
          • SHA256 a3c8ed132028969dda4b73f3aa0ec8b49ae8d097299b5a7d81aa92f1f853eb1f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          current.json
          • Path C:\ProgramData\LGHUB\current.json
          • Size 137B
          • SHA256 7b08d505329ea981fdb541add9953b9a200836038c8f1b0002d569b4607c6515
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{ba10fda9-f731-441f-a999-000bbb7ceec2}\state.rsm
          • Size 996B
          • SHA256 f996aa60940dbbcf5c3eea3fd22c2c28cdad889bcab1b9a76179ec65541aee56
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_arm64_20260823155635.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_arm64_20260823155635.log
          • Size 8KB
          • SHA256 d0ce964921fcf337fc5616279894654fb305538599ee62ea070e298bb064209b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_arm64_20260823155635_000_vcRuntime_arm64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_arm64_20260823155635_000_vcRuntime_arm64.log
          • Size 2KB
          • SHA256 f09888836c3b6a8c72d422c8cdc0dbc2af4c6dceca52b9ea62a2b3eddac98add
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_x86_20260823155627.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823155627.log
          • Size 14KB
          • SHA256 3a5cd1a8bceedf61de17a8ee1c25a3cceb7a2c63318fce7928fb6bd716f62c2d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_x86_20260823155627_000_vcRuntimeMinimum_x86.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823155627_000_vcRuntimeMinimum_x86.log
          • Size 2KB
          • SHA256 8dbffa056493a552932abe4e9d39c15ab17252a7b65f5b91a4f72b9cedd172e6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_x86_20260823155627_001_vcRuntimeAdditional_x86.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823155627_001_vcRuntimeAdditional_x86.log
          • Size 2KB
          • SHA256 c12e3b0490d03304cbabc65b4f4c4e670b7afd7b99e8ffbc1210ea635c259cb4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          logi_codecs_shared.dll
          • Path C:\Users\Admin\AppData\Local\Temp\ghub-tvepmhks.js0\logi_codecs_shared.dll
          • Size 718KB
          • SHA256 0f1dd537153ab4f1155de28a251e6b27243a1780c1cabfabfb8414630ee06c95
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logi_installer_shared.dll
          • Path C:\Users\Admin\AppData\Local\Temp\ghub-tvepmhks.js0\logi_installer_shared.dll
          • Size 6.7MB
          • SHA256 730c23e9c30c5690d33aa5e157cdd8904ded7adea7e3dd816704dd018b6fe80e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.arm64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\ghub-tvepmhks.js0\vc_redist.arm64.exe
          • Size 11.2MB
          • SHA256 8a81a52b7ff6b194cb88e1bb48d597b6588d2b840552909359f286fb1699235c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\ghub-tvepmhks.js0\vc_redist.x64.exe
          • Size 24.5MB
          • SHA256 8f9fb1b3cfe6e5092cf1225ecd6659dab7ce50b8bf935cb79bfede1f3c895240
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x86.exe
          • Path C:\Users\Admin\AppData\Local\Temp\ghub-tvepmhks.js0\vc_redist.x86.exe
          • Size 13.3MB
          • SHA256 c4e3992f3883005881cf3937f9e33f1c7d792ac1c860ea9c52d8f120a16a7eb1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab67BF7A87766DE2D5256F7D9BB36CDA13
          • Path C:\Windows\Temp\{3E1CF678-F6AB-4E71-94CF-12E02A451CEE}\cab67BF7A87766DE2D5256F7D9BB36CDA13
          • Size 10.5MB
          • SHA256 e9d23c1a6be58cfcd4b87fa13814be0cc648c54db38df1ad1d98bb337bafaad5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntime_arm64
          • Path C:\Windows\Temp\{3E1CF678-F6AB-4E71-94CF-12E02A451CEE}\vcRuntime_arm64
          • Size 208KB
          • SHA256 fa0196a57efd61d25cbddf86e6d0ec596a7002b6ff4b8c9fe5b33ddce5bd6dd8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab54A5CABBE7274D8A22EB58060AAB7623
          • Path C:\Windows\Temp\{4F2AD787-BF14-47FC-9317-E2C12AC51E0C}\cab54A5CABBE7274D8A22EB58060AAB7623
          • Size 841KB
          • SHA256 2cb3a1b4f9a4baaf43f4ecc2fb80235c21591519b3e9f4a541a3d635998cdacf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cabB3E1576D1FEFBB979E13B1A5379E0B16
          • Path C:\Windows\Temp\{4F2AD787-BF14-47FC-9317-E2C12AC51E0C}\cabB3E1576D1FEFBB979E13B1A5379E0B16
          • Size 4.9MB
          • SHA256 6581882e1855424594ea007bc25c00ed9efa8da59914f30cd6b0a1a6de8be804
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x86
          • Path C:\Windows\Temp\{4F2AD787-BF14-47FC-9317-E2C12AC51E0C}\vcRuntimeAdditional_x86
          • Size 200KB
          • SHA256 957492cd0e106d7296b1f2eb9642d34300d11fbce603866f3d5762c2e08f33c3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x86
          • Path C:\Windows\Temp\{4F2AD787-BF14-47FC-9317-E2C12AC51E0C}\vcRuntimeMinimum_x86
          • Size 200KB
          • SHA256 a8fd1435b086e6d2d7cce233a5bdd899ef6ac76be755883c55df134c5aba1a2d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Windows\Temp\{697CC616-B892-45A9-B1F1-4D1B1E2BED69}\.cr\vc_redist.x64.exe
          • Size 670KB
          • SHA256 bd25d6a5c9ef835802ba25100ce66c9402dbca74d309db5fbaefa1532af31d5a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{71E6452E-7AD3-4D14-A164-5274FFAC113C}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{71E6452E-7AD3-4D14-A164-5274FFAC113C}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1028\license.rtf
          • Size 17KB
          • SHA256 44c76290f7a2e45940e8338912feb49bcf4e071cfa85d2d34762857743acbc8d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1028\thm.wxl
          • Size 2KB
          • SHA256 8e2e660dfb66cb453e17f1b6991799678b1c8b350a55f9ebe2ba0028018a15ad
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1029\license.rtf
          • Size 12KB
          • SHA256 503c433dcde2f3a9e7d388a5ff2b0612e7d8f90f5188d5b2b60228db33044fde
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1029\thm.wxl
          • Size 3KB
          • SHA256 07fb3ec174f25dfbe532d9d739234d9dfda8e9d34f01fe660c5b4d56989fa779
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1031\license.rtf
          • Size 12KB
          • SHA256 28f63bad9c2960395106011761993049546607f8a850d344d6a54042176bf03f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1031\thm.wxl
          • Size 3KB
          • SHA256 8e0dca6e085744bfcbff46f7dcbcfa6fbd722dfa52013ee8ceeaf682d7509581
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1036\license.rtf
          • Size 12KB
          • SHA256 5c13a65870d770d1642a4259eecb436257ca39016a0500f747be9c79be0c7009
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1036\thm.wxl
          • Size 3KB
          • SHA256 704ddf2e60c1f292be95c7c79ee48fe8ba8534ceb7ccf9a9ea68b1ad788ae9d4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1040\license.rtf
          • Size 11KB
          • SHA256 70ecf23c03b66a2b18e173332586afa8f00f91e02a80628f4f9cb2521e27f6ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1040\thm.wxl
          • Size 3KB
          • SHA256 0c57f40cc2091554307aa8a7c35dd38e4596e9513e9efae00ac30498ef4e9bc2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1041\license.rtf
          • Size 29KB
          • SHA256 c3061a334bfd5f02b7085f8f454d5d3d97d477af14bab497bf31a7887bc90c5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1041\thm.wxl
          • Size 3KB
          • SHA256 6b9bbf90d75cfa7d943f036c01602945fe2fa786c6173e22acb7afe18375c7ea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1042\license.rtf
          • Size 27KB
          • SHA256 3d4e9c165cbeab829d608106f0e96450f839ffa8adbd755f0b51867e89da2ae0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1042\thm.wxl
          • Size 3KB
          • SHA256 ad7608b87a7135f408abf54a897a0f0920080f76013314b00d301d6264ae90b2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1045\license.rtf
          • Size 13KB
          • SHA256 6f94a99072061012c5626a6dd069809ec841d6e3102b48394d522a0c2e3aa2b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1045\thm.wxl
          • Size 3KB
          • SHA256 440b309fcdf61ffc03b269fe3815c60cb52c6ae3fc6acad14eac04d057b6d6ea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1046\license.rtf
          • Size 10KB
          • SHA256 27891eec899be859e3b4d3b29247fc6b535d7e836def0329111c48741ec6e701
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1046\thm.wxl
          • Size 3KB
          • SHA256 f52b54a0e0d0e8f12cba9823d88e9fd6822b669074dd1dc69dad6553f7cb8913
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1049\license.rtf
          • Size 31KB
          • SHA256 1bb3fb55b8a13fa3bafffe72f5b1ed8b57a63bd4d8654bb6dc5b9011ce803b44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1049\thm.wxl
          • Size 4KB
          • SHA256 7333bc8e52548821d82b53dbd7d7c4aa1703c85155480cb83cefd78380c95661
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1055\license.rtf
          • Size 13KB
          • SHA256 f80926604e503697247353f56856b31de0b3fc1319f1c94068363952549cc9b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\1055\thm.wxl
          • Size 3KB
          • SHA256 e5abe3cb3bf84207dac4e6f5bba1e693341d01aea076dd2d91eaa21c6a6cb925
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\2052\license.rtf
          • Size 17KB
          • SHA256 a808b4933ce3b3e0893504dbef43ebf90b8b567f94bd6481b6315ed9141e1b11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\2052\thm.wxl
          • Size 2KB
          • SHA256 2ac8b7c19a5189662de36a0581c90dbad96df259ec00a28f609b644c3f39f9ca
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\3082\license.rtf
          • Size 10KB
          • SHA256 abc11bb2b04dff6afe2d4d4f40d95a7d62e5af352928af90daa3dade58dd59bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{921B8707-1D7E-4690-A6FF-29A3446425A9}\.ba\3082\thm.wxl
          • Size 3KB
          • SHA256 9cbb2b312c100b309a1b1495e84e2228b937612885f7a642fbbd67969b632c3a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{9B0EEB5F-077E-49AC-B3EE-E6955F2EE672}\.ba\license.rtf
          • Size 9KB
          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{9B0EEB5F-077E-49AC-B3EE-E6955F2EE672}\.ba\thm.wxl
          • Size 2KB
          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\Temp\{9B0EEB5F-077E-49AC-B3EE-E6955F2EE672}\.ba\thm.xml
          • Size 8KB
          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x86.exe
          • Path C:\Windows\Temp\{A47AFE72-8DB2-4C32-B9C9-D3E8754CFF10}\.cr\vc_redist.x86.exe
          • Size 669KB
          • SHA256 0bf10b50928e59c4cd9380a87d9aa89e61c4a1494567f99d914effe240b0dbad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.arm64.exe
          • Path C:\Windows\Temp\{C8E0B72C-BB28-48F9-B642-6FB5C040BB1E}\.cr\vc_redist.arm64.exe
          • Size 667KB
          • SHA256 1f8d710c6ed91de9df9ad40f47f03b87c36b5a2c25a7fe49dea83c71b0e10a0b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{FED9B48C-308E-40A3-97E0-31CDD5F52790}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1136-462-0x0000000000C40000-0x0000000000CB9000-memory.dmp
          Download

          memory/2560-439-0x0000000000860000-0x00000000008D7000-memory.dmp
          Download

          memory/2860-438-0x0000000000860000-0x00000000008D7000-memory.dmp
          Download

          memory/3360-463-0x0000000000C40000-0x0000000000CB9000-memory.dmp
          Download

          memory/4560-436-0x0000000000860000-0x00000000008D7000-memory.dmp
          Download

          memory/5644-8-0x0000000005640000-0x0000000005648000-memory.dmp
          Download

          memory/5644-10-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
          Download

          memory/5644-5-0x00007FFFB990F000-0x00007FFFB9910000-memory.dmp
          Download

          memory/5644-440-0x0000000021570000-0x0000000021578000-memory.dmp
          Download

          memory/5644-443-0x00000000215C0000-0x00000000215CE000-memory.dmp
          Download

          memory/5644-442-0x00000000215F0000-0x000000002162E000-memory.dmp
          Download

          memory/5644-7-0x0000000000380000-0x00000000045E6000-memory.dmp
          Download

          memory/5644-6-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
          Download

          memory/5644-78-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp
          Download