Overview

overview

8

Static

static

3

2026-08-26...os.exe

windows10-2004-x64

8

2026-08-26...os.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/08/2026, 01:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-26_fa87503d94dd464862de8a407e9f901f_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
  • Size 1.8MB
  • Sample260827-bdk2mayckf
  • SHA256 61959dc550c7e14bfdb61565f5415474acf58d78107102aa498a844fdb6630be
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 49 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-26_fa87503d94dd464862de8a407e9f901f_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-26_fa87503d94dd464862de8a407e9f901f_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5780
    • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_XMLFA\GalaxyInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_XMLFA\GalaxyInstaller.exe" 1971477531 "GWENT: The Witcher Card Game"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4704
      • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_XMLFA\GalaxySetup.exe
        "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_XMLFA\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1971477531 /silent /game_name="GWENT: The Witcher Card Game"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1484
        • C:\Users\Admin\AppData\Local\Temp\is-NTQOK6PLS3.tmp\GalaxySetup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-NTQOK6PLS3.tmp\GalaxySetup.tmp" /SL5="$150060,337782750,1791488,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_XMLFA\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1971477531 /silent /game_name="GWENT: The Witcher Card Game"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2304
          • C:\Users\Admin\AppData\Local\Temp\is-7LYCAYQMMB.tmp\vc_redist.x86.exe
            "C:\Users\Admin\AppData\Local\Temp\is-7LYCAYQMMB.tmp\vc_redist.x86.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5404
            • C:\Windows\Temp\{372FA33B-57F1-4175-BEA6-D7DD937505F2}\.cr\vc_redist.x86.exe
              "C:\Windows\Temp\{372FA33B-57F1-4175-BEA6-D7DD937505F2}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-7LYCAYQMMB.tmp\vc_redist.x86.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5464
              • C:\Windows\Temp\{7EBD4BA3-CB72-4284-AB5B-5A8957D58AA1}\.be\VC_redist.x86.exe
                "C:\Windows\Temp\{7EBD4BA3-CB72-4284-AB5B-5A8957D58AA1}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{0453093A-F81B-4429-93B5-5C0B7236498E} {9DC60324-74C6-4881-8FF1-8B0BA2943937} 5464
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3516
                • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={73fd1972-7030-4d2d-9ede-dd38a78c1d52} -burn.filehandle.self=1128 -burn.embedded BurnPipe.{9DC449F9-11C7-4828-980E-384ECD7954D9} {A7FC5DE2-0EF1-4C00-BF43-8F2CA5E91364} 3516
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:5288
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4568
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:2712
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4196
    • C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe
        "C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260827020304.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3404
        • C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe
          "C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260827020304.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5612
          • C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe
            "C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{8F5C0ACA-06B4-44CA-92E7-C2321FAAA3FD} {B9FCFCBC-758F-4FE8-A3C2-8107E2224C9A} 5612
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:5824
            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={73fd1972-7030-4d2d-9ede-dd38a78c1d52} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{AE484CD4-AD87-4405-BCD1-7649884FDE12} {691A8F2A-0F67-414B-86A6-0F447156B0F4} 5824
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2656
              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={73fd1972-7030-4d2d-9ede-dd38a78c1d52} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{AE484CD4-AD87-4405-BCD1-7649884FDE12} {691A8F2A-0F67-414B-86A6-0F447156B0F4} 5824
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4128
                • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{A9006328-7A14-4269-9A85-0FBB911142A1} {FF69A29D-F23E-4766-9A31-07A6991654B0} 4128
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:1308

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5aab2b.rbs
          • Path C:\Config.Msi\e5aab2b.rbs
          • Size 16KB
          • SHA256 1b4373468fdf6edd6529fa7b1f3847b5fe5faa4013912965c6eb345b12f578e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5aab30.rbs
          • Path C:\Config.Msi\e5aab30.rbs
          • Size 18KB
          • SHA256 4ebb0576dd2c565655a7071881a7b2cdd8d80807e68a9c46c6a64a7e4863339a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5aab3d.rbs
          • Path C:\Config.Msi\e5aab3d.rbs
          • Size 20KB
          • SHA256 7a4a8ba8ff60b445383fef81129ee60f9200e9dc81a8ebc837152b918a95e86c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5aab4c.rbs
          • Path C:\Config.Msi\e5aab4c.rbs
          • Size 19KB
          • SHA256 c5ceaaba84040351122f9613713d300f7841ce3e1e978a4eb6b75546b53aa592
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-JSLF30TFSW.tmp
          • Path C:\Program Files\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\_websocket\is-JSLF30TFSW.tmp
          • Size 18KB
          • SHA256 682d97f70917c59a8a09ba2759d2504c4f12a1f4ffd091a584a8f2f0bda4b7f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-ZOMVKBASH5.tmp
          • Path C:\Program Files\GOG Galaxy\plugins\GalaxyPluginXbox\propcache\is-ZOMVKBASH5.tmp
          • Size 14B
          • SHA256 6b2e4e30ee3be4f95c67f15bba7f666875bb63a3014e4d145cbe33b47c7722e8
          • MD5 SHA1 SHA512
          Submit Download

          is-6LFNFITWPU.tmp
          • Path C:\Program Files\GOG Galaxy\web\is-6LFNFITWPU.tmp
          • Size 27KB
          • SHA256 9d7f768138e6afa99714de21d61e6096a425fa168da6a6ed11e1c5356f438d91
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-6Z6438KEUU.tmp
          • Path C:\Program Files\GOG Galaxy\web\locales\pt-PT\is-6Z6438KEUU.tmp
          • Size 1KB
          • SHA256 4b09dfb390e8e522d12861d0f5e22462658bdacaceaee67bc5132228f9e802d0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          is-7E766PTCEX.tmp
          • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-7E766PTCEX.tmp
          • Size 54KB
          • SHA256 a54d17708ce3d7cb1f62a3e0b5481cb0ee78db2f14426328d00b2b5ab2238f18
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-FOGUWRA5KX.tmp
          • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-FOGUWRA5KX.tmp
          • Size 40KB
          • SHA256 fac8bb4a19c265294393bebac2a25e825507de3d79e9e239f6decb8702f57926
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          InstallerWebinstaller.log
          • Path C:\ProgramData\GOG.com\Galaxy\logs\InstallerWebinstaller.log
          • Size 728B
          • SHA256 310dd175927a2073ab96577c72811471e2bf1121405c0fa0f3299d7ac9ea1f66
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\state.rsm
          • Size 988B
          • SHA256 f07a0bf5b25e4acaa4f7eb4d0b6218d69eee4cc172c338bb73bb3534eb023413
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          GalaxyInstaller.exe
          • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_XMLFA\GalaxyInstaller.exe
          • Size 607KB
          • SHA256 0fc3b42a96b6ac0fa20556bac1d6a58071436952cddd8655545dc24ff207a09a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icon.ico
          • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_XMLFA\icon.ico
          • Size 520KB
          • SHA256 d09ccaf753e884a02976544208a33b72a17e74eba9a0254b355554752f4a267f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          payload.campaign
          • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_XMLFA\payload.campaign
          • Size 545B
          • SHA256 d2dab1e68b83f97c1bc6891aad4466ab82bba56e3d00922b3fead2f51143fd7c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          remoteconfig.json
          • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_XMLFA\remoteconfig.json
          • Size 529B
          • SHA256 110ed2fc0245994dc44ccde50064e2e996864031309fc46b13369cdbec5e1099
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_x86_20260827020304_000_vcRuntimeMinimum_x86.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260827020304_000_vcRuntimeMinimum_x86.log
          • Size 2KB
          • SHA256 8edf08e793b188b6be239089a6489e64d77dab2c58f40672d379f3536b486101
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_x86_20260827020304_001_vcRuntimeAdditional_x86.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260827020304_001_vcRuntimeAdditional_x86.log
          • Size 2KB
          • SHA256 01bafd392430b8cb6833d5502476382ac9ca7fba1b3ee853dcde8a8a68a46fb8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _isdecmp.dll
          • Path C:\Users\Admin\AppData\Local\Temp\is-7LYCAYQMMB.tmp\_isetup\_isdecmp.dll
          • Size 27KB
          • SHA256 231ae2fd793ab01ffb47611eb32cf64cdf5f447736cba4268b3e54875ff87330
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x86.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-7LYCAYQMMB.tmp\vc_redist.x86.exe
          • Size 6.7MB
          • SHA256 b6ab675f0a27e6600f9726e75dea08d99c15f8ea4b842a2a1d988fa9529d39b9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GalaxySetup.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-NTQOK6PLS3.tmp\GalaxySetup.tmp
          • Size 7.0MB
          • SHA256 3632388cb25f3ca257938519a1ef2bb9fbbe4c7ae7177e2c4694ac7b2fde8980
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x86.exe
          • Path C:\Windows\Temp\{372FA33B-57F1-4175-BEA6-D7DD937505F2}\.cr\vc_redist.x86.exe
          • Size 668KB
          • SHA256 746a6db1a22c0e3efb2bb7301c179a7201c462c55214b36c3f95639c55322fe8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{7EBD4BA3-CB72-4284-AB5B-5A8957D58AA1}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{7EBD4BA3-CB72-4284-AB5B-5A8957D58AA1}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab54A5CABBE7274D8A22EB58060AAB7623
          • Path C:\Windows\Temp\{7EBD4BA3-CB72-4284-AB5B-5A8957D58AA1}\cab54A5CABBE7274D8A22EB58060AAB7623
          • Size 902KB
          • SHA256 19cbe6fdbd8625c6f0ed9eb733057be711209c14ad87115d0396ea2c04b5bc1a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cabB3E1576D1FEFBB979E13B1A5379E0B16
          • Path C:\Windows\Temp\{7EBD4BA3-CB72-4284-AB5B-5A8957D58AA1}\cabB3E1576D1FEFBB979E13B1A5379E0B16
          • Size 4.9MB
          • SHA256 bc152a94642c9642bbc1d76454ce4df62c4f33f271588d1aa5618a8288ed27d3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x86
          • Path C:\Windows\Temp\{7EBD4BA3-CB72-4284-AB5B-5A8957D58AA1}\vcRuntimeAdditional_x86
          • Size 200KB
          • SHA256 5b8fe9c8e3d2d264bcf813a6a06bfd3d997edcb7cb731e0cd87ac79c76a15349
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x86
          • Path C:\Windows\Temp\{7EBD4BA3-CB72-4284-AB5B-5A8957D58AA1}\vcRuntimeMinimum_x86
          • Size 200KB
          • SHA256 d5006e047b46437542b122affb7bd45628eea07e2086062ec349c7efdd7929cd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EA0F495A-F729-4743-A9D1-45CFFA57DD70}\.ba\license.rtf
          • Size 9KB
          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EA0F495A-F729-4743-A9D1-45CFFA57DD70}\.ba\thm.wxl
          • Size 2KB
          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\Temp\{EA0F495A-F729-4743-A9D1-45CFFA57DD70}\.ba\thm.xml
          • Size 8KB
          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{EA0F495A-F729-4743-A9D1-45CFFA57DD70}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1308-2216-0x00000000000B0000-0x0000000000127000-memory.dmp
          Download

          memory/1484-478-0x0000000000460000-0x000000000062B000-memory.dmp
          Download

          memory/1484-60-0x0000000000460000-0x000000000062B000-memory.dmp
          Download

          memory/2304-2041-0x0000000000B20000-0x000000000122D000-memory.dmp
          Download

          memory/2304-767-0x0000000000B20000-0x000000000122D000-memory.dmp
          Download

          memory/2656-2220-0x00000000000B0000-0x0000000000127000-memory.dmp
          Download

          memory/4128-2218-0x00000000000B0000-0x0000000000127000-memory.dmp
          Download

          memory/4704-34-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp
          Download

          memory/4704-32-0x000000001C760000-0x000000001C922000-memory.dmp
          Download

          memory/4704-42-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp
          Download

          memory/4704-41-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp
          Download

          memory/4704-20-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp
          Download

          memory/4704-36-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp
          Download

          memory/4704-35-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp
          Download

          memory/4704-44-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp
          Download

          memory/4704-33-0x000000001ECF0000-0x000000001F218000-memory.dmp
          Download

          memory/4704-43-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp
          Download

          memory/4704-19-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp
          Download

          memory/4704-18-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp
          Download

          memory/4704-17-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp
          Download

          memory/4704-16-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp
          Download

          memory/4704-15-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp
          Download

          memory/4704-14-0x00000000005D0000-0x000000000066C000-memory.dmp
          Download

          memory/4704-13-0x00007FFA8500F000-0x00007FFA85010000-memory.dmp
          Download

          memory/4704-45-0x00007FFA84E80000-0x00007FFA85824000-memory.dmp
          Download

          memory/5780-0-0x00000000004F0000-0x00000000006C9000-memory.dmp
          Download