Overview

overview

6

Static

static

1

FontLab-8-...84.exe

windows10-2004-x64

4

FontLab-8-...84.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 21:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FontLab-8-Win64-Install-8984.exe
  • Size 105.2MB
  • Sample261020-1frdvsft9s
  • SHA256 2d42613e09d7497bff1ae300ae8e1ad77db7d966a3981c921d2cf12f6b6e03a2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 50 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 23 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 59 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\FontLab-8-Win64-Install-8984.exe
    "C:\Users\Admin\AppData\Local\Temp\FontLab-8-Win64-Install-8984.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5716
    • C:\Users\Admin\AppData\Local\Temp\is-70K4U.tmp\FontLab-8-Win64-Install-8984.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-70K4U.tmp\FontLab-8-Win64-Install-8984.tmp" /SL5="$7021C,109305221,900608,C:\Users\Admin\AppData\Local\Temp\FontLab-8-Win64-Install-8984.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Users\Admin\AppData\Local\Temp\is-0H8OC.tmp\vc_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-0H8OC.tmp\vc_redist.x64.exe" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5780
        • C:\Windows\Temp\{9A1BD6B8-B1B6-442C-B087-64DBA5A8288B}\.cr\vc_redist.x64.exe
          "C:\Windows\Temp\{9A1BD6B8-B1B6-442C-B087-64DBA5A8288B}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-0H8OC.tmp\vc_redist.x64.exe" -burn.filehandle.attached=616 -burn.filehandle.self=604 /q /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5232
          • C:\Windows\Temp\{90DD73CA-033C-49DE-947F-DFEF18BA7F9C}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{90DD73CA-033C-49DE-947F-DFEF18BA7F9C}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{38A97B67-1641-4E1E-BBF5-59F771AE01AC} {696DD492-3AF5-4983-A722-E400462CB068} 5232
            5⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:1880
      • C:\Program Files\Fontlab\FontLab 8\FontLab 8.exe
        "C:\Program Files\Fontlab\FontLab 8\FontLab 8.exe"
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:5844
        • C:\Program Files\Fontlab\FontLab 8\PythonChecker.exe
          PythonChecker.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2120
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:5836
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:2580
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4828
    • C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3876
      • C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261020223656.log"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3360
        • C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261020223656.log"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C02085B9-0F4D-4975-A801-F2922B7A02E4} {284F3782-DD1B-4C3A-A983-F24EA9C17067} 2704
            4⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3524
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{397419B5-DD83-4450-A21D-F8DA2E68F56A} {C34B6B35-BA44-4CEF-A69C-ADC6C90F8AE6} 3524
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:296
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{397419B5-DD83-4450-A21D-F8DA2E68F56A} {C34B6B35-BA44-4CEF-A69C-ADC6C90F8AE6} 3524
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4072
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{AE9305BD-288C-4245-A55C-575B11B712FB} {DDC810F0-E653-423A-A4EF-17CECE679711} 4072
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4464

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5a478f.rbs
          • Path C:\Config.Msi\e5a478f.rbs
          • Size 19KB
          • SHA256 8957bbd872a262d6d3ba88d0401eea3d5e0ac139eb9550cee5c1d7823340094d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a479b.rbs
          • Path C:\Config.Msi\e5a479b.rbs
          • Size 19KB
          • SHA256 e086a10d00cfdb8b6df8f49153660389b00e28054f5f521bc2cece32173cdbe0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a47a2.rbs
          • Path C:\Config.Msi\e5a47a2.rbs
          • Size 21KB
          • SHA256 da48a8dec45cfdb9d624feac7ac404614f42775a907446894ceb02e5cdaa658b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a47b1.rbs
          • Path C:\Config.Msi\e5a47b1.rbs
          • Size 21KB
          • SHA256 b342cb3e6789e1b966b79c12f38021939ec8f16b15b71a438af7d944aa03c0a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-36U2H.tmp
          • Path C:\Program Files\Fontlab\FontLab 8\Lib\__phello__\is-36U2H.tmp
          • Size 104B
          • SHA256 b9ba5f17a049779747dbc8b17fa318fab67875be829994ed437c81d0666a88dc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          is-55SMP.tmp
          • Path C:\Program Files\Fontlab\FontLab 8\Lib\xmlrpc\is-55SMP.tmp
          • Size 39B
          • SHA256 52069aeefb58dad898781d8bde183ffda18faae11f17ace8ce83368cab863fb1
          • MD5 SHA1 SHA512
          Submit Download

          PythonChecker.exe
          • Path C:\Program Files\Fontlab\FontLab 8\PythonChecker.exe
          • Size 13KB
          • SHA256 fc34ba0706181772a1f29f8829f7f302a10a3d52a044f6525af4aea0d0b2d05d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PythonQt.dll
          • Path C:\Program Files\Fontlab\FontLab 8\PythonQt.dll
          • Size 1.3MB
          • SHA256 baaafa22452948f7841d47bc2a98b18f06ab9ca1a388e448f7f8b49b8ecd506e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PythonQt_QtAll.dll
          • Path C:\Program Files\Fontlab\FontLab 8\PythonQt_QtAll.dll
          • Size 8.7MB
          • SHA256 d026254eeb643fcad583d8d590aaa7964a2ab948ae13adf81c94007db5d47eb4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Concurrent.dll
          • Path C:\Program Files\Fontlab\FontLab 8\Qt5Concurrent.dll
          • Size 37KB
          • SHA256 195e5b1ee2b88eb0fa3522b61fe9f685ab8efe80a910c8841a7cabb4b7845fde
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Core.dll
          • Path C:\Program Files\Fontlab\FontLab 8\Qt5Core.dll
          • Size 5.9MB
          • SHA256 96f9afe242ffeffa1d9c3d05918a2c13f5b495ff6f1fb1e26abd6eda230458d8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Gui.dll
          • Path C:\Program Files\Fontlab\FontLab 8\Qt5Gui.dll
          • Size 7.2MB
          • SHA256 718d69289df3e5a3d71c921b81953fc4b0ec8acfb52c630c5eb75874d4cf9b30
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Network.dll
          • Path C:\Program Files\Fontlab\FontLab 8\Qt5Network.dll
          • Size 1.3MB
          • SHA256 115bb0413e0b6646451374f86a3f7d087b3a76200a7fe60ff214c3fae11e384c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5PrintSupport.dll
          • Path C:\Program Files\Fontlab\FontLab 8\Qt5PrintSupport.dll
          • Size 316KB
          • SHA256 066ba12d0b22579349bbb59dfa02acebfd5b0eb83a67f9faf42eb81a06bd5879
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Svg.dll
          • Path C:\Program Files\Fontlab\FontLab 8\Qt5Svg.dll
          • Size 331KB
          • SHA256 c83f65944591c2c3645617ff065dcd084c0466edf199379da23725c8594db18c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Widgets.dll
          • Path C:\Program Files\Fontlab\FontLab 8\Qt5Widgets.dll
          • Size 5.3MB
          • SHA256 ec19a95a37e2076f7caaecf7b8cb884fb010a44058de52f79659552b33fad704
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5WinExtras.dll
          • Path C:\Program Files\Fontlab\FontLab 8\Qt5WinExtras.dll
          • Size 237KB
          • SHA256 d21852ef1d8dabbf7ed674b2fd0a45cd2fbdd8c9eef30d169beb7a4f1ffefeff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Xml.dll
          • Path C:\Program Files\Fontlab\FontLab 8\Qt5Xml.dll
          • Size 217KB
          • SHA256 1e93a0059394ec641728460ac28efb0fe81767c3872f98f5330911b2a85fc976
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-J2B2F.tmp
          • Path C:\Program Files\Fontlab\FontLab 8\Resources\pairs\is-J2B2F.tmp
          • Size 7KB
          • SHA256 8adde6c60ff303fd61b3b16a785793fe702a5b8f38c6805c9eeb4bf82bedd254
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-JKI04.tmp
          • Path C:\Program Files\Fontlab\FontLab 8\Resources\python\3.11\site-packages\fontlab_private\fontTools\misc\is-JKI04.tmp
          • Size 75B
          • SHA256 0c90569a85ff1da6aeeea9609af5b27db852ceb5f6a8beb7e919ecec21b4d699
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          is-PATA6.tmp
          • Path C:\Program Files\Fontlab\FontLab 8\Resources\readme_files\Codepage\is-PATA6.tmp
          • Size 655B
          • SHA256 49387f5b97dc1f0d39ebe40ea78893862a9845fd969d22df006f5ae74b8f9830
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          is-727QD.tmp
          • Path C:\Program Files\Fontlab\FontLab 8\Resources\readme_files\Data\is-727QD.tmp
          • Size 669B
          • SHA256 39fe5e525e37fdffed35351b8e28b8e5bd3d94c4b6daab529add67dc582eb073
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          is-2T5HO.tmp
          • Path C:\Program Files\Fontlab\FontLab 8\Resources\readme_files\Encoding\is-2T5HO.tmp
          • Size 667B
          • SHA256 23fd83f5a0c49993566013f7898a738d6c915b986a9eb68cb2b34a1e313615ed
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          freetype.dll
          • Path C:\Program Files\Fontlab\FontLab 8\freetype.dll
          • Size 667KB
          • SHA256 b260fb8cd07d2be2897fb9cedfea73937f057df5a7be3ae9d946f120483be333
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          harfbuzz.dll
          • Path C:\Program Files\Fontlab\FontLab 8\harfbuzz.dll
          • Size 4.8MB
          • SHA256 a585ea94a39c0f6429b5ed610c9d1fe1287475b32aacb109ecb90771190ae0a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1-x64.dll
          • Path C:\Program Files\Fontlab\FontLab 8\libcrypto-1_1-x64.dll
          • Size 3.3MB
          • SHA256 39abddad98877786a6c5fb2ebadb31201d2fcfda4957ee3b9ad738ab69c2cb8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libtesseract.dll
          • Path C:\Program Files\Fontlab\FontLab 8\libtesseract.dll
          • Size 4.0MB
          • SHA256 03064dd83f12f41705febb237063a02a31828df60e82ad81cee97d27dc3a50f2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-52Q0N.tmp
          • Path C:\Program Files\Fontlab\FontLab 8\plugins\platforms\is-52Q0N.tmp
          • Size 1.5MB
          • SHA256 990a97ee2f72998c26d921f37994f223c24a99c26a2b586ef9b6e8c14f7250af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python311.dll
          • Path C:\Program Files\Fontlab\FontLab 8\python311.dll
          • Size 5.5MB
          • SHA256 c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qscintilla2_qt5.dll
          • Path C:\Program Files\Fontlab\FontLab 8\qscintilla2_qt5.dll
          • Size 2.0MB
          • SHA256 39d0adb595855ddd80ae043f2041e7e7da50327575451f5bde516b7723f16288
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140.dll
          • Path C:\Program Files\Fontlab\FontLab 8\vcruntime140.dll
          • Size 95KB
          • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          yaml-cpp.dll
          • Path C:\Program Files\Fontlab\FontLab 8\yaml-cpp.dll
          • Size 428KB
          • SHA256 5b56eefcdca9d73c56db357aecbae89fb620f5ae982ded49458220345a9060de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zlib.dll
          • Path C:\Program Files\Fontlab\FontLab 8\zlib.dll
          • Size 179KB
          • SHA256 71baea7ab6d2e7d5dcf08a4b19a175e382d871dcd502535fabee04296f9f8f1a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\state.rsm
          • Size 964B
          • SHA256 b255c6bc7cc33f49cd379cc9ae893ce24c48758b9b6d92cc7af6aec74e2363fe
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20261020223656_000_vcRuntimeMinimum_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261020223656_000_vcRuntimeMinimum_x64.log
          • Size 2KB
          • SHA256 3b6d124f99c268739b0a3e315a2bd0bec027aee1b34326ed85287261b660d0c9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20261020223656_001_vcRuntimeAdditional_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261020223656_001_vcRuntimeAdditional_x64.log
          • Size 2KB
          • SHA256 ceb80b41f4d6d91bf299b97b1640c940b90d388cfb5de7e595267ad52129dfdd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-0H8OC.tmp\vc_redist.x64.exe
          • Size 24.2MB
          • SHA256 917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FontLab-8-Win64-Install-8984.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-70K4U.tmp\FontLab-8-Win64-Install-8984.tmp
          • Size 3.1MB
          • SHA256 cc23ba2b9d5200fd5264eded2fecc610fd329b96ec5b1ff2082aa3d781c2fd77
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140.dll
          • Path C:\Windows\System32\msvcp140.dll
          • Size 564KB
          • SHA256 74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BootstrapperApplicationData.xml
          • Path C:\Windows\Temp\{4E8A8E4C-8ABE-4E9A-B771-B2C74E41097D}\.ba\BootstrapperApplicationData.xml
          • Size 14KB
          • SHA256 e3becb81ef61964e7d969653b6dac7c9873a46e58bae4400aeb7656a04eaf5be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{4E8A8E4C-8ABE-4E9A-B771-B2C74E41097D}\.ba\license.rtf
          • Size 9KB
          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{4E8A8E4C-8ABE-4E9A-B771-B2C74E41097D}\.ba\thm.wxl
          • Size 2KB
          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\Temp\{4E8A8E4C-8ABE-4E9A-B771-B2C74E41097D}\.ba\thm.xml
          • Size 8KB
          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{90DD73CA-033C-49DE-947F-DFEF18BA7F9C}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{90DD73CA-033C-49DE-947F-DFEF18BA7F9C}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Path C:\Windows\Temp\{90DD73CA-033C-49DE-947F-DFEF18BA7F9C}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Size 5.4MB
          • SHA256 2de285c0fc328d30501cad8aa66a0ca9556ad5e30d03b198ebdbc422347db138
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab5046A8AB272BF37297BB7928664C9503
          • Path C:\Windows\Temp\{90DD73CA-033C-49DE-947F-DFEF18BA7F9C}\cab5046A8AB272BF37297BB7928664C9503
          • Size 935KB
          • SHA256 b8b4732a600b741e824ab749321e029a07390aa730ec59401964b38105d5fa11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x64
          • Path C:\Windows\Temp\{90DD73CA-033C-49DE-947F-DFEF18BA7F9C}\vcRuntimeAdditional_x64
          • Size 188KB
          • SHA256 1c450cacdbf38527c27eb2107a674cd9da30aaf93a36be3c5729293f6f586e07
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x64
          • Path C:\Windows\Temp\{90DD73CA-033C-49DE-947F-DFEF18BA7F9C}\vcRuntimeMinimum_x64
          • Size 188KB
          • SHA256 ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Windows\Temp\{9A1BD6B8-B1B6-442C-B087-64DBA5A8288B}\.cr\vc_redist.x64.exe
          • Size 635KB
          • SHA256 9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/296-4640-0x00000000000D0000-0x0000000000147000-memory.dmp
          Download

          memory/1652-4374-0x0000000000400000-0x0000000000725000-memory.dmp
          Download

          memory/1652-2156-0x0000000000400000-0x0000000000725000-memory.dmp
          Download

          memory/1652-4710-0x0000000000400000-0x0000000000725000-memory.dmp
          Download

          memory/1652-6-0x00000000028B0000-0x00000000028B1000-memory.dmp
          Download

          memory/1652-10-0x00000000028B0000-0x00000000028B1000-memory.dmp
          Download

          memory/1652-9-0x0000000000400000-0x0000000000725000-memory.dmp
          Download

          memory/4072-4639-0x00000000000D0000-0x0000000000147000-memory.dmp
          Download

          memory/4464-4637-0x00000000000D0000-0x0000000000147000-memory.dmp
          Download

          memory/5716-0-0x0000000000400000-0x00000000004E9000-memory.dmp
          Download

          memory/5716-8-0x0000000000400000-0x00000000004E9000-memory.dmp
          Download

          memory/5716-4711-0x0000000000400000-0x00000000004E9000-memory.dmp
          Download

          memory/5844-4694-0x00007FF6D1750000-0x00007FF6D5297000-memory.dmp
          Download

          memory/5844-4693-0x00007FFF6A640000-0x00007FFF6AB8D000-memory.dmp
          Download

          memory/5844-4695-0x00007FFF6B040000-0x00007FFF6B936000-memory.dmp
          Download