Overview

overview

9

Static

static

1

1_ChemDraw_26-0.exe

windows10-2004-x64

9

1_ChemDraw_26-0.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    151s
  • max time network
    161s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 19:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1_ChemDraw_26-0.exe
  • Size 393.0MB
  • Sample261024-x2g6jaff35
  • SHA256 db5f0c04e817c6a28b59f6eec91d5a1b1b3700ade851b4a42fcd435df5746fac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwarediscoveryexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 61 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Windows directory 33 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 11 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 51 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\1_ChemDraw_26-0.exe
    "C:\Users\Admin\AppData\Local\Temp\1_ChemDraw_26-0.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3320
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\Install.bat" "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:972
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "$group = (Get-WmiObject -Class Win32_Group -Filter \"Domain='$env:computername' and SID='S-1-5-32-544'\").Name; $group | Out-File -FilePath "C:\Users\Admin\AppData\Local\ADMINISTRATORSGROUPNAME.txt" -Encoding OEM"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5768
      • C:\Windows\SysWOW64\net.exe
        net localgroup Administrators
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4008
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup Administrators
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2564
      • C:\Windows\SysWOW64\findstr.exe
        findstr /b /e /i /c:"CZIEFEEQ\Admin"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2840
      • C:\Windows\SysWOW64\net.exe
        net localgroup Administrators
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4136
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup Administrators
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2836
      • C:\Windows\SysWOW64\findstr.exe
        findstr /b /e /i /c:"Admin"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3584
      • C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\Install.exe
        Install.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5760
        • C:\Windows\SysWOW64\reg.exe
          C:\Windows\SysWOW64\reg.exe IMPORT "C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\HKCU_QProGIF.ocx.del.reg"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1380
        • C:\Windows\SysWOW64\regsvr32.exe
          C:\Windows\SysWOW64\regsvr32.exe /s QProGIF.ocx
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2568
        • C:\Windows\SysWOW64\reg.exe
          C:\Windows\SysWOW64\reg.exe IMPORT "C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\HKCU_MSCOMCTL.OCX.del.reg"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4856
        • C:\Windows\SysWOW64\regsvr32.exe
          C:\Windows\SysWOW64\regsvr32.exe /s MSCOMCTL.OCX
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:1256
        • C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\ThirdParty\Microsoft\VCRedist\vc_redist.x86.exe
          C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\ThirdParty\Microsoft\VCRedist\vc_redist.x86.exe /q /norestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3552
          • C:\Windows\Temp\{2818553A-1AA7-4D74-B6B0-4EDAE05DA643}\.cr\vc_redist.x86.exe
            "C:\Windows\Temp\{2818553A-1AA7-4D74-B6B0-4EDAE05DA643}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\ThirdParty\Microsoft\VCRedist\vc_redist.x86.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /q /norestart
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5576
            • C:\Windows\Temp\{146E376A-99BE-4499-8319-D12104185DE4}\.be\VC_redist.x86.exe
              "C:\Windows\Temp\{146E376A-99BE-4499-8319-D12104185DE4}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{A3A12E21-F83A-4B61-BFE8-560C3E919E9D} {742A4919-5670-499C-B527-4546D556B243} 5576
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4824
        • C:\Windows\SysWOW64\regsvr32.exe
          C:\Windows\SysWOW64\regsvr32.exe /s /u QProGIF.ocx
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3252
        • C:\Windows\SysWOW64\regsvr32.exe
          C:\Windows\SysWOW64\regsvr32.exe /s /u MSCOMCTL.OCX
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4360
        • C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\ThirdParty\Microsoft\VCRedist\vc_redist.x64.exe
          C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\ThirdParty\Microsoft\VCRedist\vc_redist.x64.exe /q /norestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2864
          • C:\Windows\Temp\{744B1766-B572-4A15-983E-6B95E36C0A34}\.cr\vc_redist.x64.exe
            "C:\Windows\Temp\{744B1766-B572-4A15-983E-6B95E36C0A34}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\ThirdParty\Microsoft\VCRedist\vc_redist.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /q /norestart
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1516
            • C:\Windows\Temp\{8C54E7F6-0810-4784-915D-AAC84634AD0C}\.be\VC_redist.x64.exe
              "C:\Windows\Temp\{8C54E7F6-0810-4784-915D-AAC84634AD0C}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D6CD5FD1-1D95-41AC-8213-F3C555746799} {58CDEE48-8237-4FCF-A994-1BB285D1F135} 1516
              6⤵
              • Adds Run key to start application
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3696
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 1616
              6⤵
              • Program crash
              PID:3288
        • C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\ThirdParty\Microsoft\VCRedist\vc_redist.x86.exe
          C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\ThirdParty\Microsoft\VCRedist\vc_redist.x86.exe /q /norestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:832
          • C:\Windows\Temp\{6F04EC1B-1AED-4140-A14F-2237081F9B03}\.cr\vc_redist.x86.exe
            "C:\Windows\Temp\{6F04EC1B-1AED-4140-A14F-2237081F9B03}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\ThirdParty\Microsoft\VCRedist\vc_redist.x86.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /q /norestart
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5644
            • C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.be\VC_redist.x86.exe
              "C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{3391158B-F3B9-4842-8C26-CB746462074E} {679289AA-0B83-4FB3-B3A3-A245E2DB73B8} 5644
              6⤵
              • Adds Run key to start application
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4420
        • C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\ThirdParty\Microsoft\VCRedist\vc_redist.x86.exe
          C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\ThirdParty\Microsoft\VCRedist\vc_redist.x86.exe /q /norestart
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1864
          • C:\Windows\Temp\{D48C4FB0-1424-4D22-B7F1-F15DD7AD4F2D}\.cr\vc_redist.x86.exe
            "C:\Windows\Temp\{D48C4FB0-1424-4D22-B7F1-F15DD7AD4F2D}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\ThirdParty\Microsoft\VCRedist\vc_redist.x86.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /q /norestart
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5944
            • C:\Windows\Temp\{1F0D303D-E045-4D42-A134-8792AB883E53}\.be\VC_redist.x86.exe
              "C:\Windows\Temp\{1F0D303D-E045-4D42-A134-8792AB883E53}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{3BAFAD67-E1F8-4C90-8916-0ECF818ADC8B} {FBCA461F-1361-4115-B1B4-F4474E384BBD} 5944
              6⤵
              • Adds Run key to start application
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:4984
              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1048 -burn.embedded BurnPipe.{41623093-1CEA-4C42-A3D3-3B8BD9766CB2} {55CEEECF-E29C-4E1A-AD6C-134ED3E78A60} 4984
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3364
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3120
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1508
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4244
  • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4376
    • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261024202340.log"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3852
      • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261024202340.log"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3416
        • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D351CB4B-2AF9-48DC-88F3-7659E3387078} {BC481D3F-5213-4CFA-ACBC-FE51974F2633} 3416
          4⤵
          • Adds Run key to start application
          • Enumerates connected drives
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4180
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1516 -ip 1516
    1⤵
      PID:3128
    • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
        "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261024202346.log"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3504
        • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
          "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=548 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261024202346.log"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1580
          • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
            "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{FBDFAA2A-F6A9-446B-A316-BF38129513DC} {AE7348F0-41C6-429A-93BE-A1087E21CA34} 1580
            4⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3060
            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{D1C90EA6-FECC-47D7-834D-9D6EA45E79A9} {70BCA811-56DC-45F9-B84E-C7EF6BE7790C} 3060
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2812
              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{D1C90EA6-FECC-47D7-834D-9D6EA45E79A9} {70BCA811-56DC-45F9-B84E-C7EF6BE7790C} 3060
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2152
                • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{9B61F9AB-52D7-41A6-9DD2-92FF14BE5CB0} {58EBACB0-37DC-4CAB-B1BE-36F16C5D56A2} 2152
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:1764

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5b8a7f.rbs
          • Path C:\Config.Msi\e5b8a7f.rbs
          • Size 19KB
          • SHA256 e38fd1974c8a25f4b4c379f27ff6eafffe8231bdf368c3683c281fb2c983fab4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5b8a90.rbs
          • Path C:\Config.Msi\e5b8a90.rbs
          • Size 16KB
          • SHA256 ace03478fb9789138483661721361d3cd9c642509b1e57a7d097ffb768dc4fca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5b8a95.rbs
          • Path C:\Config.Msi\e5b8a95.rbs
          • Size 18KB
          • SHA256 7c0ac7c2dcc9f8b10cb985ee64f4ac451ee59bf2db1c54bf94aaf39214575e3d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5b8aa2.rbs
          • Path C:\Config.Msi\e5b8aa2.rbs
          • Size 20KB
          • SHA256 53968124379ae0e2ef74093bec565ee89b429d33f902e862b0d1e459bb677bfc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5b8ab1.rbs
          • Path C:\Config.Msi\e5b8ab1.rbs
          • Size 19KB
          • SHA256 493e83115eb9e9e529ca75f3c72b1d3f03f721f4830d09fad0f08ccd6b63ff84
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\state.rsm
          • Size 1KB
          • SHA256 6a365790bc9c131f3c431e09b947754f400d32f4ed617bb4331481167db532bc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
          • Size 1KB
          • SHA256 957de1b47543b5ca79aa30e3e1d5300554837747ebcb639232684b17e7411f0a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ADMINISTRATORSGROUPNAME.txt
          • Path C:\Users\Admin\AppData\Local\ADMINISTRATORSGROUPNAME.txt
          • Size 16B
          • SHA256 d672c033e3bb0dd990a45a35db00da044b09497b19d5aebaaa0065c6864d35e9
          • MD5 SHA1 SHA512
          Submit Download

          cs-installwizard.log
          • Path C:\Users\Admin\AppData\Local\Temp\cs-installwizard.log
          • Size 625B
          • SHA256 291496eb7ef1cab65e93ed2e9a1c671aec9157dcbb32c9130b3fea7329c6e6ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20261024202340.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261024202340.log
          • Size 14KB
          • SHA256 a05543369f6dc100443f8bc043d4bb9a3c460d086958d17437d89fd8ac4b9579
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_amd64_20261024202340_000_vcRuntimeMinimum_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261024202340_000_vcRuntimeMinimum_x64.log
          • Size 2KB
          • SHA256 918f4850756fab6ed154802cc0355be141ee1459bd147dc999e449c428c2a922
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_x86_20261024202346.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261024202346.log
          • Size 18KB
          • SHA256 e67a5198f9d1ece2d975c1782a1b1fbbdb077f8fc0b1fb91e636d73ca1250cc0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_x86_20261024202346_000_vcRuntimeMinimum_x86.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261024202346_000_vcRuntimeMinimum_x86.log
          • Size 2KB
          • SHA256 d3b4b9ddf87af340d8c4ca09ed0932cec4c8ab8ad454e5bab40c31e6f26b019e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_x86_20261024202352_000_vcRuntimeAdditional_x86.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261024202352_000_vcRuntimeAdditional_x86.log
          • Size 3KB
          • SHA256 d6371358af35c6bdeccdf9fe662f70315b8cf9e1c7d9c1bad2ff7f88005eab92
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          HKCU_MSCOMCTL.OCX.del.reg
          • Path C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\HKCU_MSCOMCTL.OCX.del.reg
          • Size 8KB
          • SHA256 03bd1556eda49ac7281ae4ac81ceb7307497083b8deb15bb0be2136ed5008365
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          HKCU_QProGIF.ocx.del.reg
          • Path C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\HKCU_QProGIF.ocx.del.reg
          • Size 672B
          • SHA256 31c9a1734c6e09cfa2d9816fc8f473a118860919cf60f5f8e916b9c9a06248eb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Install.bat
          • Path C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\Install.bat
          • Size 813B
          • SHA256 1c775534a3fbe5f3804d973d867a666dcae914d0a2184ac0451f42332df147ea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Install.exe
          • Path C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\Install.exe
          • Size 4.1MB
          • SHA256 ce261fd412d273d09e2a9238bda8db3f6847b6278ea38b8e7a11baf036451b6c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Install.ini
          • Path C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\Install.ini
          • Size 2KB
          • SHA256 854ac814fb90d31a427f0ea8241cdc8731080ee506d17d777117db31f884397b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSCOMCTL.OCX
          • Path C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\MSCOMCTL.OCX
          • Size 1.0MB
          • SHA256 152121a5d1ac8f12002c18afc294bb1ebcecc1d61deec6211df586c11acde9b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          QProGIF.ocx
          • Path C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\QProGIF.ocx
          • Size 72KB
          • SHA256 cfb2eb4cd8388d68e7aeea71bfc20db5d1387716fced45d3f47042f270534ee5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\ThirdParty\Microsoft\VCRedist\vc_redist.x64.exe
          • Size 24.4MB
          • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x86.exe
          • Path C:\Users\Admin\AppData\Roaming\RevvitySignalsSoftware\Installers\ChemDraw_26.0.0\ThirdParty\Microsoft\VCRedist\vc_redist.x86.exe
          • Size 13.3MB
          • SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{146E376A-99BE-4499-8319-D12104185DE4}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{146E376A-99BE-4499-8319-D12104185DE4}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x86.exe
          • Path C:\Windows\Temp\{2818553A-1AA7-4D74-B6B0-4EDAE05DA643}\.cr\vc_redist.x86.exe
          • Size 669KB
          • SHA256 4a6e1044ff0f49d2e3b12f7c40352c7e573e0c58f3b3cc0b55b63c95ede87828
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BootstrapperApplicationData.xml
          • Path C:\Windows\Temp\{4204212B-DD8D-4FF9-919C-4F862326C086}\.ba\BootstrapperApplicationData.xml
          • Size 14KB
          • SHA256 8c81100f594e3d0bc51e5571e0046f016086207c1c382d45708c30e1d732b648
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Windows\Temp\{744B1766-B572-4A15-983E-6B95E36C0A34}\.cr\vc_redist.x64.exe
          • Size 670KB
          • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{8C54E7F6-0810-4784-915D-AAC84634AD0C}\.ba\license.rtf
          • Size 9KB
          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{8C54E7F6-0810-4784-915D-AAC84634AD0C}\.ba\thm.wxl
          • Size 2KB
          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\Temp\{8C54E7F6-0810-4784-915D-AAC84634AD0C}\.ba\thm.xml
          • Size 8KB
          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Path C:\Windows\Temp\{8C54E7F6-0810-4784-915D-AAC84634AD0C}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Size 5.4MB
          • SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab5046A8AB272BF37297BB7928664C9503
          • Path C:\Windows\Temp\{8C54E7F6-0810-4784-915D-AAC84634AD0C}\cab5046A8AB272BF37297BB7928664C9503
          • Size 964KB
          • SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x64
          • Path C:\Windows\Temp\{8C54E7F6-0810-4784-915D-AAC84634AD0C}\vcRuntimeAdditional_x64
          • Size 208KB
          • SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x64
          • Path C:\Windows\Temp\{8C54E7F6-0810-4784-915D-AAC84634AD0C}\vcRuntimeMinimum_x64
          • Size 208KB
          • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1028\license.rtf
          • Size 17KB
          • SHA256 44c76290f7a2e45940e8338912feb49bcf4e071cfa85d2d34762857743acbc8d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1028\thm.wxl
          • Size 2KB
          • SHA256 8e2e660dfb66cb453e17f1b6991799678b1c8b350a55f9ebe2ba0028018a15ad
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1029\license.rtf
          • Size 12KB
          • SHA256 503c433dcde2f3a9e7d388a5ff2b0612e7d8f90f5188d5b2b60228db33044fde
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1029\thm.wxl
          • Size 3KB
          • SHA256 07fb3ec174f25dfbe532d9d739234d9dfda8e9d34f01fe660c5b4d56989fa779
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1031\license.rtf
          • Size 12KB
          • SHA256 28f63bad9c2960395106011761993049546607f8a850d344d6a54042176bf03f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1031\thm.wxl
          • Size 3KB
          • SHA256 8e0dca6e085744bfcbff46f7dcbcfa6fbd722dfa52013ee8ceeaf682d7509581
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1036\license.rtf
          • Size 12KB
          • SHA256 5c13a65870d770d1642a4259eecb436257ca39016a0500f747be9c79be0c7009
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1036\thm.wxl
          • Size 3KB
          • SHA256 704ddf2e60c1f292be95c7c79ee48fe8ba8534ceb7ccf9a9ea68b1ad788ae9d4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1040\license.rtf
          • Size 11KB
          • SHA256 70ecf23c03b66a2b18e173332586afa8f00f91e02a80628f4f9cb2521e27f6ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1040\thm.wxl
          • Size 3KB
          • SHA256 0c57f40cc2091554307aa8a7c35dd38e4596e9513e9efae00ac30498ef4e9bc2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1041\license.rtf
          • Size 29KB
          • SHA256 c3061a334bfd5f02b7085f8f454d5d3d97d477af14bab497bf31a7887bc90c5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1041\thm.wxl
          • Size 3KB
          • SHA256 6b9bbf90d75cfa7d943f036c01602945fe2fa786c6173e22acb7afe18375c7ea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1042\license.rtf
          • Size 27KB
          • SHA256 3d4e9c165cbeab829d608106f0e96450f839ffa8adbd755f0b51867e89da2ae0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1042\thm.wxl
          • Size 3KB
          • SHA256 ad7608b87a7135f408abf54a897a0f0920080f76013314b00d301d6264ae90b2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1045\license.rtf
          • Size 13KB
          • SHA256 6f94a99072061012c5626a6dd069809ec841d6e3102b48394d522a0c2e3aa2b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1045\thm.wxl
          • Size 3KB
          • SHA256 440b309fcdf61ffc03b269fe3815c60cb52c6ae3fc6acad14eac04d057b6d6ea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1046\license.rtf
          • Size 10KB
          • SHA256 27891eec899be859e3b4d3b29247fc6b535d7e836def0329111c48741ec6e701
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1046\thm.wxl
          • Size 3KB
          • SHA256 f52b54a0e0d0e8f12cba9823d88e9fd6822b669074dd1dc69dad6553f7cb8913
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1049\license.rtf
          • Size 31KB
          • SHA256 1bb3fb55b8a13fa3bafffe72f5b1ed8b57a63bd4d8654bb6dc5b9011ce803b44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1049\thm.wxl
          • Size 4KB
          • SHA256 7333bc8e52548821d82b53dbd7d7c4aa1703c85155480cb83cefd78380c95661
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1055\license.rtf
          • Size 13KB
          • SHA256 f80926604e503697247353f56856b31de0b3fc1319f1c94068363952549cc9b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\1055\thm.wxl
          • Size 3KB
          • SHA256 e5abe3cb3bf84207dac4e6f5bba1e693341d01aea076dd2d91eaa21c6a6cb925
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\2052\license.rtf
          • Size 17KB
          • SHA256 a808b4933ce3b3e0893504dbef43ebf90b8b567f94bd6481b6315ed9141e1b11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\2052\thm.wxl
          • Size 2KB
          • SHA256 2ac8b7c19a5189662de36a0581c90dbad96df259ec00a28f609b644c3f39f9ca
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\3082\license.rtf
          • Size 10KB
          • SHA256 abc11bb2b04dff6afe2d4d4f40d95a7d62e5af352928af90daa3dade58dd59bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\3082\thm.wxl
          • Size 3KB
          • SHA256 9cbb2b312c100b309a1b1495e84e2228b937612885f7a642fbbd67969b632c3a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          BootstrapperApplicationData.xml
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\.ba\BootstrapperApplicationData.xml
          • Size 12KB
          • SHA256 ea38da67f3785623f4c70335b51a11df7bb27528170c39ad8cbc6b15a8902744
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab54A5CABBE7274D8A22EB58060AAB7623
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\cab54A5CABBE7274D8A22EB58060AAB7623
          • Size 838KB
          • SHA256 c9935322c0af2fe00ebb018f8b0b908018576048fa4d3c0376a30ebf0eb2cf50
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cabB3E1576D1FEFBB979E13B1A5379E0B16
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\cabB3E1576D1FEFBB979E13B1A5379E0B16
          • Size 4.9MB
          • SHA256 01b11076177c8a5ee37eba745142cd6bbc4ac1ebfc4ebe48c85bd285a73ebf60
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x86
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\vcRuntimeAdditional_x86
          • Size 200KB
          • SHA256 3e4a528fe5263a5dc44455d0ab2717f0c02acdc120c918cf43730ce9f36ccbb5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x86
          • Path C:\Windows\Temp\{EA177D40-9967-41D5-921E-B849EB9F3FC7}\vcRuntimeMinimum_x86
          • Size 200KB
          • SHA256 c5ff4d6cd4be9f4965f93af273dd364948fbe44d40b123f34f82bcbcf64c8df4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1580-697-0x0000000000170000-0x00000000001E9000-memory.dmp
          Download

          memory/1764-690-0x00000000002B0000-0x0000000000327000-memory.dmp
          Download

          memory/2152-694-0x00000000002B0000-0x0000000000327000-memory.dmp
          Download

          memory/2812-695-0x00000000002B0000-0x0000000000327000-memory.dmp
          Download

          memory/3364-693-0x00000000002B0000-0x0000000000327000-memory.dmp
          Download

          memory/3416-705-0x0000000000DE0000-0x0000000000E59000-memory.dmp
          Download

          memory/3504-698-0x0000000000170000-0x00000000001E9000-memory.dmp
          Download

          memory/3852-706-0x0000000000DE0000-0x0000000000E59000-memory.dmp
          Download

          memory/4180-704-0x0000000000DE0000-0x0000000000E59000-memory.dmp
          Download

          memory/5768-81-0x0000000073182000-0x0000000073183000-memory.dmp
          Download

          memory/5768-93-0x0000000007A00000-0x0000000007A96000-memory.dmp
          Download

          memory/5768-85-0x0000000005970000-0x0000000005992000-memory.dmp
          Download

          memory/5768-83-0x0000000073170000-0x000000007392C000-memory.dmp
          Download

          memory/5768-84-0x0000000005CD0000-0x000000000631A000-memory.dmp
          Download

          memory/5768-82-0x0000000002EE0000-0x0000000002F16000-memory.dmp
          Download

          memory/5768-92-0x0000000006400000-0x000000000644C000-memory.dmp
          Download

          memory/5768-86-0x0000000005B10000-0x0000000005B76000-memory.dmp
          Download

          memory/5768-94-0x0000000006C50000-0x0000000006C6A000-memory.dmp
          Download

          memory/5768-95-0x0000000006CB0000-0x0000000006CD2000-memory.dmp
          Download

          memory/5768-100-0x0000000073170000-0x000000007392C000-memory.dmp
          Download

          memory/5768-97-0x0000000008CA0000-0x000000000931C000-memory.dmp
          Download

          memory/5768-87-0x0000000005AA0000-0x0000000005B06000-memory.dmp
          Download

          memory/5768-90-0x0000000006460000-0x00000000067BB000-memory.dmp
          Download

          memory/5768-91-0x00000000063D0000-0x00000000063EE000-memory.dmp
          Download

          memory/5768-96-0x0000000008060000-0x000000000861A000-memory.dmp
          Download