Overview

overview

8

Static

static

3

cherax.exe

windows10-2004-x64

8

cherax.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 20:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cherax.exe
  • Size 10.1MB
  • Sample261102-zbbl6sc16w
  • SHA256 66dde64bc7373917256d969da5d784b7b81212499bbf8a04a61c2b09b4b38732
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistenceransomware

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 52 IoCs
  • Drops file in Windows directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\cherax.exe
    "C:\Users\Admin\AppData\Local\Temp\cherax.exe"
    1⤵
    • Downloads MZ/PE file
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3348
    • C:\Users\Admin\Documents\Cherax\Cache\Downloads\vc_redist.x64.exe
      "C:\Users\Admin\Documents\Cherax\Cache\Downloads\vc_redist.x64.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1576
      • C:\Windows\Temp\{C920AD17-8823-4774-85B5-37E4461D3B83}\.cr\vc_redist.x64.exe
        "C:\Windows\Temp\{C920AD17-8823-4774-85B5-37E4461D3B83}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Documents\Cherax\Cache\Downloads\vc_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:512
        • C:\Windows\Temp\{BE3922D1-33C7-4926-99FB-27962344825D}\.be\VC_redist.x64.exe
          "C:\Windows\Temp\{BE3922D1-33C7-4926-99FB-27962344825D}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5BBA1E2C-B625-4832-830A-C0ABADB7E97B} {542F8DE2-8EC3-4ACE-AF3F-30F6FB0D1AD7} 512
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3532
          • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1040 -burn.embedded BurnPipe.{005C9671-CD4B-4745-BC68-81797D733DBE} {248AEDFF-6577-45F5-A418-B2D395EF05CD} 3532
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2164
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1040 -burn.embedded BurnPipe.{005C9671-CD4B-4745-BC68-81797D733DBE} {248AEDFF-6577-45F5-A418-B2D395EF05CD} 3532
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3776
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A9B5E5D0-6D72-409D-910C-9F20402AFC4A} {FADE43D9-BA60-49E5-A4EB-D35053A64FE2} 3776
                7⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:3076
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:1968
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:1908
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5076
    • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5004
      • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102203225.log"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:964
        • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102203225.log"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3404
          • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{03561C4E-9978-4EAB-9660-E5A066E17854} {50521992-1964-4D03-B596-20FAE0154E16} 3404
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:1500

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e590ee0.rbs
          • Path C:\Config.Msi\e590ee0.rbs
          • Size 19KB
          • SHA256 6c8bdd549edc00240127c9f9d34b7b83ab5eecceb245c7767ea088c2efd2ee23
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e590eec.rbs
          • Path C:\Config.Msi\e590eec.rbs
          • Size 19KB
          • SHA256 b9d66052169a37c5e0be8efdd784a39b75798b42288bc8debae5c74ad9d438c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e590ef3.rbs
          • Path C:\Config.Msi\e590ef3.rbs
          • Size 21KB
          • SHA256 6ab599cf37c6035fd89e49be94094336bfc61c8267fbc2d135c2d31d54679f36
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e590f02.rbs
          • Path C:\Config.Msi\e590f02.rbs
          • Size 21KB
          • SHA256 b0f30472ca41b54da46524f76c4a14ebb8ba76eac0ec1938b3ff02ad95d80bf4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e590f06.rbs
          • Path C:\Config.Msi\e590f06.rbs
          • Size 15KB
          • SHA256 d3297092d20d93d814777cc9a868bfdb1310160bcdd108d77193b4029cedf7aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e590f15.rbs
          • Path C:\Config.Msi\e590f15.rbs
          • Size 16KB
          • SHA256 5c81b0c2d20eb95b2228fdff91f393e3c4dafc326adb747242891a0c65dc168f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
          • Size 988B
          • SHA256 649747366bbc57968257d7b0ef0c1cbe3fc83583b959b1a033a5c48e2530ac8e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI96690.LOG
          • Path C:\Users\Admin\AppData\Local\Temp\MSI96690.LOG
          • Size 2KB
          • SHA256 a006f406be923689c3a3d31c389fa84035c91281994b13e92f3a3d8dbc4ff576
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI96691.LOG
          • Path C:\Users\Admin\AppData\Local\Temp\MSI96691.LOG
          • Size 2KB
          • SHA256 b19d22716b6f23ff9a783ccc7915326682fb24be99fd094de5b1621ea33d8d38
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20261102203225_000_vcRuntimeMinimum_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102203225_000_vcRuntimeMinimum_x64.log
          • Size 4KB
          • SHA256 e2d3600afb492bdb01f9d53639a73a08170490b67a046b27ed1ce44560fccbd7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_amd64_20261102203225_001_vcRuntimeAdditional_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102203225_001_vcRuntimeAdditional_x64.log
          • Size 2KB
          • SHA256 03454a342949b5985dbe37985fccfae2d107f6a7c4ef7f36c4440ac97ff9b148
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Users\Admin\Documents\Cherax\Cache\Downloads\vc_redist.x64.exe
          • Size 24.4MB
          • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          concrt140.dll
          • Path C:\Windows\System32\concrt140.dll
          • Size 316KB
          • SHA256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mfc140.dll
          • Path C:\Windows\System32\mfc140.dll
          • Size 5.4MB
          • SHA256 2eba4e78edea7a9654075cf0bfcbf9ba7faa3332c40be6f96317f2b707925cc3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mfc140chs.dll
          • Path C:\Windows\System32\mfc140chs.dll
          • Size 50KB
          • SHA256 02db5a7589a6c0469dc08c6e0e33644e0e0509fb06ec64f213e00c30ac1157ee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mfc140cht.dll
          • Path C:\Windows\System32\mfc140cht.dll
          • Size 50KB
          • SHA256 85ead493fba021337d5eaa09281de09e0dc2aa630f9856a3bc7a52f0336c062a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mfc140deu.dll
          • Path C:\Windows\System32\mfc140deu.dll
          • Size 78KB
          • SHA256 9e7b3e798db10d5a4b8372bdeef7ee47cd027bcc70220d91b94297b518171ec3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mfc140enu.dll
          • Path C:\Windows\System32\mfc140enu.dll
          • Size 68KB
          • SHA256 59b7da456a5716e167da8a736151c1ae841fc9db21c606bef35666f2836b4b54
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mfc140esn.dll
          • Path C:\Windows\System32\mfc140esn.dll
          • Size 77KB
          • SHA256 3d1de91a735343b8e970dcebe233ecfe2c32b3ad62f2ec24b389c0c17a960b44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mfc140fra.dll
          • Path C:\Windows\System32\mfc140fra.dll
          • Size 78KB
          • SHA256 b49e3f79abf030d9cfe95e4302ed02e53f357dcb9083555340fdb3b40845e619
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mfc140ita.dll
          • Path C:\Windows\System32\mfc140ita.dll
          • Size 76KB
          • SHA256 b7947dba144d3188605ede7d0432ea7c7668ac8a853dd7e1c06d17dce7fe5c5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mfc140jpn.dll
          • Path C:\Windows\System32\mfc140jpn.dll
          • Size 57KB
          • SHA256 88935eeb6641e9a7981d7a74b19260f4a21f05b99ea9756b65d4e3ad0b0fc93b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mfc140kor.dll
          • Path C:\Windows\System32\mfc140kor.dll
          • Size 57KB
          • SHA256 12c87451b0760104155aa7133a38ad2093c8eefc754dbd0994197b1f201bd08c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mfc140rus.dll
          • Path C:\Windows\System32\mfc140rus.dll
          • Size 74KB
          • SHA256 452d45451e712e3231a4a3222657ca612d66d59c76d467c9822aad4aa2a1d95a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mfc140u.dll
          • Path C:\Windows\System32\mfc140u.dll
          • Size 5.4MB
          • SHA256 643ce7fe6a203c53a96a00f272a1a5b42d5b0c320c84364a6fe866307a19bb65
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mfcm140.dll
          • Path C:\Windows\System32\mfcm140.dll
          • Size 94KB
          • SHA256 075f599425f6d3bda354a9560fc3f7111fb80f642ab6e55e2b2971bcd69494ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mfcm140u.dll
          • Path C:\Windows\System32\mfcm140u.dll
          • Size 94KB
          • SHA256 21ac15f807ae8bc7c178039e7d9d29e53003b16f152d9102c629af95cba2f433
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140.dll
          • Path C:\Windows\System32\msvcp140.dll
          • Size 544KB
          • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140_1.dll
          • Path C:\Windows\System32\msvcp140_1.dll
          • Size 35KB
          • SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140_2.dll
          • Path C:\Windows\System32\msvcp140_2.dll
          • Size 273KB
          • SHA256 3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140_atomic_wait.dll
          • Path C:\Windows\System32\msvcp140_atomic_wait.dll
          • Size 49KB
          • SHA256 640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140_codecvt_ids.dll
          • Path C:\Windows\System32\msvcp140_codecvt_ids.dll
          • Size 31KB
          • SHA256 f2069a52880ec885ee7f0511186100eb7fada0411a2b4948fafea7735b878a18
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcamp140.dll
          • Path C:\Windows\System32\vcamp140.dll
          • Size 409KB
          • SHA256 52af68f35476bd03d7b97752b01bef358ffdda568d150057d6ce809f77c4f704
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vccorlib140.dll
          • Path C:\Windows\System32\vccorlib140.dll
          • Size 344KB
          • SHA256 19839407c3fdbc824e5bce189bf68ddf8097f12ec28b757797ffa0415c144ddd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcomp140.dll
          • Path C:\Windows\System32\vcomp140.dll
          • Size 188KB
          • SHA256 55aba23cdcd6484fbb06f4155b8ca75adfce7a881f10afd0c49457165e677164
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140.dll
          • Path C:\Windows\System32\vcruntime140.dll
          • Size 121KB
          • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140_1.dll
          • Path C:\Windows\System32\vcruntime140_1.dll
          • Size 48KB
          • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140_threads.dll
          • Path C:\Windows\System32\vcruntime140_threads.dll
          • Size 37KB
          • SHA256 219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BootstrapperApplicationData.xml
          • Path C:\Windows\Temp\{44EF5359-7965-4CD8-A4E7-303E42D487C2}\.ba\BootstrapperApplicationData.xml
          • Size 14KB
          • SHA256 8c81100f594e3d0bc51e5571e0046f016086207c1c382d45708c30e1d732b648
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{B66EB40C-A242-42B0-9DDB-176C4A2FF187}\.ba\license.rtf
          • Size 9KB
          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{B66EB40C-A242-42B0-9DDB-176C4A2FF187}\.ba\thm.wxl
          • Size 2KB
          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\Temp\{B66EB40C-A242-42B0-9DDB-176C4A2FF187}\.ba\thm.xml
          • Size 8KB
          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{B66EB40C-A242-42B0-9DDB-176C4A2FF187}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{BE3922D1-33C7-4926-99FB-27962344825D}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{BE3922D1-33C7-4926-99FB-27962344825D}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Path C:\Windows\Temp\{BE3922D1-33C7-4926-99FB-27962344825D}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Size 5.4MB
          • SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab5046A8AB272BF37297BB7928664C9503
          • Path C:\Windows\Temp\{BE3922D1-33C7-4926-99FB-27962344825D}\cab5046A8AB272BF37297BB7928664C9503
          • Size 964KB
          • SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x64
          • Path C:\Windows\Temp\{BE3922D1-33C7-4926-99FB-27962344825D}\vcRuntimeAdditional_x64
          • Size 208KB
          • SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x64
          • Path C:\Windows\Temp\{BE3922D1-33C7-4926-99FB-27962344825D}\vcRuntimeMinimum_x64
          • Size 208KB
          • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Windows\Temp\{C920AD17-8823-4774-85B5-37E4461D3B83}\.cr\vc_redist.x64.exe
          • Size 670KB
          • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2164-265-0x0000000000F20000-0x0000000000F97000-memory.dmp
          Download

          memory/3076-262-0x0000000000F20000-0x0000000000F97000-memory.dmp
          Download

          memory/3348-0-0x00007FF7B8550000-0x00007FF7B8F74000-memory.dmp
          Download

          memory/3348-6-0x00007FF7B8550000-0x00007FF7B8F74000-memory.dmp
          Download

          memory/3776-264-0x0000000000F20000-0x0000000000F97000-memory.dmp
          Download