158540a607ac3e189cbf71591d8d9e24821d1aa86d1e11da1e43f410dfc1b548

Analysis

max time kernel
105s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VisualStudioSetup.exe
Size 3.8MB
Sample240520-rrwnaaee2z
SHA256 158540a607ac3e189cbf71591d8d9e24821d1aa86d1e11da1e43f410dfc1b548
MD5 3829b1afe5db44b04238b058ad44d195
SHA1 f74fbac3404b87ba1d4f1eac77137b387b6b2c33
SHA512 d3d97bf6686846b7169bde2adb1765ba39e0cf6af3dbc36d6a9e4f91f3ae4c1282501c9eff61eb412a3c09334fa1aef4b4b6d81065dab9098378d3f5d988b38b
SSDEEP 98304:cEbi4uAD0mOjmdheae0eJnT+PfvzQU6+PnkSPy51ISpDYdqL:9uADrnhFjSw3kaK51ISNoQ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	VisualStudioSetup.exe

Executes dropped EXE 1 IoCs

pid	Process
3236	vs_setup_bootstrapper.exe

Loads dropped DLL 21 IoCs

pid	Process
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe
3236	vs_setup_bootstrapper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3456	3236	WerFault.exe	86

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vs_setup_bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vs_setup_bootstrapper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vs_setup_bootstrapper.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	vs_setup_bootstrapper.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4380	AcroRd32.exe
4380	AcroRd32.exe
4380	AcroRd32.exe
4380	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 3236	4824	VisualStudioSetup.exe	86
PID 4824 wrote to memory of 3236	4824	VisualStudioSetup.exe	86
PID 4824 wrote to memory of 3236	4824	VisualStudioSetup.exe	86
PID 3236 wrote to memory of 4404	3236	vs_setup_bootstrapper.exe	87
PID 3236 wrote to memory of 4404	3236	vs_setup_bootstrapper.exe	87
PID 3236 wrote to memory of 4404	3236	vs_setup_bootstrapper.exe	87
PID 4380 wrote to memory of 4276	4380	AcroRd32.exe	115
PID 4380 wrote to memory of 4276	4380	AcroRd32.exe	115
PID 4380 wrote to memory of 4276	4380	AcroRd32.exe	115
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 3924	4276	RdrCEF.exe	116
PID 4276 wrote to memory of 948	4276	RdrCEF.exe	117
PID 4276 wrote to memory of 948	4276	RdrCEF.exe	117
PID 4276 wrote to memory of 948	4276	RdrCEF.exe	117
PID 4276 wrote to memory of 948	4276	RdrCEF.exe	117
PID 4276 wrote to memory of 948	4276	RdrCEF.exe	117
PID 4276 wrote to memory of 948	4276	RdrCEF.exe	117
PID 4276 wrote to memory of 948	4276	RdrCEF.exe	117
PID 4276 wrote to memory of 948	4276	RdrCEF.exe	117
PID 4276 wrote to memory of 948	4276	RdrCEF.exe	117
PID 4276 wrote to memory of 948	4276	RdrCEF.exe	117
PID 4276 wrote to memory of 948	4276	RdrCEF.exe	117
PID 4276 wrote to memory of 948	4276	RdrCEF.exe	117
PID 4276 wrote to memory of 948	4276	RdrCEF.exe	117
PID 4276 wrote to memory of 948	4276	RdrCEF.exe	117

C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe
"C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\AppData\Local\Temp"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\SysWOW64\getmac.exe
    "getmac"
    3⤵
    PID:4404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 2832
    3⤵
    - Program crash
    PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3236 -ip 3236
1⤵
PID:4872

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=04BC06AF6FB5C8303F832B13CA650174 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3924
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EEB6EE9F3BB59ABDE6ECC4E3B6F7D53C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EEB6EE9F3BB59ABDE6ECC4E3B6F7D53C --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:948
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=76FC3FFBCFC16AF235FF3DA624F589A3 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4384
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3F8F41F8FE21C499FAAD348BA849127D --mojo-platform-channel-handle=1940 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2684
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3FB0C1C36B46B00D03B02E78FE744F14 --mojo-platform-channel-handle=1852 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vs_setup_bootstrapper_202405201426177674.json

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_bootstrapper\vs_setup_bootstrapper_202405201426177674.json
Size 162B
SHA256 186c4b16ee009564819730b358dbdbb0792fc27e602698c5f0a16e20104647c7
MD5 ad891c3b02a02419dc60db8c273a8315
SHA1 141a08ca0e25d56bdb35fc71e1c767667079114a
SHA512 64cdaf1d6d1b4072e24f3926f91103abf946ff044cda34a9070586c2d2927bcdfc53381c955e447a38965ee426373259759025f97b715158afc429080956196f
MD5 SHA1 SHA512

Submit Download

Microsoft.C2RSignatureReader.Interop.dll

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Interop.dll
Size 19KB
SHA256 93a4a722c19f7f89ca2ce1aed73eee941c24c6e396585be8b2073b9b2ef235c7
MD5 c6cf9fd202cb1229cbe7b9efbc9f4317
SHA1 d5c9c33a16c759c0bcf685cc8eae05104b50696a
SHA512 6e303a5e9975daeb7161dd1958ac0784b416fe1d65dc862da99eeecb59d12d7d43165865a2737d5ebbb9727439665b743b69952265e2721f4f01a00487555518
SSDEEP 384:gQ4E2jccYKPZiWNlsQNVXC4deR9zVj3h:gQYj4ue6VXC4dC9zVj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.C2RSignatureReader.Native.dll

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Native.dll
Size 114KB
SHA256 848ef52200b9bdd9807b20e1e0c834c3bbb09c723bcc59875658ee3f29781601
MD5 5a0e5cbb68292104ed91f53275432781
SHA1 90bd370a5867ca889d47ba5c928ea06910160af7
SHA512 0698f928fa2de8c48f04579c6904981e288552ee651b9d4a65b355c4698eae6f275625d5ef3c053de39c45d732d5f0514e062d762784a5630453e0e5f40b200e
SSDEEP 3072:OZVQojfmVq0UiGkGfFordfsbj3Bfmj4EtV5JO:Y3IqtkOod6xfehtA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.RemoteControl.dll

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\Microsoft.VisualStudio.RemoteControl.dll
Size 46KB
SHA256 cc52e19735d6152702672feb5911c8ba77f60fdc73df5ed0d601b37415f3a7ed
MD5 355c1a112bc0f859b374a4b1c811c1e7
SHA1 b9a58bb26f334d517ab777b6226fef86a67eb4dd
SHA512 f1e858f97dabeb8e9648d1eb753d6fcd9e2bab378259c02b3e031652e87c29fbabfc48d209983f7074dfc256afd42fa1d8184805534037771a71db517fe16c8b
SSDEEP 768:E3DOuy2r9MhdS0+Mg/n+FbK/lCxkQZ2XJP8MbLVSav7C9zAH:ETOK9MhdStMYn4dtcXJPzbLVSaDez0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Setup.Common.dll

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Common.dll
Size 578KB
SHA256 f160aa395cd03a77c88e9ed476d2cd308528ef28ede7d3cd51d799192b66788a
MD5 1d8d070d47510b7ad2d649edb415a90d
SHA1 464e282bf196219d39c24c5610cf76efc0b9772c
SHA512 91ebe5e9ded214695f9c2df08e2f8c2accf2ec17f8679cdd9425b37f60f9758da6de7f474ab14343f3edf5abab0ebbe639ee878417947b89dfaa1361d517ebe1
SSDEEP 12288:zOZjJ1EnfsSJbzpOcdQh/YQroaW6IrvQkSeFaAZG:M4RJnpTQh/3oaW6kvQkfa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Setup.Download.dll

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Download.dll
Size 305KB
SHA256 e79603b7f9ada27335deca10edf748f4cb1bf700cf866f585d0eb0a88bd7758e
MD5 b23e7cc9034c5063c4374c76015c4f6a
SHA1 74c39d36d37f8fb1fec14462ac5a7e1eb3182e76
SHA512 be5d084aa6c5b1dbbf5b2b8d2a3ef99962dcbdaefc76eca6d411b9e929ee25c5032edcda565f4b0ecc1aabda3335a3eac736e96750d8d54e4f9e9793ed3f2902
SSDEEP 3072:TB3z5HB2WY5iM3RD3Hl8t8rJisEAH7Bt/9f/R2KwfxECw9BLdePKtr2g8kpM4ayA:TBj5JMhD18t8tiOHXIw9BTtkkpPrE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Setup.dll

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.dll
Size 1.4MB
SHA256 aea445890e328c45ad594e98043808722fea6017dc8b0fa54b85f43732eed389
MD5 f203011840317dca75b5958b4ef1383c
SHA1 f975958ff6329fbac84d6f7bb263a287d8fa5c38
SHA512 119d39ebc7a19ace9881754af73f834fd6fd27230b8e8b544aeea10e471d3fc8b33d1e25a70d30f514eae3fafed9da7a5ec6a7650a5b842a6668ea97c279d884
SSDEEP 12288:pm88J/rL6lR+3nxTOxZP/VsgzbLbBgM4DJHNhdVapE9+4/0OdbK5z/sJiamrGmHz:+3xTmsg/GHtxY2TK5AJiamCu1r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Telemetry.dll

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\Microsoft.VisualStudio.Telemetry.dll
Size 995KB
SHA256 8fe17ff9da7932dc01a39ed27559d5cdfa9b97ba14cbaa9f719087a241c8b82d
MD5 bbcc8244db84ad2031ac010633abf798
SHA1 de0cb65ee877663da272b4162a55a64ab8669f74
SHA512 d5682ea1aa9d50e9a491f8dc25c82907cde24ead2842ea392242e8cdedf49f68f3035042442738e147b5aa29d6328ced68007732298f62466c78fd10b276b06f
SSDEEP 12288:MmebRarx1J3m4YV5s4vsoeegJCXyjuj5NBZ2taqFc5bYt6:Mme1LO4NeIgCE1c5ks
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Utilities.Internal.dll

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\Microsoft.VisualStudio.Utilities.Internal.dll
Size 62KB
SHA256 b044863f98af8d28f4f2f5e2dccb945c57439e1575afb37110e1eec306a6c89c
MD5 2dc1dc66b267a3470add7fab88b78069
SHA1 dbe80047475b503791038ed7e47389c062c15c72
SHA512 44ef73aab50dcc13ccd94c0353c366818afb27ce73772d722755b04add0c4f294c7814c84da6069d9aa6136f2a48683c25062dcddd1664e8d32fed1b38ceca21
SSDEEP 768:EmcpOXklyzcrDEGnyeY/i6M/UuHls6/yPm+Bk0BEwwjPoG3c4M9zmoABzEXDi9zo:klrrD2eY/TM/XDb0BVw0G3VM96BzS+zo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\System.Memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\System.Runtime.CompilerServices.Unsafe.dll
Size 17KB
SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
MD5 c610e828b54001574d86dd2ed730e392
SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
MD5 SHA1 SHA512 SSDEEP

Submit Download

detection.json

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\detection.json
Size 8KB
SHA256 c828a2e5b4045ce36ecf5b49d33d6404c9d6f865df9b3c9623787c2332df07d9
MD5 782f4beae90d11351db508f38271eb26
SHA1 f1e92aea9e2cd005c2fb6d4face0258d4f1d8b6c
SHA512 0a02beeca5c4e64044692b665507378e6f8b38e519a17c3ceccca1e87f85e1e2e7b3598e598fc84c962d3a5c723b28b52ee0351faaec82a846f0313f3c21e0e4
SSDEEP 192:c5RL5JW2ppB82Bp12K/1xXKuFnXquoI8qguTnoiAOXbsECQxV3mb:qqUUs6maY6L
MD5 SHA1 SHA512 SSDEEP

Submit Download

vs_setup_bootstrapper.config

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\vs_setup_bootstrapper.config
Size 619B
SHA256 e53ee13ee4ec7cfbb146aa88193d723d6c8d8cdabf8283a454ab6d24e6f78903
MD5 65396960309df10a6cfdd3a34160e4f8
SHA1 a8c7df9c86be9a90669e903baa15535dee86d053
SHA512 d7e768669ffddbaf78d0beddb10b220d554399bb5c86c009c330184c53e3768043ac6c896c6386590b5c382f5612a864752376597b2b5c752f99a4771ee04492
MD5 SHA1 SHA512

Submit Download

vs_setup_bootstrapper.exe

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
Size 403KB
SHA256 e94349f39b4b45774caf05fabcedee74ff182ad6f77f143eb661580824155a42
MD5 3257dc82fdc8136629ac4a4333193391
SHA1 9f1aa607c0d8508cb50f3f0ddc1b844bf570f2c2
SHA512 3189c7eba1db26a37f64b7d650b566f14b855a8a406f7d900d6f3af937e7b5d817038d23aac8ddbc9d69b939beb26e7cecf9ab8dcbf9e0edf338fe7932f1c867
SSDEEP 6144:drQvOqb9mewRrsxwwqaPUY+nYoXVheNdPafjfwlp:GvNWlsgg6nYoFhe7aTwlp
MD5 SHA1 SHA512 SSDEEP

Submit Download

vs_setup_bootstrapper.exe.config

Path C:\Users\Admin\AppData\Local\Temp\94b15c00b1d620f566f07e6ca0\vs_bootstrapper_d15\vs_setup_bootstrapper.exe.config
Size 2KB
SHA256 1e0f19e5f792fc97e1ab40d6a8259f19843c8a22c1ccc008effc3a771cae9b66
MD5 d705d5ccc158f125dfbf4b1f06ea8966
SHA1 76486d41cb0a0316ee354cbfb59f697a43ab1489
SHA512 c3b2ac8d186990c3c7d6755a641cf3bf0256e8ea3789942374c56fdd97de6a7fae516ee944880bc3ed31b0e569192d570db899847b9a8fadfe46d4ed150b480f
MD5 SHA1 SHA512

Submit Download

memory/3236-166-0x0000000072F80000-0x0000000073730000-memory.dmp

Download

memory/3236-136-0x0000000005180000-0x00000000051D0000-memory.dmp

Download

memory/3236-132-0x0000000005040000-0x0000000005048000-memory.dmp

Download

memory/3236-120-0x0000000004C30000-0x0000000004D92000-memory.dmp

Download

memory/3236-164-0x0000000005BF0000-0x0000000005C12000-memory.dmp

Download

memory/3236-148-0x0000000005670000-0x0000000005696000-memory.dmp

Download

memory/3236-116-0x0000000000190000-0x00000000001F8000-memory.dmp

Download

memory/3236-144-0x0000000005620000-0x0000000005632000-memory.dmp

Download

memory/3236-114-0x0000000072F8E000-0x0000000072F8F000-memory.dmp

Download

memory/3236-140-0x00000000056C0000-0x0000000005772000-memory.dmp

Download

memory/3236-152-0x0000000005610000-0x0000000005618000-memory.dmp

Download

memory/3236-165-0x0000000005D40000-0x0000000006094000-memory.dmp

Download

memory/3236-128-0x0000000005230000-0x000000000532C000-memory.dmp

Download

memory/3236-124-0x0000000005090000-0x0000000005124000-memory.dmp

Download

memory/3236-167-0x0000000006E10000-0x0000000006E76000-memory.dmp

Download

memory/3236-168-0x0000000006F40000-0x0000000006FFA000-memory.dmp

Download

memory/3236-156-0x0000000005B10000-0x0000000005B20000-memory.dmp

Download

memory/3236-170-0x00000000071A0000-0x0000000007232000-memory.dmp

Download

memory/3236-171-0x00000000077F0000-0x0000000007D94000-memory.dmp

Download

memory/3236-172-0x0000000072F80000-0x0000000073730000-memory.dmp

Download

memory/3236-174-0x00000000076A0000-0x00000000076A8000-memory.dmp

Download

memory/3236-175-0x0000000072F80000-0x0000000073730000-memory.dmp

Download

memory/3236-177-0x0000000072F80000-0x0000000073730000-memory.dmp

Download

memory/3236-178-0x0000000072F80000-0x0000000073730000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads