c19c9de127e9a64ba9a6ba566d20c1e8aab2a17a95d6e4d9d6fd1f780ea08927

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SQLTest_4.4.5.5330.exe
Size 9.8MB
Sample260415-pjdrdsgv2x
SHA256 c19c9de127e9a64ba9a6ba566d20c1e8aab2a17a95d6e4d9d6fd1f780ea08927
MD5 31f9e908b787f6115a1c80fd5f496890
SHA1 16467143c3ba2153b761dca394fcc5a1518e4274
SHA512 9329ce2e1de90faf6a3db592f1ceda52c236d46b9280a64319050c29c6db5580600a932a93860d11208fdca438d02097232cf6dcc9164e5d6ee8a780c0ccdc53
SSDEEP 196608:IuGm1ulUnTHWHNBlJjFBUMaZ5Cha1P8aoBfz+/vYlaUB0W:lnuldyGLtBfK/vYgG
TLSH
T10EA6D00133A44426C76F4F3CB42CA6246678BD554BB5E7CB26C4BD9E3DB33424A60BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\W:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\O:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\S:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\V:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\I:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\R:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\E:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\Q:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\Y:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\K:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\M:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\Z:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\T:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\U:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	RedGate.Installer.UI.App.exe
File opened (read-only)	\??\L:	RedGate.Installer.UI.App.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
1764	RedGate.Installer.UI.App.exe

Loads dropped DLL 42 IoCs

pid	Process
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
4936	MsiExec.exe
4936	MsiExec.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe
1764	RedGate.Installer.UI.App.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SQLTest_4.4.5.5330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedGate.Installer.UI.App.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	SQLTest_4.4.5.5330.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	SQLTest_4.4.5.5330.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	SQLTest_4.4.5.5330.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	SQLTest_4.4.5.5330.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	SQLTest_4.4.5.5330.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeSecurityPrivilege	5180	msiexec.exe
Token: SeCreateTokenPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeAssignPrimaryTokenPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeLockMemoryPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeIncreaseQuotaPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeMachineAccountPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeTcbPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeSecurityPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeTakeOwnershipPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeLoadDriverPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeSystemProfilePrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeSystemtimePrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeProfSingleProcessPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeIncBasePriorityPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeCreatePagefilePrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeCreatePermanentPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeBackupPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeRestorePrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeShutdownPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeDebugPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeAuditPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeSystemEnvironmentPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeChangeNotifyPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeRemoteShutdownPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeUndockPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeSyncAgentPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeEnableDelegationPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeManageVolumePrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeImpersonatePrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeCreateGlobalPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeCreateTokenPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeAssignPrimaryTokenPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeLockMemoryPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeIncreaseQuotaPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeMachineAccountPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeTcbPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeSecurityPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeTakeOwnershipPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeLoadDriverPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeSystemProfilePrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeSystemtimePrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeProfSingleProcessPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeIncBasePriorityPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeCreatePagefilePrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeCreatePermanentPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeBackupPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeRestorePrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeShutdownPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeDebugPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeAuditPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeSystemEnvironmentPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeChangeNotifyPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeRemoteShutdownPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeUndockPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeSyncAgentPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeEnableDelegationPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeManageVolumePrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeImpersonatePrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeCreateGlobalPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeCreateTokenPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeAssignPrimaryTokenPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeLockMemoryPrivilege	1764	RedGate.Installer.UI.App.exe
Token: SeIncreaseQuotaPrivilege	1764	RedGate.Installer.UI.App.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4604	SQLTest_4.4.5.5330.exe
4604	SQLTest_4.4.5.5330.exe
4604	SQLTest_4.4.5.5330.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 1764	4604	SQLTest_4.4.5.5330.exe	84
PID 5180 wrote to memory of 4936	5180	msiexec.exe	88

C:\Users\Admin\AppData\Local\Temp\SQLTest_4.4.5.5330.exe
"C:\Users\Admin\AppData\Local\Temp\SQLTest_4.4.5.5330.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Installer.UI.App.exe
  "C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Installer.UI.App.exe"
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1764

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 34F31E7FE4358F7F7CB5F77A74136CF6 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 22b5c71d4ac096b3b3edf207fe90e8a042d3c55813b954a3cb8acce1d4420b9c
MD5 32b69624683655f18caa530ea7443337
SHA1 5511ef7c79299bfcf0b23d8f94876505c1812ac0
SHA512 c23512421aaf165a5ff56b02045f30d2721b4155a99cb23a4fed3ac8c13c55326e0c084e342faf28233a9f16febeff9910258cdca6cd992cbc74d004f6efdcff
TLSH
T152F0D47350FE3466120754941EF90F343AB405CBA0D2C06E3C351FEDC18D692610F404
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 2107c3f0fa7dbb9d296ad9aa90ee518d1bc9074075f9885e7cb074beb3cb00db
MD5 d0dc3f75a6e26575050c964e8d2069f1
SHA1 c5ec772d214d7682324d5f83be86a1e7f73082dc
SHA512 ab7ddc7ff85d7a3c02487cf5c77781ce55b842ca15c536a1462c4d032c4ca3e674c66dcd2d080767547a5460af41ed49362867a7bee7edeafcd1488466fe25ea
TLSH
T195E0203027FF502EF170A77413D5D0DA9F26F1122C6556BE04D1182D6D169404C72D30
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 ed42cf67194b9846c90a2543d5af10727be41c5c58a55abc98d85ce28c910ce1
MD5 b45b9dd0e18a1a0b70fddc028794ad11
SHA1 6c5fbb44bbb30673e5ef1b9342d9aaaa6e85646b
SHA512 5fad47fdad9d6aa3bb937fbed54907e46ed2e386f30afaa0bb69bb269c04c7a51f187698e1bb8ba710ae3f1181ea4fc84e1058bad409381ecaae1908437ae3f6
TLSH
T11DE0682816ABA40EF060A93181FEB0720D99E301108082791494430CBB52F005D50AB0
MD5 SHA1 SHA512 TLSH

Submit Download

Autofac.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\Autofac.dll
Size 186KB
SHA256 8aaec6c836bfe934799e1f28588e6426be5d5158ebcfd4b9e0a17b5293764f46
MD5 67e05ae28d1017fba80c237ce715bd3a
SHA1 0ef18aee4fd25144e8b754d2e907d81a8269061e
SHA512 eb4acd675a998ad6df5469f880ab222dffb0cee526f43ee7851d45e6c6cbacb01f83e822d651110a7bccf944e1a5883a846adff21e6659d28b8effdff844292a
SSDEEP 3072:Ug5OK8PAVhSWTiIg/PHqD6Ug7Hiz44Wrbge7ILsf4qzTZ78srAnqdzYR4:UvehS5cWrVaYvp8srAqdzY
TLSH
T10514290523E9026BD7EB4FBFA43040114B76FD07A81ADB0E2A8D54FB1967F5099A1F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INTERNAL_sql test_4.4.5.5330_x86.msi

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\INTERNAL_sql test_4.4.5.5330_x86.msi
Size 180KB
SHA256 30060d1a1ab30521923ff3031ff4d850dafa6ca8db54749d8578dd4a19df57b4
MD5 9469c929b6c2a4b9bfc577dc2861930f
SHA1 53b1e2794d0ec2e98ab7e26812a167a54dcf2ee3
SHA512 da76097365722ac12906c94f5022b9fa35862cc09ed27f504f095200a6683d7ea745f64079901c27bc849aae0e692a09e064e9b616801026fc335218e80a679f
SSDEEP 3072:Zyp2aODHJzEaPeEo1fHpcnYFRZ0rA30+Hin0F1wrDmp:ZZneELnYlK03wQ
TLSH
T165047D127480C471D4BF2A3918B4D6651B7EBD30DF7199CB6398762E5FB02C16F38AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\Newtonsoft.Json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProjectItems.xml

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\ProjectItems.xml
Size 283B
SHA256 efe7802960e5c5ff1538c3f87be94af964be7f062e70fb26db811499f99763d0
MD5 23bbb28f6c30721310403e5ae866aee1
SHA1 ab375cf5d1710ea7c73ea6ff62346e3049dc8304
SHA512 acdec7a30a3591cecc656c63094388ac696e87da9b3e7df48ce2cc4c4526ff302eca692d12beed0dcbcaaaae93c0d70415a59f29baa2841f7b3e0a29414609d3
TLSH
T156D02B8CD3D8D2105B3D9820FAF8CC497212C08895C67EE5F4EC459B13150C3A27344B
MD5 SHA1 SHA512 TLSH

Submit Download

RedGate.CompressEngine.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.CompressEngine.dll
Size 42KB
SHA256 4985b9ea69e0ba4b7ed048973c5ce10129caf502ee27b074e5a0a8d68da2237b
MD5 e044372122f1b105ac48939dba2d34e3
SHA1 86ac61c7ae40f8b6b811e21530393c8a83db68bf
SHA512 d33e343401ccae5d38da612b219d1efba4b6ff306f04a5617ef3a226f926d2f08b07e9ef1f80e6d2a24be9c93200e3ecfabb4886ab23ff1c0566c7349b6a0fe3
SSDEEP 768:camIudzPr5GaPnpAJt0SJC9ZCDa1/u5Yi6impb5ALv:cBNBOHrC2D+/E7ic
TLSH
T189136C2907EC8517C6AF1BB4B9B0C12A4BF1F21B6521E78E4F89F0D61B137811A543E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.Honeycomb.Wpf.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Honeycomb.Wpf.dll
Size 176KB
SHA256 5b240ef83fa1b00bec83f7bd2fa376f113a4159eeee1a13f3d55091a20dba920
MD5 5b1350b85460db8893027508ca1fdb91
SHA1 41752614a6eeb34b8c894070cfee31b3c0368c52
SHA512 9c91e6dae9c74c8a042b21c2fce84249a982b55e72cf1dd5da072d2fc2109021a873d0b723ebf3202ddca58c4412a305f8d752f35fe8e67e4ab85603a43feffa
SSDEEP 3072:5DQSPIW/U5nvY00UzMmyl9SGkfb2GETodGRK:T9/U5nvYpUzlyl9eIT+
TLSH
T13E046D0013344875CE67667114B59B4CF63174DB6B82CF9B3ACE698CACA7687052E3BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.Installer.Adapter.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Installer.Adapter.dll
Size 66KB
SHA256 20496f77ae854d04128c8d6a2801eba8cf55c5f5d15005f459b872030fae9e75
MD5 d48ad9a35ae1dc0e658acaa25bf5b7ea
SHA1 9c9bc38fdc0a9e278267e9f4ef3e25303927d207
SHA512 1272feab039200ef903e53eabdb99ba266901b4e18ade7cddfa36376fcee965bf52e6b5d9ff157469a7f016508a36ec6b1bdcd643e58f9f8ce5e773d52bba919
SSDEEP 1536:N+huPAlFyTmfBiwx40Wa32lDhqEN/QF7A3hH:QhuMFVBt+5hBN/QF8RH
TLSH
T188638D4263E84A32E5EF0F7870B148354A75FA4B1863D29E1ECEA4DE0A777401D617BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.Installer.CompressionInterfaces.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Installer.CompressionInterfaces.dll
Size 16KB
SHA256 ca303a60a98cc60847ae7f4c6136f87a155452f37cf39c2f74ac2ddd4b2cecde
MD5 94489bd462c039caf04d60ed1fa1a012
SHA1 5db98ac4c519e09a925dfb803645d0cf136a0262
SHA512 a7e32f2997d7206b4665e570b455867859bad0acc190290a2d2125e9cf6738049caf0d9ce86844c82a0e7b27fa651e25871c8bf866b0fc5db2925fa6c4bec0eb
SSDEEP 192:x8LpzaDmDbnPIIYiYF8Wa/Oq8Oa194G7LhRULc8pq8RuwdmL4pUQrNycVz4:+pzUmHQIYiXozTVKy8RbmL4nNyc14
TLSH
T161726D638AE01C01DC239E70BCE1963A6EB1BA519DE1C6DB314DC0694BE13456AFD3BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.Installer.Compressors.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Installer.Compressors.dll
Size 54KB
SHA256 77cff41f805abe138364a2aaad485294be3298cfbe7186c75c89d7474a86cb7f
MD5 ae8932966b6a9071c011f4d35015d11b
SHA1 fb9a583aa8adac28ecda631f409aef667ab51389
SHA512 ba5fd63e03f204208066ca8312d049c56d87ea80b0db3052411bff5a24fb267ab7ca779e8c3462875788526279ae345eaf50e18e727a7eafbc3a0e3604d402a4
SSDEEP 768:I9roFKUuxqrl2tWwbUzRyAmjeD/unhXWHrDxdfdo/PCGnr5Yi6nP5AL0A:Iyvfh2tWw4yzezuR9XCiV7+A
TLSH
T1A0434B098ECCDA13CF4A96FCE4D4595B47F1A1322A92E3DAB804B4613A433D5495E3BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.Installer.Logging.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Installer.Logging.dll
Size 20KB
SHA256 754b2b0b9b87dab1a3044ccf22562695974f86a31b79c36cbfbaaa758b9bb289
MD5 a4bb92082351d14ca383f2d96ac2bb63
SHA1 a3a1c3a24fccfb8fde41be4130fdf75c087d2b31
SHA512 5a3c97de845cc5d22f67fd4297dc48942fcf3b95266b02199a2408385bbc98f62ea973c10d330d7d8773a4a4f8e7ef8b71d81a9b74db846516058a5315c6de93
SSDEEP 384:oAmihjCBf0keFtiRXgoHQIYiXozbigHy8RbmL4nNyIV6:or0kXCC5Yi6bF5AL7
TLSH
T16D926B138BE08A05DD1B5B31B8E167226F71FA550DA1C6DF324C90698F963823FD92BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.Installer.LongFileName.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Installer.LongFileName.dll
Size 24KB
SHA256 5a281068b13b5aaebd9e7720be4b7a37796cc680df02521fc89c3ffc79747ff3
MD5 d6307f93d8c9637d1d2cf1b4882f4225
SHA1 6a9cbbe5cc9705835287b65ab00fa449752931e7
SHA512 a2876221c11f3d34316862eab47d156f0d614e7c9ece7bcd93d9a9737d476dfde74a41051147405ed6b8e9aaf5df3547b6ec3c9000fe01a21bef79e19c8b8e0c
SSDEEP 384:RDdtMVEdKnjuW0jgB3bOOvCegYRtpHQIYiXozJy8RbmL4nNy0dj1:R7MKUurEBtrj5Yi6J5ALk
TLSH
T106B28E928FD40C19CD6F9F3478F689275E71F29548B0CADF204D80A62B563842F963FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.Installer.Model.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Installer.Model.dll
Size 46KB
SHA256 0b6a63ab64aa5651fbece6fe0a45c98a1205d460fcbf236c4fbf457f3cb02c6e
MD5 5d9c43f7b6f2a71e98fe668c614d7478
SHA1 04ca4038375da3d8adc2751ea6d887f8f40e92f3
SHA512 24ea33bcd866de8d4af457a051bd2cff7e6522df4aa2c711c35ef871813f6978b02dacb75a3b0bcc0693c766b2ccafb6399e22fbaaac0c2972e1a56600502e10
SSDEEP 768:9udyZyn/B2S8jxRz02cpf/8JQKHoDSaI/RX4ELqt4mYVZx3pTuXF5Yi6L5ALQ:9udSy/UlxRz02cpf/8JQ0RX4EW2Zx3p5
TLSH
T184236C8147AC5737DE5B0F3EB49349010FB9E2851B12E667BFC8B49A9B1370026B167B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.Installer.ParameterParsing.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Installer.ParameterParsing.dll
Size 21KB
SHA256 7e670be8a97472c3905ffff5d9a82339e876b52cb72d4af712561782928ccb07
MD5 79a3971cb6b6ac429026c59e303783d8
SHA1 50117dda7d97d97668638c3c653c0584304ec5a6
SHA512 a9434d634cc7f2ed2c2709848d73c1dd4f6e8fe26a299aea3edb867bf80cdc9e2c9f0198b72f52815325c7cb067d24331d90b2c12a4a32dbb190002109a0f5d6
SSDEEP 384:zsmYx8L2Fanj9nHQIYiXoz0tuy8RbmL4nNyWtK:zsmY2KqJH5Yi6l5ALD
TLSH
T154A27F52CBE49914DD3B5E30B4F456365AB3BA842CB1C1DA2A0DD0CBAB317011EB93B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.Installer.ThreadHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Installer.ThreadHelper.dll
Size 17KB
SHA256 e9041524a449605668ceb4a593bd20d64f12a0d18e631f09fe1a20825a61ee9a
MD5 92566bb849499dea1fa09ce9cebd6590
SHA1 1fedb80ef321933b6946dd95071c585ef7974532
SHA512 3f0ed2bebb9b91c1191103d6f94eddf4771505f452ef1b75b9b7a008e8f6cd54e12024b1933ea310f28983d69abf1be499fe92b0fab0982cecf43af7a4850d0b
SSDEEP 384:FrWuTms4VinHQIYiXozcRYSy8RbmL4nNyp3K:hes4oH5Yi6u5ALW
TLSH
T148826DB38BD41C01DC279F30B8E58535AEB1BA905EE2C6DA3149C05A9F553062BBD3BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.Installer.UI.App.exe

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Installer.UI.App.exe
Size 152KB
SHA256 926238ba07a7dc55d9c398a1f8bfde64ef787e628b92082e8d040159bc80fedc
MD5 cbf01c38d0f937340be0b59972ea1f06
SHA1 5c9aabaa650d8de3ffebf183be12d187f7b49d29
SHA512 98438e504ae7dad990594692b131dd5d6f3818938509d74e9bbd26b8c35a8bb863852dd38a5855a2bb9308e0b425ab45d3e98dea66f2e145b8280c50befa683f
SSDEEP 1536:U51ih6+Qs+m0ONvSGIFytih6+Qs+m0yNYSGAS1D7G:awKsn0ONqGIFytwKsn0yN3GAS1D6
TLSH
T196E37EA2BA509819C822E73D2113AE7D27677C4AD951B94531C8FED7FBB32A335C402D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.Installer.UI.App.exe.config

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Installer.UI.App.exe.config
Size 608B
SHA256 3c54e2c6d5c866695d4865fbd8fa3ef386942d1198f061d8fe5469a8bba64a31
MD5 2c9f72cc3af3aab54cc15cbd192d1d86
SHA1 a2899f638c8f9d8eb829a8f3d56d159822e7de5c
SHA512 16a57eb49ecb15ecb5066af342fa0bf9290adb3061310239da4c21a6f3684d7942b6ac95f0d3f41cbd854ed2fcaed9ee76b1cf6ded5cb72eb68b68acf6d58e9e
TLSH
T169F0281080C8FA554F734A633A669428CF3453B32448094C74AF19579B361DA42072B7
MD5 SHA1 SHA512 TLSH

Submit Download

RedGate.Installer.UI.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Installer.UI.dll
Size 252KB
SHA256 f4c074fdd538fa8f0534edc37427b935d60ec5be063f8c9759bf48e9421e0cad
MD5 cda499c3a56418a255c2c2363e103de3
SHA1 a6d55e28b0584956b9aa0afcf2758464c01d67c4
SHA512 6a3aa4e04e6ea55874740955462ee3c52871de3a4aeda313fd3774455f3404c175a7afec762aecf7f5b8300a4741108937b54eb8a64948d3323b873bf6943adb
SSDEEP 3072:x5o22hvGPwmyPr8jDw56Yi9h6Mc1zHJSyUHQPtOWSu6eklp2:v28DCRGcVUHQPtOWSTeki
TLSH
T1CA447D0057748978D7F74B3AB53144614F3AFA4B9AA3EB5E2A8F18CD79233068212777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.InstallerEngine.Interfaces.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.InstallerEngine.Interfaces.dll
Size 20KB
SHA256 843fea41587a9243a3eb2daa4bdf0455acbaaf888c0cce9ca974e90cad16ea95
MD5 f4a2da979ff7dd6be03770559558e3df
SHA1 0f478657e95b0021ea12e811fbd17defcd3e946b
SHA512 2c1e4f5e48ccf24d00c360c0010d85d4d802cf2bf7a9f20732737d814e748d75b1ce3228bd181968a33cdd5ab13458e2eee241803198651e81932c3ce733245f
SSDEEP 384:w2RiJmon/B4PHQIYiXozNy8RbmL4nNyXL/Vl:xRilWv5Yi6N5ALt/Vl
TLSH
T112927D538AC09818DD239F39B4E146375B74BB814E92D386314E84AE4F9338537B93BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.InstallerEngine.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.InstallerEngine.dll
Size 109KB
SHA256 6088bca733b5a4ebf65fffaf800ca0c5e812665c5f44e564cce51f32e333e9dc
MD5 7aa9fa192446aca2c24b5d12876a4c11
SHA1 25e1c0230f78d1a00e194deb2549f3473e631387
SHA512 394d9485395b966727149581ef31b6fd730358323ac34e576873ab8b6a67b5abe9b97a31fd27be5f0b384e27f797bebf4c1abfa2b838686421f287595ab6e76e
SSDEEP 1536:8UpzFxWrXNGS6CjunINh8VZ34bqbBfPs0D1L9UR8tqrRK9HBDTpm7x+:Nz60S67SGZqqq2L9UR8kdKpBDFm9+
TLSH
T1B6B33A5553FC4A26F1FB3F39747018250BB2FC8AA932D74E6A89509E4AB27809D71733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.Usage.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\RedGate.Usage.Client.dll
Size 144KB
SHA256 b041e5c847b9bc2c53ec6a7588583ca4de0e431680f8f0a2da18454e4f1c6309
MD5 2ff3baa257d66565c4d7922878e36dfc
SHA1 6824a82daced370b67ba0cde557224a4a7bde867
SHA512 e7534b70e71be58427cbd796416b3b74461a0d0144879357581f816c81c86c21bc96cd242b5aa42a3063bcca9d692cd0cb8d2515e34b4348735111fe3b833960
SSDEEP 1536:72epYeUJBpdyXQwCuRaiZvsFc6jFU7XZ38NulnOerjsGhQT9Hjw610c4DORIpiT0:72eprgwCuQUvsFtSOFJ8610cmORDRwoo
TLSH
T1AEE34A1827FC0506C2FF5AB6F4B414518AB1F617B8B6D7EE898A8CFD1AD2746091133B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MahApps.Metro.dll.~1

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\SQL Test\Red Gate\Uninstaller\MahApps.Metro.dll.~1
Size 830KB
SHA256 af947674017156baee5b0fd1128650f35d4ba62e1565d87d8aefe02321f423c5
MD5 e438a28d505850f8f83e312f342d6c53
SHA1 49e9dbd98be7a7118411ed86999572e0c8ffac30
SHA512 fb50b975736d84fd002cbb4a8381bf283183d2ca42e0df73f762fafd04e52a0df87d5822f58abecd33af0874feaca91fb82f217e8af7ce89a09b5be4bbb765b2
SSDEEP 12288:8KH2auUuZnnnnnnnnnnnnnnnnnnnnnnnGnknnnnnAMcnnnnnnnnnnnnnnnnnnnnS:mUuJMSRNXZtyVHZCJ
TLSH
T189058C5033704836CAAB877D94718A846730D59A53E2DE592CCE2F9EACC67074B523FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll.~1

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\SQL Test\Red Gate\Uninstaller\Microsoft.Deployment.WindowsInstaller.dll.~1
Size 176KB
SHA256 b1a3721e374af26f54dde662166f355622a77b447e078dad4e22123df33ce1a6
MD5 49e8bd0d8e5a0a0cdf1adf1f87d85e64
SHA1 a6ad708dc73f29114edceef760f684fa02cb48c4
SHA512 4b847dea1ca6c60e64bdaec7b5565047804903136453b142006a38f4eb3ba7569baf2742f789c100062dcd7166c711fb09737b1a5c5f5b5678d13b0308c19b78
SSDEEP 3072:tFaMZx9o4eVU+fKlRUjW01KyY40aUq+0RLuovZnCZ4C7KjmlGj9:tUaohrSq+0RLuoxXmlm
TLSH
T1E1046B6553BC833FCEBF8739E13541A2D7F0E4A63517DB1CAD8241B52562B90BA92383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.Installer.ProductParsing.dll.~1

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\SQL Test\Red Gate\Uninstaller\RedGate.Installer.ProductParsing.dll.~1
Size 17KB
SHA256 80a2a687bd863f1bb61f851ccbf786ac5fb45ad9630ea449345983e25f8ba9a1
MD5 3332541cbd2db75dc9e59790628f1089
SHA1 dd51053234473dbcdc9bfbd391da8858acb41a5d
SHA512 02d23b0dfd7599720c791be2cf673e323207529dfc8ac0c953fa0e30c9605a08f1800aba9959820e47266d300b1858cfee00cabad511896f2404d58d226ab29c
SSDEEP 192:Wbwd9SWjJtaSDbnPIIYiYF8Wa/Oq8Oa194ylw7ULc8pq8RuwdmL4pUQrNyntz:WbkeSHQIYiXozRlwwy8RbmL4nNyntz
TLSH
T105827B538BD05D05DD279F31B4E88636AE71B65499E2CAC73048C0A69BA53413BED3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGate.Win32.dll.~1

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\SQL Test\Red Gate\Uninstaller\RedGate.Win32.dll.~1
Size 56KB
SHA256 411c6bebddedbb73854465bb2c025ddd477c570fe84714eff56dff08f7e9ab96
MD5 720c3b2e5814c08317af5036039e6794
SHA1 22cb444a279bf97353136c3fed54eb04168f7ee9
SHA512 52b12aece88d94edab15d54cadaeeb4d179b349700007250e66bc8ca55ad7de160cad2b3eba48faba1ca120d6423eee0da4cd9c3f6afe018d8a99ee5b8161d9a
SSDEEP 1536:MhHAb8qH326L0Nzqi5Acugaty621ufZRIpiCRIpi93hc2:n8qHBiOvHypufZRSRw2
TLSH
T18A439D07A768452EDE8FC73050E2DF0ACA70E1C1622ECB5A58DE8165ED82FE417585FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQL Test_4.4.5.5330_x86.msi.~1

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\SQL Test\SQL Test_4.4.5.5330_x86.msi.~1
Size 972KB
SHA256 7cf029a9ad05107489312e4b9ed13af1298dd8da6791e27c2293406935033045
MD5 355512d47759333a07c4bdbed3e47cf9
SHA1 b6b325aaf2b981e6223eeea2b6a54b68c915cf48
SHA512 370753d6231c4526005e4cc400b581ccb82b5927d2ff45895eeceb3740d6cb23ff149451b05164953f110aada0b37c9f5605add39fbd431cdadd95af4221dc65
SSDEEP 12288:vFBaimF8vvad2LghMJW+We2stwkPpRsr98GSlrGmU5FZHNjJueETv7R:dGC64LghF+S+RPpRsr9IlrGztN09
TLSH
T10425E011B5808431D0BBDA3C0865D6651A7E7D205F71B98B23D87E2F3EB32C25AF4B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLToolBeltInstaller.project

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\SQLToolBeltInstaller.project
Size 92KB
SHA256 98a38a8145281f8cf116a2f0a9dcdcea73fb48860ab71c082699ad10deedbb3d
MD5 a226bfa8588fefea92888964ca026212
SHA1 2105afbd73e7d869a28d999b914e875fb81bd8a4
SHA512 d0abb68f4d7128a8c1c3cf656fe0d68af5b248f25ec834f1fd417f7bf14375dce045448903fc9739f8894e720a127a357247998164ec193117604d363e7a1c80
SSDEEP 1536:eoAEwnfOy32It0OBZ7XU+NinQeiy39hvkpMFJef:D3+EDqM+f
TLSH
T152937C32B7049429C521C77D0066DDE523666E0F2E617E5939D93F9BBB330A33AE811B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serilog.Sinks.File.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\Serilog.Sinks.File.dll
Size 27KB
SHA256 6d8d84c9c14201674d9a309f51e952cf148ad33cdb66507d9677ebf1b1e4432b
MD5 4c2b0737d9a73da09172d3c210b0265d
SHA1 a35a98ec72154cc1d112f46bd177a7f043dbcd46
SHA512 c605bef0a7caa12b0d7c47564c3a214ea1db40f901dfdc4c5b35bf73610a5d9030b67e495b409a79c76ad5ec6ef9962cd56c050c51883a3151d34931a8361aa8
SSDEEP 384:rdK36THowuUITpqSRiIrSI1KQrgwc6LdSpARCHdDQBLJRI+qMalKVeFje+WUMuUk:rdG9LUgZRiIVJrgwDmHdD2JRr6VUqX
TLSH
T139C20705A7ED421BE6FE1FB8E9B025511731F9B2E833EB4D15CC645E1C26B148E10BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serilog.dll

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\Serilog.dll
Size 123KB
SHA256 7a26a473af5eb7a00196e275c86d773f36e1d4caef566f97f1df7e07e20b1670
MD5 0aa45a8a1cd24cd2b589e4aad925f35d
SHA1 0dc29954c4c2ffea4c33af0e56ce84158849b81e
SHA512 7a865b16633c09bdecda34fdf15c62db4f04f2fb8db0abf57563aea51de67daf9eca0c08f053f551937a0c3c7987a53de2454ecb13139a193291633df7262981
SSDEEP 3072:XfwtSQoXux2ogH8I/eXXXXXPXXXXXHXXXXXTaXXXXX14N0QXVsABFkNfM+HFukRb:PwtSQoXux2M3XXXXXPXXXXXHXXXXX2Xh
TLSH
T15BC35C26A3FC4AA1D3EE1671A47506404B71F99B3567EF4E3F5C35F92C123084A28BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.bin

Path C:\Users\Admin\AppData\Local\Temp\{036AFFCF-7F7D-491F-8E09-9D3B267ED16D}\install.bin
Size 3.7MB
SHA256 fd8e092186505a7562290f60da2405a068bf41e7658c2671fb00e6a7b1053696
MD5 e38e910584354449c087dce311fd58b5
SHA1 1d531210164321e699e864227544ffb7c949ba4a
SHA512 a83241d45a72533bfee42b04536d7414b37a73e43e88a1a0af563d33838694be471800e9dcf762d2a584c66bf58ef919f3fe045ff07b2736af21810ba96907a3
SSDEEP 98304:c8L5kbNlT3dJsMimBUMavR5C/rlaZHPAbtHbYPnoMUf8E+mm:cNBlJjFBUMaZ5Cha1P8aoBfz+/
TLSH
T1E606333ED1DC401BE4AD387AFAE0E2015C2ED923D2DFDB1058D4916AAF06A89DC557B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1764-80-0x00000000064C0000-0x000000000655C000-memory.dmp

Download

memory/1764-54-0x0000000005D40000-0x0000000005D66000-memory.dmp

Download

memory/1764-117-0x0000000006A10000-0x0000000006A20000-memory.dmp

Download

memory/1764-108-0x00000000067C0000-0x00000000067CA000-memory.dmp

Download

memory/1764-103-0x0000000006AB0000-0x0000000006B42000-memory.dmp

Download

memory/1764-98-0x00000000069F0000-0x0000000006A0E000-memory.dmp

Download

memory/1764-102-0x00000000069D0000-0x00000000069D8000-memory.dmp

Download

memory/1764-95-0x00000000067B0000-0x00000000067BE000-memory.dmp

Download

memory/1764-90-0x0000000006790000-0x0000000006798000-memory.dmp

Download

memory/1764-81-0x00000000067D0000-0x0000000006836000-memory.dmp

Download

memory/1764-86-0x0000000006840000-0x000000000688A000-memory.dmp

Download

memory/1764-70-0x0000000005E10000-0x0000000005E46000-memory.dmp

Download

memory/1764-85-0x0000000005DB0000-0x0000000005DB8000-memory.dmp

Download

memory/1764-123-0x000000000B5A0000-0x000000000B654000-memory.dmp

Download

memory/1764-127-0x000000000B510000-0x000000000B540000-memory.dmp

Download

memory/1764-79-0x0000000006050000-0x0000000006212000-memory.dmp

Download

memory/1764-128-0x000000000B8F0000-0x000000000B956000-memory.dmp

Download

memory/1764-78-0x0000000005E50000-0x0000000005E76000-memory.dmp

Download

memory/1764-74-0x0000000005D70000-0x0000000005D84000-memory.dmp

Download

memory/1764-62-0x0000000005DC0000-0x0000000005E02000-memory.dmp

Download

memory/1764-66-0x00000000059B0000-0x00000000059BE000-memory.dmp

Download

memory/1764-133-0x000000000C5E0000-0x000000000CB84000-memory.dmp

Download

memory/1764-58-0x00000000059A0000-0x00000000059AE000-memory.dmp

Download

memory/1764-113-0x0000000006780000-0x0000000006788000-memory.dmp

Download

memory/1764-50-0x00000000030F0000-0x00000000030F8000-memory.dmp

Download

memory/1764-46-0x00000000059C0000-0x00000000059D0000-memory.dmp

Download

memory/1764-45-0x0000000000D40000-0x0000000000D68000-memory.dmp

Download

memory/1764-464-0x0000000008AF0000-0x0000000008BCB000-memory.dmp

Download

memory/1764-452-0x000000000E0E0000-0x000000000E60C000-memory.dmp

Download

memory/1764-453-0x0000000006F40000-0x0000000007016000-memory.dmp

Download

memory/1764-454-0x00000000073E0000-0x000000000749A000-memory.dmp

Download

memory/1764-455-0x00000000084A0000-0x00000000084B2000-memory.dmp

Download

memory/1764-456-0x0000000008BD0000-0x0000000008BD8000-memory.dmp

Download

memory/1764-457-0x0000000008C80000-0x0000000008CB8000-memory.dmp

Download

memory/1764-458-0x0000000008C50000-0x0000000008C5E000-memory.dmp

Download

memory/1764-466-0x00000000059C0000-0x00000000059D0000-memory.dmp

Download

memory/1764-465-0x0000000007370000-0x0000000007398000-memory.dmp

Download

memory/1764-462-0x0000000005560000-0x0000000005643000-memory.dmp

Download

memory/1764-463-0x000000000B8E0000-0x000000000B8EE000-memory.dmp

Download

memory/4604-461-0x00000000047C0000-0x00000000047FB000-memory.dmp

Download

memory/4604-460-0x00000000045C0000-0x0000000004623000-memory.dmp

Download

memory/4604-459-0x00000000018B0000-0x0000000001993000-memory.dmp

Download

memory/4604-503-0x00000000045C0000-0x0000000004623000-memory.dmp

Download

memory/4604-552-0x00000000045C0000-0x0000000004623000-memory.dmp

Download

memory/4936-451-0x0000000002500000-0x00000000025E3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads