Overview

overview

7

Static

static

3

UniTube-Se....7.exe

windows10-2004-x64

7

UniTube-Se....7.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/07/2026, 17:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UniTube-Setup-v2.0.7.exe
  • Size 30.6MB
  • Sample260724-v2fxcstsgx
  • SHA256 9cd50882a20e68974c40f7f729bdced0876e4a3a0b477a3bb5a1362679eb8e7d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies registry key 1 TTPs 9 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-v2.0.7.exe
    "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-v2.0.7.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:4944
    • C:\Program Files\dotnet\dotnet.exe
      "C:\Program Files\dotnet\dotnet.exe" --list-sdks
      2⤵
        PID:1304
      • C:\Program Files\dotnet\dotnet.exe
        "C:\Program Files\dotnet\dotnet.exe" --list-sdks
        2⤵
          PID:1984
        • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
          C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe restore C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\source\src\UniTube.App\UniTube.App.csproj --runtime win-x64 --disable-parallel
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Time Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1752
        • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
          C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe publish C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\source\src\UniTube.App\UniTube.App.csproj -c Release --runtime win-x64 --self-contained true --no-restore -p:PublishSingleFile=false -p:DebugType=None -p:DebugSymbols=false -o C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\publish
          2⤵
          • Executes dropped EXE
          • System Time Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1968
          • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" exec "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Roslyn\bincore\VBCSCompiler.dll" "-pipename:6tKGrynT5KG6AwhQyWzINmjqgUhZpoMN9564ywxeHxw"
            3⤵
            • Executes dropped EXE
            PID:6108
          • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" nuget verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.sdk.tvos.manifest-8.0.100\18.0.8319\microsoft.net.sdk.tvos.manifest-8.0.100.18.0.8319.nupkg
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5844
            • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
              "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" exec C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.CommandLine.XPlat.dll verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.sdk.tvos.manifest-8.0.100\18.0.8319\microsoft.net.sdk.tvos.manifest-8.0.100.18.0.8319.nupkg
              4⤵
              • Executes dropped EXE
              PID:4120
          • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" nuget verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.sdk.aspire.manifest-8.0.100\8.2.2\microsoft.net.sdk.aspire.manifest-8.0.100.8.2.2.nupkg
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5328
            • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
              "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" exec C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.CommandLine.XPlat.dll verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.sdk.aspire.manifest-8.0.100\8.2.2\microsoft.net.sdk.aspire.manifest-8.0.100.8.2.2.nupkg
              4⤵
              • Executes dropped EXE
              PID:3356
          • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" nuget verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.workload.mono.toolchain.current.manifest-8.0.100\8.0.29\microsoft.net.workload.mono.toolchain.current.manifest-8.0.100.8.0.29.nupkg
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4336
            • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
              "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" exec C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.CommandLine.XPlat.dll verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.workload.mono.toolchain.current.manifest-8.0.100\8.0.29\microsoft.net.workload.mono.toolchain.current.manifest-8.0.100.8.0.29.nupkg
              4⤵
              • Executes dropped EXE
              PID:6128
          • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" nuget verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.sdk.maccatalyst.manifest-8.0.100\18.0.8319\microsoft.net.sdk.maccatalyst.manifest-8.0.100.18.0.8319.nupkg
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5020
            • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
              "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" exec C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.CommandLine.XPlat.dll verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.sdk.maccatalyst.manifest-8.0.100\18.0.8319\microsoft.net.sdk.maccatalyst.manifest-8.0.100.18.0.8319.nupkg
              4⤵
              • Executes dropped EXE
              PID:5216
          • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" nuget verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.sdk.android.manifest-8.0.100\34.0.154\microsoft.net.sdk.android.manifest-8.0.100.34.0.154.nupkg
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1020
            • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
              "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" exec C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.CommandLine.XPlat.dll verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.sdk.android.manifest-8.0.100\34.0.154\microsoft.net.sdk.android.manifest-8.0.100.34.0.154.nupkg
              4⤵
              • Executes dropped EXE
              PID:4780
          • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" nuget verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.workload.emscripten.current.manifest-8.0.100\8.0.29\microsoft.net.workload.emscripten.current.manifest-8.0.100.8.0.29.nupkg
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5572
            • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
              "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" exec C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.CommandLine.XPlat.dll verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.workload.emscripten.current.manifest-8.0.100\8.0.29\microsoft.net.workload.emscripten.current.manifest-8.0.100.8.0.29.nupkg
              4⤵
              • Executes dropped EXE
              PID:5996
          • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" nuget verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.workload.emscripten.net6.manifest-8.0.100\8.0.29\microsoft.net.workload.emscripten.net6.manifest-8.0.100.8.0.29.nupkg
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5360
            • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
              "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" exec C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.CommandLine.XPlat.dll verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.workload.emscripten.net6.manifest-8.0.100\8.0.29\microsoft.net.workload.emscripten.net6.manifest-8.0.100.8.0.29.nupkg
              4⤵
              • Executes dropped EXE
              PID:3956
          • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" nuget verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.sdk.macos.manifest-8.0.100\15.0.8319\microsoft.net.sdk.macos.manifest-8.0.100.15.0.8319.nupkg
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4136
            • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
              "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" exec C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.CommandLine.XPlat.dll verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.sdk.macos.manifest-8.0.100\15.0.8319\microsoft.net.sdk.macos.manifest-8.0.100.15.0.8319.nupkg
              4⤵
              • Executes dropped EXE
              PID:5480
          • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" nuget verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.workload.mono.toolchain.net7.manifest-8.0.100\8.0.29\microsoft.net.workload.mono.toolchain.net7.manifest-8.0.100.8.0.29.nupkg
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1576
            • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
              "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" exec C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.CommandLine.XPlat.dll verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.workload.mono.toolchain.net7.manifest-8.0.100\8.0.29\microsoft.net.workload.mono.toolchain.net7.manifest-8.0.100.8.0.29.nupkg
              4⤵
              • Executes dropped EXE
              PID:1724
          • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" nuget verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.sdk.maui.manifest-8.0.100\8.0.100\microsoft.net.sdk.maui.manifest-8.0.100.8.0.100.nupkg
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1188
            • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
              "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" exec C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.CommandLine.XPlat.dll verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.sdk.maui.manifest-8.0.100\8.0.100\microsoft.net.sdk.maui.manifest-8.0.100.8.0.100.nupkg
              4⤵
              • Executes dropped EXE
              PID:2916
          • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" nuget verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.workload.emscripten.net7.manifest-8.0.100\8.0.29\microsoft.net.workload.emscripten.net7.manifest-8.0.100.8.0.29.nupkg
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4860
            • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
              "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" exec C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.CommandLine.XPlat.dll verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.workload.emscripten.net7.manifest-8.0.100\8.0.29\microsoft.net.workload.emscripten.net7.manifest-8.0.100.8.0.29.nupkg
              4⤵
              • Executes dropped EXE
              PID:5380
          • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" nuget verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.sdk.ios.manifest-8.0.100\18.0.8319\microsoft.net.sdk.ios.manifest-8.0.100.18.0.8319.nupkg
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3444
            • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
              "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" exec C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.CommandLine.XPlat.dll verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.sdk.ios.manifest-8.0.100\18.0.8319\microsoft.net.sdk.ios.manifest-8.0.100.18.0.8319.nupkg
              4⤵
              • Executes dropped EXE
              PID:2212
          • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" nuget verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.workload.mono.toolchain.net6.manifest-8.0.100\8.0.29\microsoft.net.workload.mono.toolchain.net6.manifest-8.0.100.8.0.29.nupkg
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3728
            • C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
              "C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe" exec C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.CommandLine.XPlat.dll verify --all C:\Users\Admin\AppData\Local\Temp\1c2b629d-96c2-41fd-85ac-3808bc41c5e2\microsoft.net.workload.mono.toolchain.net6.manifest-8.0.100\8.0.29\microsoft.net.workload.mono.toolchain.net6.manifest-8.0.100.8.0.29.nupkg
              4⤵
              • Executes dropped EXE
              PID:2720
        • C:\Windows\system32\taskkill.exe
          taskkill.exe /F /T /IM UniTube.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1892
        • C:\Windows\system32\tasklist.exe
          tasklist.exe /FI "IMAGENAME eq UniTube.exe" /FO CSV /NH
          2⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:5736
        • C:\Windows\system32\reg.exe
          reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UniTube /v DisplayName /t REG_SZ /d UniTube /f
          2⤵
          • Modifies registry key
          PID:1352
        • C:\Windows\system32\reg.exe
          reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UniTube /v DisplayVersion /t REG_SZ /d 2.0.7 /f
          2⤵
          • Modifies registry key
          PID:3856
        • C:\Windows\system32\reg.exe
          reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UniTube /v Publisher /t REG_SZ /d UniTube /f
          2⤵
          • Modifies registry key
          PID:1532
        • C:\Windows\system32\reg.exe
          reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UniTube /v InstallLocation /t REG_SZ /d C:\Users\Admin\AppData\Local\Programs\UniTube\app-2.0.7-1784914285 /f
          2⤵
          • Modifies registry key
          PID:4752
        • C:\Windows\system32\reg.exe
          reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UniTube /v DisplayIcon /t REG_SZ /d C:\Users\Admin\AppData\Local\Programs\UniTube\app-2.0.7-1784914285\UniTube.exe,0 /f
          2⤵
          • Modifies registry key
          PID:2860
        • C:\Windows\system32\reg.exe
          reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UniTube /v UninstallString /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\UniTube\app-2.0.7-1784914285\Uninstall UniTube.exe\" /uninstall" /f
          2⤵
          • Modifies registry key
          PID:2584
        • C:\Windows\system32\reg.exe
          reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UniTube /v QuietUninstallString /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\UniTube\app-2.0.7-1784914285\Uninstall UniTube.exe\" /uninstall /quiet" /f
          2⤵
          • Modifies registry key
          PID:2964
        • C:\Windows\system32\reg.exe
          reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UniTube /v NoModify /t REG_DWORD /d 1 /f
          2⤵
          • Modifies registry key
          PID:3784
        • C:\Windows\system32\reg.exe
          reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UniTube /v NoRepair /t REG_DWORD /d 1 /f
          2⤵
          • Modifies registry key
          PID:4416
        • C:\Users\Admin\AppData\Local\Programs\UniTube\app-2.0.7-1784914285\UniTube.exe
          C:\Users\Admin\AppData\Local\Programs\UniTube\app-2.0.7-1784914285\UniTube.exe
          2⤵
          • Executes dropped EXE
          PID:1288

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            nupkg_libvlcsharp.3.10.0.dat
            • Path C:\Users\Admin\AppData\Local\NuGet\v3-cache\670c1461c29885f9aa22c281d8b7da90845b38e4$ps_api.nuget.org_v3_index.json\nupkg_libvlcsharp.3.10.0.dat
            • Size 2.6MB
            • SHA256 b1ed0cdffac10c1999a2cf95af44324341afc2da635dddb50397b9f4d0e95065
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nupkg_libvlcsharp.winforms.3.10.0.dat
            • Path C:\Users\Admin\AppData\Local\NuGet\v3-cache\670c1461c29885f9aa22c281d8b7da90845b38e4$ps_api.nuget.org_v3_index.json\nupkg_libvlcsharp.winforms.3.10.0.dat
            • Size 36KB
            • SHA256 df6945b9475b39f67e0e43d404cc054d714e02de64aceb6087443b8243444408
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nupkg_taglibsharp.2.3.0.dat
            • Path C:\Users\Admin\AppData\Local\NuGet\v3-cache\670c1461c29885f9aa22c281d8b7da90845b38e4$ps_api.nuget.org_v3_index.json\nupkg_taglibsharp.2.3.0.dat
            • Size 1.3MB
            • SHA256 3c3f5b55988f69e0bc84dc760feb8351fef4d5c09a322d88462e683d334dfbfc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            repository_signatures_5.0.0.dat
            • Path C:\Users\Admin\AppData\Local\NuGet\v3-cache\670c1461c29885f9aa22c281d8b7da90845b38e4$ps_api.nuget.org_v3_index.json\repository_signatures_5.0.0.dat
            • Size 1KB
            • SHA256 5f45cbf2d7f8a4b57fea6e43bb603d29a0682058a71eb61d900db74860d210b0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Tmp889A.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\Tmp889A.tmp
            • Size 2KB
            • SHA256 abdf3c43260dbea4cc01eb451a52ce07e273db157ee617f85c3e88ab485e79a8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AdvertisedManifestFeatureBand.txt
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-home\.dotnet\sdk-advertising\8.0.400\microsoft.net.sdk.macos\AdvertisedManifestFeatureBand.txt
            • Size 7B
            • SHA256 a61652f8a51cc6562b04b60dfcc61d842aa567bcef4afd425e4c7bed61271d2f
            • MD5 SHA1 SHA512
            Submit Download

            dotnet.exe
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\dotnet.exe
            • Size 154KB
            • SHA256 70bea8fcb3f76bc21637e4b0e889865852c4a51476822017d1c537785795817f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hostfxr.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\host\fxr\8.0.24\hostfxr.dll
            • Size 358KB
            • SHA256 681608247437e96ec508274aff792bf9ea9fce48faf31301d1ced42879e237a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet-dev-certs.runtimeconfig.json
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\DotnetTools\dotnet-dev-certs\8.0.24-servicing.26072.7\tools\net8.0\any\dotnet-dev-certs.runtimeconfig.json
            • Size 341B
            • SHA256 434574773c4e876ea32fe0f1d0aff952ef966ecb3b6eba0ea6d54a90283ed08c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            System.CommandLine.resources.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\DotnetTools\dotnet-watch\8.0.418-servicing.26072.7\tools\net8.0\any\cs\System.CommandLine.resources.dll
            • Size 18KB
            • SHA256 6c9e8a37d656c8ee738cb0db392d49e908505a82175266e072a4552a7c98adcf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.CommandLine.resources.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\DotnetTools\dotnet-watch\8.0.418-servicing.26072.7\tools\net8.0\any\de\System.CommandLine.resources.dll
            • Size 18KB
            • SHA256 8c4a1a6e84875ae583fc032a723e934f0d8805d452b43a81b4eec624b5ea7e15
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.CommandLine.resources.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\DotnetTools\dotnet-watch\8.0.418-servicing.26072.7\tools\net8.0\any\es\System.CommandLine.resources.dll
            • Size 19KB
            • SHA256 b58c35c328c383e3461c3ea2f1f0c46e7a48446d863f2c2c63f42aa466e002b8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.CommandLine.resources.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\DotnetTools\dotnet-watch\8.0.418-servicing.26072.7\tools\net8.0\any\fr\System.CommandLine.resources.dll
            • Size 19KB
            • SHA256 7ad12924769e5e85266ebd510fb4be141cf5092f0f8988345f80f5bacce0479b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.CommandLine.resources.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\DotnetTools\dotnet-watch\8.0.418-servicing.26072.7\tools\net8.0\any\it\System.CommandLine.resources.dll
            • Size 19KB
            • SHA256 37ab1ac8eafeb21cdca5418d01ee65671dacad3fe206f13e8ddb5b199e5ee471
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.CommandLine.resources.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\DotnetTools\dotnet-watch\8.0.418-servicing.26072.7\tools\net8.0\any\ja\System.CommandLine.resources.dll
            • Size 19KB
            • SHA256 654efb9ccd7c39ce7992616f8aad94e5855f01a3b1ad5dbf21710b1b6d24f00c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.CommandLine.resources.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\DotnetTools\dotnet-watch\8.0.418-servicing.26072.7\tools\net8.0\any\ko\System.CommandLine.resources.dll
            • Size 19KB
            • SHA256 f3d814678daa95c4609d723548edef7a76bb87423a4e78a20e48fded87089483
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.CommandLine.resources.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\DotnetTools\dotnet-watch\8.0.418-servicing.26072.7\tools\net8.0\any\pl\System.CommandLine.resources.dll
            • Size 18KB
            • SHA256 09eafe24bde0110f526b49001d97673e533ffd9d361d9be9c4b511eac4dd1bc2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.CommandLine.resources.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\DotnetTools\dotnet-watch\8.0.418-servicing.26072.7\tools\net8.0\any\pt-BR\System.CommandLine.resources.dll
            • Size 18KB
            • SHA256 516e73295a8c886807ef125de6dfdcc3b783133603655c7a105b38a953ca3353
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.CommandLine.resources.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\DotnetTools\dotnet-watch\8.0.418-servicing.26072.7\tools\net8.0\any\ru\System.CommandLine.resources.dll
            • Size 19KB
            • SHA256 8a24f850a71065e93ae80d3a62903653e1aaff9ff478e05831f288761e4bcc02
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.CommandLine.resources.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\DotnetTools\dotnet-watch\8.0.418-servicing.26072.7\tools\net8.0\any\tr\System.CommandLine.resources.dll
            • Size 18KB
            • SHA256 7a2ada59d84ae17791ca23ff010f1251d98a72df15d1c7355274557349c124bf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.CommandLine.resources.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\DotnetTools\dotnet-watch\8.0.418-servicing.26072.7\tools\net8.0\any\zh-Hans\System.CommandLine.resources.dll
            • Size 18KB
            • SHA256 d8682c24396dd5093f4e4bee6cc021148ed2558039b2682bebb60dbb95db56cd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.CommandLine.resources.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\DotnetTools\dotnet-watch\8.0.418-servicing.26072.7\tools\net8.0\any\zh-Hant\System.CommandLine.resources.dll
            • Size 18KB
            • SHA256 8508d85c0fcf1040b05d2a2f0c7e4f74ac476f9a46f414e05e8d47d565367e5e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.DotNet.Cli.Utils.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Microsoft.DotNet.Cli.Utils.dll
            • Size 258KB
            • SHA256 507a34fadf308a70ee409380eb15561375ecb81db53603cf6926f05d90034911
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.DotNet.Configurer.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Microsoft.DotNet.Configurer.dll
            • Size 54KB
            • SHA256 fe959f0c6d3327ce60c31d80c1620fc4dd64d6b29146f9621af6f7a4f78f9c0c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.DotNet.InternalAbstractions.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Microsoft.DotNet.InternalAbstractions.dll
            • Size 46KB
            • SHA256 6e495cd939b8e057d4cd85433bbcab71ab43d7df4a249ea22ab736476e3f23fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Logging.Abstractions.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Microsoft.Extensions.Logging.Abstractions.dll
            • Size 142KB
            • SHA256 988bb2e789faf7687dac75900d397d2b0bc7df3cc46bbc0a75d4f2e075d06dc6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.TemplateEngine.Abstractions.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Microsoft.TemplateEngine.Abstractions.dll
            • Size 86KB
            • SHA256 ac243dbe91497a5e034fc7622a858e784ee65cee2b41b57ec8124064ae3d65d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.TemplateEngine.Cli.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Microsoft.TemplateEngine.Cli.dll
            • Size 1.1MB
            • SHA256 ef131a02b009d943d18ce312003515926f769f71a7d9479dbb452e4a8a772890
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.TemplateEngine.Edge.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Microsoft.TemplateEngine.Edge.dll
            • Size 734KB
            • SHA256 ab9f619c2c279352093a2486202d358679ba6bcad748f3a44a91c6bcb04e872b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.TemplateSearch.Common.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Microsoft.TemplateSearch.Common.dll
            • Size 174KB
            • SHA256 a2f31dfe8978e15676c8dfc8b45cefb5a59908de39fdf65073feff03a36526fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NuGet.Common.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.Common.dll
            • Size 294KB
            • SHA256 c504082f5b4a53f6e69e73641b71dad0d4cf5fc9eb4f00c74150bbf2e60aa4fe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NuGet.Configuration.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.Configuration.dll
            • Size 458KB
            • SHA256 c539f971e9da34766986e411e3b0da9468d91a455047a3fa4b4d810b54298ad3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NuGet.Protocol.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\NuGet.Protocol.dll
            • Size 2.0MB
            • SHA256 d0406323b58aa60a82723bcc521f86e0535588c2b362de57e093ade89995a3c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Bcl.AsyncInterfaces.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Sdks\Microsoft.NET.Sdk.Razor\tasks\net472\Microsoft.Bcl.AsyncInterfaces.dll
            • Size 26KB
            • SHA256 80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Buffers.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Sdks\Microsoft.NET.Sdk.Razor\tasks\net472\System.Buffers.dll
            • Size 20KB
            • SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Memory.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Sdks\Microsoft.NET.Sdk.Razor\tasks\net472\System.Memory.dll
            • Size 138KB
            • SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Numerics.Vectors.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Sdks\Microsoft.NET.Sdk.Razor\tasks\net472\System.Numerics.Vectors.dll
            • Size 113KB
            • SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.CompilerServices.Unsafe.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Sdks\Microsoft.NET.Sdk.Razor\tasks\net472\System.Runtime.CompilerServices.Unsafe.dll
            • Size 17KB
            • SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Text.Encodings.Web.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Sdks\Microsoft.NET.Sdk.Razor\tasks\net472\System.Text.Encodings.Web.dll
            • Size 77KB
            • SHA256 e9c4f5eed186cb129c527c4b8d67d163ea2f2396e9d8b96e30b5e7c12203ce84
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Threading.Tasks.Extensions.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Sdks\Microsoft.NET.Sdk.Razor\tasks\net472\System.Threading.Tasks.Extensions.dll
            • Size 25KB
            • SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ValueTuple.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Sdks\Microsoft.NET.Sdk.Razor\tasks\net472\System.ValueTuple.dll
            • Size 24KB
            • SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Text.Json.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Sdks\Microsoft.NET.Sdk.StaticWebAssets\tasks\net472\System.Text.Json.dll
            • Size 629KB
            • SHA256 86c3f263ae9b4469ab1266c80471087082447eb4a38e6b97bf5e84de15c07a1d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.Immutable.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Sdks\Microsoft.NET.Sdk.WindowsDesktop\tools\net472\System.Collections.Immutable.dll
            • Size 246KB
            • SHA256 d5ec0837bb176abf13dcd52c658c4e84c5264f67065b9c19679b6643f7d21564
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.SourceLink.GitHub.props
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Sdks\Microsoft.SourceLink.GitHub\buildMultiTargeting\Microsoft.SourceLink.GitHub.props
            • Size 295B
            • SHA256 2ddb662297ebfb51e70bc61ca7695dc62124a1edd342c82e87e6302cc03f016c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft.SourceLink.GitLab.targets
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\Sdks\Microsoft.SourceLink.GitLab\buildMultiTargeting\Microsoft.SourceLink.GitLab.targets
            • Size 297B
            • SHA256 61af182d230365161e831fc573eaa7a2c9ea413e01ca2c446e3aa623e3ee37a1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            System.CommandLine.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\System.CommandLine.dll
            • Size 350KB
            • SHA256 d295c3cc05356930b485a079939b666b8d4a72ef6de91ebb69d7c3c4cbcb6a40
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            testhost.net47.x86.exe.config
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\TestHostNetFramework\testhost.net47.x86.exe.config
            • Size 4KB
            • SHA256 b60b80763571c22739c4a688a46ee12c65bb66d1e9ac7d0933c2e4222e618874
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.deps.json
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\dotnet.deps.json
            • Size 79KB
            • SHA256 d80ed7c3d213aa4c600af91e0e61507ce49af0c654d5b188167466a619045827
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\sdk\8.0.418\dotnet.dll
            • Size 2.4MB
            • SHA256 97c49dcfba2a41ca7d36885fae38f6ac694fe16fedc0e8f25e309495d6e69956
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.NETCore.App.deps.json
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\Microsoft.NETCore.App.deps.json
            • Size 27KB
            • SHA256 89668013895198c2af057ea558093b4601dca2e9c1663cc00e8b9076409ddac5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.NETCore.App.runtimeconfig.json
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\Microsoft.NETCore.App.runtimeconfig.json
            • Size 53B
            • SHA256 ac377253f9f7cf9d6127d684369de36da123d992cdc2e17950e3c8bf9688df76
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft.Win32.Primitives.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\Microsoft.Win32.Primitives.dll
            • Size 15KB
            • SHA256 e2325410fce75b8f82c18c2c01084559f935540dad4bd8239ef69149aecde6f2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\System.Collections.dll
            • Size 254KB
            • SHA256 593bfd1f70a4d877441809f099da67efc419fc114e1bdb5fc1a2af904003e679
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ComponentModel.Primitives.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\System.ComponentModel.Primitives.dll
            • Size 78KB
            • SHA256 5df06616663bbef65d1e0d7e8483617fef524031805367c2ce5519bff3a186fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Console.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\System.Console.dll
            • Size 170KB
            • SHA256 4b7643ee293b894fbe4326b0bc08aec7bf9be880d3c18e94a221ee47b9969f49
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Diagnostics.Process.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\System.Diagnostics.Process.dll
            • Size 330KB
            • SHA256 dc466df5510c3f3ed3c1786c09c5abe00df95b87020247327229e3fc3d9422d0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Diagnostics.Tracing.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\System.Diagnostics.Tracing.dll
            • Size 16KB
            • SHA256 d19f84f434c349cb36ae281490387cb11f590a0c25954f84be8bdc4ba8183bf2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Linq.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\System.Linq.dll
            • Size 530KB
            • SHA256 4f63cdefbad5358f58ff672db6498b283b15bf733015391af024d1428cea0334
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Private.CoreLib.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\System.Private.CoreLib.dll
            • Size 12.6MB
            • SHA256 8f078b97c0bd41312137d34d4c5759d5ad4b138697d092d1feb01d9bcf9b2790
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Private.Uri.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\System.Private.Uri.dll
            • Size 254KB
            • SHA256 635137a1d8426f7c7d9f08c09acb22bdaab8906fb73563d95b02ad10e0b51695
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.InteropServices.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\System.Runtime.InteropServices.dll
            • Size 94KB
            • SHA256 c07fc9fbf4dd7897bbb0b52115f4920182501892f604d1844ca2ba874f410589
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\System.Runtime.dll
            • Size 42KB
            • SHA256 7d104204eb3d859f8963011df299710bafbbad7f9ab39802b364a462f14151c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Text.Encoding.CodePages.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\System.Text.Encoding.CodePages.dll
            • Size 842KB
            • SHA256 db2b836b0b12c5ae7fa86aa803ac023005294e9dd54a487b340308bcfbd98803
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Text.Encoding.Extensions.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\System.Text.Encoding.Extensions.dll
            • Size 15KB
            • SHA256 29fcdff9865e0e84d0cb5a55ac4cd2b0da791bb5a6502146bacf6beeb8c821e6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Threading.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\System.Threading.dll
            • Size 82KB
            • SHA256 58d58df5bd68cec47d0f647d1a54690b19a9e6ee8f3636bfe6f0b50d99d8c853
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            clrjit.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\clrjit.dll
            • Size 1.7MB
            • SHA256 d3a6452826679f53db64520173f30a387abc1a6caf1bd7462cab01d6b065c870
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            coreclr.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\coreclr.dll
            • Size 4.8MB
            • SHA256 ff84e21aab9700a145a44518f1ff1626d893f017bda30ad0231fa61fa74a72a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hostpolicy.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\hostpolicy.dll
            • Size 397KB
            • SHA256 0d2c892644e82fa155ab9dcd5aa6db7f0d333744bfe1094ccade4249d97c0a1e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            netstandard.dll
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\dotnet-sdk\shared\Microsoft.NETCore.App\8.0.24\netstandard.dll
            • Size 98KB
            • SHA256 d7df10dfc02d427f3165c2bbbc2a6008c5196238e6ecc86495053846a6d7d2db
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gnhqx3v2.h52
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\nuget-packages\microsoft.aspnetcore.app.runtime.win-x64\8.0.24\gnhqx3v2.h52
            • Size 11.6MB
            • SHA256 706cd603ae193e8912bb8e580f934722dbd10befd7b2012550fb7073ed4adb1e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cin50g00.3ke
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\nuget-packages\microsoft.netcore.app.runtime.win-x64\8.0.24\cin50g00.3ke
            • Size 34.5MB
            • SHA256 66650628d9ebe5f3893097870bee3c8b4087212c078eadb8aecc5ba62ca815c3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tbwwbcbv.5ij
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\nuget-packages\microsoft.windowsdesktop.app.runtime.win-x64\8.0.24\tbwwbcbv.5ij
            • Size 35.1MB
            • SHA256 0918147f69afe38c74f51874c8eb0f11d72e05671cd736ee4598d30a5555ecb5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            apphost.exe
            • Path C:\Users\Admin\AppData\Local\Temp\UniTube-Setup-3004987910\source\src\UniTube.App\obj\Release\net8.0-windows\win-x64\apphost.exe
            • Size 344KB
            • SHA256 3903230e1b9f4e90faed90fd6e380298dfb84c57b5f9b3dca16d74f046cc451a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download