Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 23:27

General

  • Target
    2026-08-06_1ebd5ef39069c9d99edd1019d7d5f1c8_dosia_elex_quasar-rat_wannacry.exe
  • Size 31.5MB
  • Sample260806-3ffcpsshrb
  • SHA256 1f49ecc882c57eb5fbbd09ac5390fefbb218c09b898b6e7ee36b753e8fca2d2a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 27 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_1ebd5ef39069c9d99edd1019d7d5f1c8_dosia_elex_quasar-rat_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-06_1ebd5ef39069c9d99edd1019d7d5f1c8_dosia_elex_quasar-rat_wannacry.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5864
    • C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\Setup.exe
      C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\Setup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3356
      • C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\DownloadManager.exe
        "C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\DownloadManager.exe" -u "https://trial2.autodesk.com/NetSWDLD/ODIS/prd/2026/ACD/9165B4AF-8BF4-37D6-882D-694B73603AED/WI/AutoCAD_2026_Simplified_Chinese_zh-CN_setup.dat" -p "C:\Users\Admin\AppData\Local\Temp\odis_download_dest\8431316646431521735\AutoCAD_2026_Simplified_Chinese_zh-CN_setup.dat" --productname Bootstrap --productversion 2.21.0.14
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2104
        • C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\CER\upi.exe" --cmd=get-device-id C:\Users\Admin\AppData\Local\Temp\upi_deviceid2
          4⤵
          • Executes dropped EXE
          PID:4348
        • C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\CER\upi.exe" C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\upiconfig.xml C:\Users\Admin\AppData\Local\Temp\upi_info.xml
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1748
      • C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\DownloadManager.exe
        C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\DownloadManager.exe -u https://dds.autodesk.com/NetSWDLD/ODIS/prd/1.0/ODIS/C976E324-2E2F-3B7A-826C-6389BF66FB79/pkg.odis.tar -p C:\Users\Admin\AppData\Local\Temp\odis_download_dest\C976E324-2E2F-3B7A-826C-6389BF66FB79\pkg.odis.tar --productname BootStrap --productversion 2.21.0.14 --fileChecksum D28D082A2CD2EB7AB80292AE8F6C3416F24A6DE4804C716EF3129DB1C724CC59
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4204
        • C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\CER\upi.exe" --cmd=get-device-id C:\Users\Admin\AppData\Local\Temp\upi_deviceid2
          4⤵
          • Executes dropped EXE
          PID:3220
        • C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\CER\upi.exe" C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\upiconfig.xml C:\Users\Admin\AppData\Local\Temp\upi_info.xml
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3808
      • C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\7za.exe
        C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\7za.exe x -ttar C:\Users\Admin\AppData\Local\Temp\odis_download_dest\C976E324-2E2F-3B7A-826C-6389BF66FB79\pkg.odis.tar -aoa "-o""C:\Users\Admin\AppData\Local\Temp\odis_download_dest\14695981039346656039"""
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1844
      • C:\Users\Admin\AppData\Local\Temp\odis_download_dest\14695981039346656039\ODIS\AdODIS-installer.exe
        C:\Users\Admin\AppData\Local\Temp\odis_download_dest\14695981039346656039\ODIS/AdODIS-installer.exe --mode unattended --prefix C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006 --xmlFilePath C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006 --useService 0
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:3840

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        pkg.odis.xml

        • Path C:\Autodesk\WI\{9165B4AF-8BF4-37D6-882D-694B73603AED}\ACD_2026_zh-CN\ODIS\pkg.odis.xml
        • Size 2KB
        • SHA256 8635ce8a37c77aa464b3a6e08abdc28525ac0fcc573ab9a0322bb0c615c0a45f
        • MD5 SHA1 SHA512 TLSH

        setup.xml

        • Path C:\Autodesk\WI\{9165B4AF-8BF4-37D6-882D-694B73603AED}\ACD_2026_zh-CN\setup.xml
        • Size 5KB
        • SHA256 1896fcc19b0266c5f852a6ed6b765c61ca92591da5bcee99919cc117f03bb628
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1A374813EDB1A6631387E414D3E73232

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232
        • Size 176KB
        • SHA256 f56e0dc616f9e58e0bc1f374bbcf630a260aa76a5ea1fb6e02f41f8e057f586f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 471B
        • SHA256 84bd2f8e8edf2c1e8faf64423787c6f281fd81bd2c2761a68bd507996b14de46
        • MD5 SHA1 SHA512 TLSH

        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Size 727B
        • SHA256 31530c48d4b9d2903020d05bed553129a4d2c0b8df2d03b5bb4a961f28b95e15
        • MD5 SHA1 SHA512 TLSH

        1A374813EDB1A6631387E414D3E73232

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232
        • Size 306B
        • SHA256 113f5f2780f43fef38889395ca93983f1622f177fdee25a9b394ddabe7f122c9
        • MD5 SHA1 SHA512 TLSH

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 400B
        • SHA256 09daaeab340f61b6cd52537bbbc82ec9afc238ead48094dece1f02b6a4a028d8
        • MD5 SHA1 SHA512 TLSH

        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Size 412B
        • SHA256 df436257e4b0a8965b1ddecbd8e94d0864e826fffd6dfa6c006699e71679e512
        • MD5 SHA1 SHA512 TLSH

        cer.log

        • Path C:\Users\Admin\AppData\Local\Autodesk\CER\663edac2b4a11548672a6576b8dbe7a9b8683fcf\cer.log
        • Size 4KB
        • SHA256 b7abe786573d31b863c4041fa6184a8ad6ae5b335a618a0f4ade3917fd184d51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sandbox_senddmp.location

        • Path C:\Users\Admin\AppData\Local\Autodesk\CER\cache\sandbox_senddmp.location
        • Size 69B
        • SHA256 f0007e0f8c044ae96430dba8f768b34d931a9e45c3cfcdc23fbdd82b2c1458f3
        • MD5 SHA1 SHA512 TLSH

        upi.log

        • Path C:\Users\Admin\AppData\Local\Autodesk\CER\upi.log
        • Size 850B
        • SHA256 9cfe383113f01dadee22148be556f7c2c26aca1754a71e9472cd8963b95d2b9e
        • MD5 SHA1 SHA512 TLSH

        upi.log

        • Path C:\Users\Admin\AppData\Local\Autodesk\CER\upi.log
        • Size 1KB
        • SHA256 48fccad62fe1c509618f1e822463d2d9e7cd51ceb02ed49eadec1d77b4bf46b0
        • MD5 SHA1 SHA512 TLSH

        upi.log

        • Path C:\Users\Admin\AppData\Local\Autodesk\CER\upi.log
        • Size 2KB
        • SHA256 122fd81d517b9643649142815c816114d520f4b72d3a8bb797970ba4627f889a
        • MD5 SHA1 SHA512 TLSH

        DLM.log

        • Path C:\Users\Admin\AppData\Local\Autodesk\ODIS\DLM.log
        • Size 1KB
        • SHA256 926c2b844c66c5190c9f2d8aa3d9963d9e9d24c4b5d7bb5919e112cd59b087a4
        • MD5 SHA1 SHA512 TLSH

        7za.exe

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\7za.exe
        • Size 1.1MB
        • SHA256 49e64a3e6a4b69c98e647201ad0b18c5a3fb16487d9cad618b2c2b824b3c9dac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Autodesk_dialog_512x512.png

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\Autodesk_dialog_512x512.png
        • Size 122KB
        • SHA256 bff55fcaf87784d76acf68f10b9d0a13da938ba2eadeb8a8482fc0a28e618237
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UPI.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\CER\UPI.dll
        • Size 659KB
        • SHA256 df1a1da45a3f07388c7bcfd060893b25811e59961f0377be4516a043b2c1f911
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DeviceSettingsProvider.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\CER\service\DeviceSettingsProvider.dll
        • Size 10.0MB
        • SHA256 ad995c6765796fe169d9c591a06acae87054cc763afa39e4f939033a2335eac2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        upi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\CER\upi.exe
        • Size 417KB
        • SHA256 a5ca75454365313920411e212f5380e3e921e3501cfce0571c1bc09f681906cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cer.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\cer.dll
        • Size 2.4MB
        • SHA256 b1889dc687ef9ac6472fa20b06e66e6bcf55eb13482b885a200114b0f8b55576
        • MD5 SHA1 SHA512 SSDEEP TLSH

        upiconfig.xml

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\CER\upiconfig.xml
        • Size 984B
        • SHA256 df91796ef977d62d6e29ca1d2aca073e52ec2d4e2bc779cdb40adf9be613bfea
        • MD5 SHA1 SHA512 TLSH

        DownloadManager.exe

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\DownloadManager.exe
        • Size 18.5MB
        • SHA256 a43121d172933baba6413c924b10b9a0fe6279ebb53d7b13b5b5bbc6305ebd07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bootstrap.json

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\bootstrap.json
        • Size 1KB
        • SHA256 4645cacbed053ba1813970443d5ae8bf56db22f5daf7878978b6da99364e9f5b
        • MD5 SHA1 SHA512 TLSH

        AdHttpLib.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\odis.bs.win\AdHttpLib.dll
        • Size 17.8MB
        • SHA256 9e6b1be5d5659016441d904eddef3c51e45c8ee5a61c86c4d0a8414e463d38bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AdpSDKCore.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\odis.bs.win\AdpSDKCore.dll
        • Size 1009KB
        • SHA256 132f82ab141fd6bfa600b72fc01a0c59dd04c1d3ba9ce462ab6fc6c500582ded
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DeviceSettingsProvider.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\odis.bs.win\DeviceSettingsProvider.dll
        • Size 10.0MB
        • SHA256 a91807ac33c524d476fbeaaef2e4048c49de6636f2ab05235e6f5d63fef5aec4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MSVCP140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\odis.bs.win\MSVCP140.dll
        • Size 612KB
        • SHA256 bdf1d095d1419e9ce49e774590ee092b1b673ca259c0126f21afe595b3e661eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\odis.bs.win\VCRUNTIME140.dll
        • Size 83KB
        • SHA256 0164b1bfdcedb07295eae14fa5dca88b46862bc91ec2d317ef8559bbec8128ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\odis.bs.win\vcruntime140_1.dll
        • Size 35KB
        • SHA256 54a38117f402f43d4e819642f6e74c048666e840037a3c1c0944bc8bb941d69c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wxbase331u_vc_x64_custom.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\odis.bs.wx\wxbase331u_vc_x64_custom.dll
        • Size 3.2MB
        • SHA256 000a5f9b788294852e764e52156f7646729d9e87f1c9b75be3e57c7828719e96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wxmsw331u_core_vc_x64_custom.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\odis.bs.wx\wxmsw331u_core_vc_x64_custom.dll
        • Size 10.1MB
        • SHA256 9696175fd303290aa5fa7bf3bc2d2f60bdc79c7018053658b96c6ff5ce1e216c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        strings.xml

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\ODIS\strings.xml
        • Size 22KB
        • SHA256 ae652e226f0d983d0445178dcf8152265426460cabd6cfe49f7d5d9966c24a9b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Setup.exe

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\Setup.exe
        • Size 23.3MB
        • SHA256 add11ecedc80266de63a54ed9678e736c96c752c35e9271b42e28de995914786
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ad.logconfig

        • Path C:\Users\Admin\AppData\Local\Temp\7z9167D6E8\SetupRes\ad.logconfig
        • Size 1KB
        • SHA256 768e351a487ff277f0f06f1af2dbfc0d2ad83d2ce6aa97b9389f6e67e2bc329a
        • MD5 SHA1 SHA512 TLSH

        Installer.exe

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\Installer.exe
        • Size 38.7MB
        • SHA256 c07443352cf77ade6bcf599f597115bf83a98be77b184b27d6efcdb334af7606
        • MD5 SHA1 SHA512 SSDEEP TLSH

        add.logconfig

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\add.logconfig
        • Size 1KB
        • SHA256 9f281c744795a97d33b60db10fc12c0955b8456402205a01b38132b183c06448
        • MD5 SHA1 SHA512 TLSH

        collection.xsd

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\collection.xsd
        • Size 32KB
        • SHA256 31859ddd3b4751d104298d90a230034620ccbd769412a2ee6b5bcfa600e527a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        feature.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\feature.json
        • Size 5KB
        • SHA256 555de1814d080679e73fb3bf83d240c96c48a385a85924028f015b02242e3f02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        autodesk-logo-svg.svg

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\icons\autodesk-logo-svg.svg
        • Size 2KB
        • SHA256 b2004d3118b81aadff650496724efd1e69db4362277466ed185f62e76703770d
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\cs-CZ\strings.json
        • Size 2KB
        • SHA256 12850d7fe98fc0e4c59147d1f74014f48d4e717c4fc2ce3999ea36960456ddea
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\de-DE\strings.json
        • Size 2KB
        • SHA256 4acfcf5e8ba57014e81033bf6cbd25c2583e235458d6908f0a8b4c2f87d2102c
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\en-GB\strings.json
        • Size 1KB
        • SHA256 ead77fa131bc24dba22c4ae2e80303f75ece4e6e6f1934a6ffee206c20fea79c
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\en-US\strings.json
        • Size 1KB
        • SHA256 6ab7f41d697f196d4808d917169f38ac77ea8218b683b6b021c4717ebc3beacc
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\es-ES\strings.json
        • Size 2KB
        • SHA256 b4d9562c63d3d6fb4b13d13cf9855300cd5827f895f5c4a535933352fe54ed6f
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\fr-FR\strings.json
        • Size 2KB
        • SHA256 d3113682e9cba0030c4749be0de42225e2efbe26bd929fdf1f9c3597cd675ef8
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\hu-HU\strings.json
        • Size 2KB
        • SHA256 bf8cafe78f34be49c79ec763bce229f4669d6c7bad63c375301cb626cabd7db4
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\it-IT\strings.json
        • Size 2KB
        • SHA256 1c18478ee14c00797b31d3a08e916d4b4a185c95efab8430744d67df35a5069b
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\ja-JP\strings.json
        • Size 2KB
        • SHA256 c7eb48d78b58f9791f1c2e97f71a84db79a749feda30a3b02d06cdfc8ada6dab
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\ko-KR\strings.json
        • Size 2KB
        • SHA256 ff03dd577a170ad916ec02b545b46b1cffe377fd9e0a54a7def2602d88c85ca8
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\pl-PL\strings.json
        • Size 2KB
        • SHA256 9d7fb0bf4ad534ba64fdf299777c8cf9b35e7403ce42143fe998c5da4bbcbc84
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\pt-BR\strings.json
        • Size 2KB
        • SHA256 214e94a88d401e26e0d3073eb20dc6fcbf49b735fadef57d65246a0ba8406751
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\pt-PT\strings.json
        • Size 2KB
        • SHA256 acde0364382b98ae3d24930cfc2f5b7d24633e01f257b21ef91740a035a2b209
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\ru-RU\strings.json
        • Size 2KB
        • SHA256 03920742fe8dd3bd8af750d6d89924d105655adce6878fcd1d16cfd4a8924cc0
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\zh-CN\strings.json
        • Size 1KB
        • SHA256 f8dbf55393396a76bac1776511cf2a42234584ac7a30f773d47584147a7c0685
        • MD5 SHA1 SHA512 TLSH

        strings.json

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\SetupRes\locale\zh-TW\strings.json
        • Size 1KB
        • SHA256 a289f1936598d58e5dd47c3ab3b69167661c4d8a1b1c58d08d762cbdc5fb94dc
        • MD5 SHA1 SHA512 TLSH

        AdHttpLib.dll

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\Setup\AdHttpLib.dll
        • Size 12.3MB
        • SHA256 5481c46aa6a9ca53846ee4ec87d043210269b4872fe8d6a529016b6092fb8018
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AdpSDKCore.dll

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\Setup\AdpSDKCore.dll
        • Size 1.0MB
        • SHA256 07f64e4ef4a1beb75e80f4637c8b57e6d8351c981da9a893f0619493e539fc86
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AdskAccessDialogUtility.exe

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\Setup\AdskAccessDialogUtility.exe
        • Size 9.6MB
        • SHA256 402af531b170c6f1413049d01c3839c25cb66ac103346b77da7fe5ce580a85b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AdskUninstallHelper.exe

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\Setup\AdskUninstallHelper.exe
        • Size 9.3MB
        • SHA256 8c09f7474ff9ce74b93c35a44673f4909f7ed12ff739ab1219c59c10357782e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        upiconfig.xml

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\Setup\CER\upiconfig.xml
        • Size 986B
        • SHA256 b0d2e22589d12484dc4c50af1c427c40fc88ccf124659a6f3d7208c1c1126f4f
        • MD5 SHA1 SHA512 TLSH

        DeviceSettingsProvider.dll

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\Setup\DeviceSettingsProvider.dll
        • Size 5.3MB
        • SHA256 bb1df60c31c7a8389f1e952a7435fc3187e678930b49e494e5636eb81ab5b49f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InstallerSDK.dll

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\Setup\InstallerSDK.dll
        • Size 7.2MB
        • SHA256 a0e208645855bda6e30d6c0121bf361305002fa864051206cdfdd5a2e177983c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LogAnalyzer.exe

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\Setup\LogAnalyzer.exe
        • Size 2.5MB
        • SHA256 77f93f8877eca2fb40c3e3e28134edca819365844398960c397a7b6767aed520
        • MD5 SHA1 SHA512 SSDEEP TLSH

        adp_wrapper.dll

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\Setup\adp_wrapper.dll
        • Size 11.6MB
        • SHA256 4e80d753ef2de44c5457ec84d0c4a3feabeffd0ed73c5ba0f1aaa160d22b6b53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        condition_evaluator.dll

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\Setup\condition_evaluator.dll
        • Size 9.6MB
        • SHA256 40414e26fd60cfc1f0a8466284c9629e84ad4899e9710ef4544bbd86368a74a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        deployment.dll

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\Setup\deployment.dll
        • Size 12.6MB
        • SHA256 630e282c4252c4cf64018cef68f9dcec406ddf353943aaaf6c059d67b3c7b0f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        log4cplusU.dll

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\17253327722272441006\Setup\log4cplusU.dll
        • Size 1.4MB
        • SHA256 fac8233ed2137380b9529de1c14c858022f01d691b841fbdad7a06e09ca1b647
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoCAD_2026_Simplified_Chinese_zh-CN_setup.dat

        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\8431316646431521735\AutoCAD_2026_Simplified_Chinese_zh-CN_setup.dat
        • Size 95B
        • SHA256 f1af18248e2f23046e4e9b978f52716139ff615bfc3bd56c04adf3d729a5b295
        • MD5 SHA1 SHA512 TLSH

        upi_deviceid2

        • Path C:\Users\Admin\AppData\Local\Temp\upi_deviceid2
        • Size 194B
        • SHA256 b7bc535dc1fbe60a2b703ddc44a0ca4fb09ab855aaad0d129f3959a8dfb7e3ca
        • MD5 SHA1 SHA512 TLSH

        upi_info.xml

        • Path C:\Users\Admin\AppData\Local\Temp\upi_info.xml
        • Size 400B
        • SHA256 d45ab0ae5ec31cf3b6ec2965c265dfea321a6b10117ed70024cd9a165e645a74
        • MD5 SHA1 SHA512 TLSH