7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
149s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260814-gepdbsdn31
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
1372	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2784	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4492	powershell.exe
1504	powershell.exe
5052	powershell.exe
5640	powershell.exe
2328	powershell.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2156	cmd.exe
3160	cmd.exe
5792	cmd.exe
2652	cmd.exe
948	cmd.exe
3252	cmd.exe
3464	cmd.exe
4316	cmd.exe
2620	cmd.exe
3328	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV\Compile.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV\Defaults.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV\MicrosoftDataEdm.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV\14fjaNbUP.3z:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV\MicrosoftDataEdm.csproj.user:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4492	powershell.exe
4492	powershell.exe
1504	powershell.exe
1504	powershell.exe
5052	powershell.exe
5052	powershell.exe
5052	powershell.exe
5640	powershell.exe
5640	powershell.exe
5640	powershell.exe
2328	powershell.exe
2328	powershell.exe
2328	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeIncreaseQuotaPrivilege	4492	powershell.exe
Token: SeSecurityPrivilege	4492	powershell.exe
Token: SeTakeOwnershipPrivilege	4492	powershell.exe
Token: SeLoadDriverPrivilege	4492	powershell.exe
Token: SeSystemProfilePrivilege	4492	powershell.exe
Token: SeSystemtimePrivilege	4492	powershell.exe
Token: SeProfSingleProcessPrivilege	4492	powershell.exe
Token: SeIncBasePriorityPrivilege	4492	powershell.exe
Token: SeCreatePagefilePrivilege	4492	powershell.exe
Token: SeBackupPrivilege	4492	powershell.exe
Token: SeRestorePrivilege	4492	powershell.exe
Token: SeShutdownPrivilege	4492	powershell.exe
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeSystemEnvironmentPrivilege	4492	powershell.exe
Token: SeRemoteShutdownPrivilege	4492	powershell.exe
Token: SeUndockPrivilege	4492	powershell.exe
Token: SeManageVolumePrivilege	4492	powershell.exe
Token: 33	4492	powershell.exe
Token: 34	4492	powershell.exe
Token: 35	4492	powershell.exe
Token: 36	4492	powershell.exe
Token: SeIncreaseQuotaPrivilege	4492	powershell.exe
Token: SeSecurityPrivilege	4492	powershell.exe
Token: SeTakeOwnershipPrivilege	4492	powershell.exe
Token: SeLoadDriverPrivilege	4492	powershell.exe
Token: SeSystemProfilePrivilege	4492	powershell.exe
Token: SeSystemtimePrivilege	4492	powershell.exe
Token: SeProfSingleProcessPrivilege	4492	powershell.exe
Token: SeIncBasePriorityPrivilege	4492	powershell.exe
Token: SeCreatePagefilePrivilege	4492	powershell.exe
Token: SeBackupPrivilege	4492	powershell.exe
Token: SeRestorePrivilege	4492	powershell.exe
Token: SeShutdownPrivilege	4492	powershell.exe
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeSystemEnvironmentPrivilege	4492	powershell.exe
Token: SeRemoteShutdownPrivilege	4492	powershell.exe
Token: SeUndockPrivilege	4492	powershell.exe
Token: SeManageVolumePrivilege	4492	powershell.exe
Token: 33	4492	powershell.exe
Token: 34	4492	powershell.exe
Token: 35	4492	powershell.exe
Token: 36	4492	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeIncreaseQuotaPrivilege	1504	powershell.exe
Token: SeSecurityPrivilege	1504	powershell.exe
Token: SeTakeOwnershipPrivilege	1504	powershell.exe
Token: SeLoadDriverPrivilege	1504	powershell.exe
Token: SeSystemProfilePrivilege	1504	powershell.exe
Token: SeSystemtimePrivilege	1504	powershell.exe
Token: SeProfSingleProcessPrivilege	1504	powershell.exe
Token: SeIncBasePriorityPrivilege	1504	powershell.exe
Token: SeCreatePagefilePrivilege	1504	powershell.exe
Token: SeBackupPrivilege	1504	powershell.exe
Token: SeRestorePrivilege	1504	powershell.exe
Token: SeShutdownPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeSystemEnvironmentPrivilege	1504	powershell.exe
Token: SeRemoteShutdownPrivilege	1504	powershell.exe
Token: SeUndockPrivilege	1504	powershell.exe
Token: SeManageVolumePrivilege	1504	powershell.exe
Token: 33	1504	powershell.exe
Token: 34	1504	powershell.exe
Token: 35	1504	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4624	Setup.exe
4624	Setup.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 3464	4624	Setup.exe	89
PID 4624 wrote to memory of 4316	4624	Setup.exe	91
PID 4624 wrote to memory of 2620	4624	Setup.exe	93
PID 4624 wrote to memory of 2652	4624	Setup.exe	95
PID 2652 wrote to memory of 4492	2652	cmd.exe	97
PID 4624 wrote to memory of 3328	4624	Setup.exe	99
PID 3328 wrote to memory of 1504	3328	cmd.exe	101
PID 4624 wrote to memory of 948	4624	Setup.exe	102
PID 948 wrote to memory of 5052	948	cmd.exe	104
PID 4624 wrote to memory of 2156	4624	Setup.exe	105
PID 2156 wrote to memory of 5640	2156	cmd.exe	107
PID 4624 wrote to memory of 3160	4624	Setup.exe	108
PID 3160 wrote to memory of 2328	3160	cmd.exe	110
PID 4624 wrote to memory of 1372	4624	Setup.exe	111
PID 1372 wrote to memory of 5128	1372	forfiles.exe	112
PID 5128 wrote to memory of 4304	5128	cmd.exe	114
PID 5128 wrote to memory of 3432	5128	cmd.exe	115
PID 5128 wrote to memory of 5792	5128	cmd.exe	116
PID 5792 wrote to memory of 1664	5792	cmd.exe	117
PID 5792 wrote to memory of 4948	5792	cmd.exe	118
PID 5128 wrote to memory of 616	5128	cmd.exe	119
PID 616 wrote to memory of 3252	616	conhost.exe	120
PID 3252 wrote to memory of 4976	3252	cmd.exe	121
PID 3252 wrote to memory of 2784	3252	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:3464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2328
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV /m 14fjaNbUP.3z /c "cmd /c ren @file 14fjaNbUP.bat && call 14fjaNbUP.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "14fjaNbUP.3z" 14fjaNbUP.bat && call 14fjaNbUP.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5128
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4304
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:3432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5792
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
        5⤵
        
        PID:1664
    - - C:\Windows\system32\find.exe
        
        find "CurrentBuildNumber"
        5⤵
        
        PID:4948
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV\14fjaNbUP.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:616
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV\14fjaNbUP.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3252
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4976
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV\MicrosoftDataEdm.csproj" /nologo /v:q /nodereuse:false /noconlog
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 52c3278fd60a3fa44f4491584a21a403090cfe12204f9e4b7f45f40e7d10f9b3
MD5 ebebd4ee9e273954a351a240d6b7a5d3
SHA1 87dfcd8ea5bc34269e6b2b325ba1e3b4f1ea5f97
SHA512 dd00237be24baaae5556304bd9b26d35a4ab8adbd884f8f4cb25f92697aa4a63aa55d0ede1ecc8b56f1646047402a714a378ea47644e45a9a4ca14d78fdec405
TLSH
T17B318637F3DC8611CC9A003A10CDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 78e35f54b333958e4f55662eccfe0744d9aed423f1b7a047644c90aa80879a1f
MD5 a3d6b178bd6f0dfeed34cd460e3f6d0a
SHA1 42c11f0aa02464f1defa0dba40af05877e0f7cee
SHA512 b8f77a279006a1fb9cb391b1293459aa421bd8c668138e0b5315a247606e597c754b70e74b9b0436faecc1400cb468059cc2d89766faf13746891f7d85cc6ea7
TLSH
T175219833F3DC8214DC99403A10DDAC1036B6C7CB40DECF9B6B81E259A42F299DF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 616a5f0ae7f26ba24b505902798ba7993f9f5543c8f3dfb81be80ecbcaef4ec6
MD5 9c8151f48eda1b86ce03be72915b3a75
SHA1 b6a7b7d3eb3e63cc1116d848e1985e7337afa996
SHA512 42d9d5d8752032e6064561529e01c73cab1ade4d5ad6f86b6deee9fefae55a734f741437b75920a270033828f2d68850180af88379f246e3c4d0caaf1a28e7c4
TLSH
T1BF219833F3DC8624CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F299DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f916075ccf4073a18383b78278ce7314465bfca8b1a3e536e423e33a8f791c16
MD5 5d498fa4aa3c42d31dbff1bb5838ffad
SHA1 551cff960c3dc385c3ee185c2024fb03d47d8d78
SHA512 75c96b82a7a49feeceb1869e5f972192257f95290dd65dd9c92d6132175ad077b7d9305f35061bf2748cb7069e5ce40fa7e152befbaa5800e0180c416ffb9dc6
TLSH
T15D219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xgornkra.xep.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xgornkra.xep.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1786686408.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1786686408.tmp
Size 1KB
SHA256 4503aa6c22a42505cf244c736d468657907418547f5d6f53643a603aae285610
MD5 09b1eeb3edc9d402772fac3cad83a383
SHA1 ae5737d7cd70c831ac02f068fc8c2f5eb203b95f
SHA512 4ff2952b3bccbeaa7fb1599bfa0e6242b47563ec5feebd66d4b4ed9ee157ada2c33c9351e2dc2b21ec92177dd0365b599cc00424fab2ed21c42c65ede633014b
TLSH
T112310A26805B2B70F23896096DB037BB9432FDDB16C357204ADAC102F13BB7E9142B0D
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Local\Temp\data\saves\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

14fjaNbUP.3z

Path C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV\14fjaNbUP.3z
Size 1KB
SHA256 6d39d15db02f94774eace5202f20ebdba51f1187cc7ed51d38a04d78dd0ecd17
MD5 ab79c6d87a67e6af18f87d50172bbbc4
SHA1 b77379ace22fecc64e434cd437f94a9df94f396a
SHA512 090665e9f66a282f589c52f2ba4447a778537453f8b1b92ac3f53e14d7f793e2bea1118be8aef36be5c21e52520fdbfca5f02e2544948a6ae5bb5d8bb4e06472
TLSH
T12B31BD96B115044DC4F1B27B53B18233234DA2C33884F5BC70C4DDA8749F2AFB6A51E8
MD5 SHA1 SHA512 TLSH

Submit Download

Compile.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV\Compile.targets
Size 591KB
SHA256 6420666fc92a590f46f02295981ffb4e018f1de9f0fb0032495d78e43466ed14
MD5 c5443b6763d1454274ec41e9beae5b56
SHA1 3b59039c9ce520b468c179b166b1d43d5e97d272
SHA512 4a8b7f57fc80ad14ba59b6bd4f9a79fa9d02f47730d7835721cddbce71162d8184f0b3660030cb3b73a63b5fdebfaaa2bffe18fd3d5b7e9cdde58f0948658e08
SSDEEP 1536:YK2IwFXzv2gfEsDaTHWKVuYcTqC4B/ZCKXofYjhObs31mKS4jgN8l8ZGW9HISQuw:SPOV2WbYIn3WDdW4my+2I/cTZ0eeNZX
TLSH
T10ED4AC6C96CB94B5F9AF811175AC3D551432328B97CA3EA087BCE100D6E6FCA3E494CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Defaults.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV\Defaults.props
Size 322KB
SHA256 18e6585292814d1a1fedbdf2eafc40e56e17a745f600abb52e344829604d20d2
MD5 6ed76507fc57d0a68db031e7f3a420ee
SHA1 ac9e3f4ddf6aa68c0d3995441fcfed3af1d5c0ec
SHA512 84ce421130b8e0d6cf6d6ca8f10397125162eceea4b5c0e67874a9ff0aad6d0ff6c5101ea2197bacb660757968ba7557981b785092c13dfefa70cd36f5538212
SSDEEP 1536:Y85pkDDdT+JSp1RhgpWD5KXZgiXw8Fwt3RybtuEdeVbVROjrltLiQobtIvI+1Y3i:k0gZVt3ex+VMRZAQ6Z48CVA4R6K
TLSH
T12364657896DF54A1F69BC8102DECBE71417335CBDBD62E50036CA8214BECEA73E09949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftDataEdm.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV\MicrosoftDataEdm.csproj
Size 9.3MB
SHA256 110f64f50d12422d68123caf6aeb1086aaa72d6eb9f1ba09d14ef58a445dcab8
MD5 c00d507a1555e04ef7a82ba592c67182
SHA1 73f6bf0a3d663e6bfc94e10f191a6ec31cc4c1b1
SHA512 06744aca86f7ad06093e0ba6cc5c2cdbe6aa56238b76a5b715114948c5b1f19fb3e722ef2a7337d98f23113e0d2d180bdf7e4f4543684d731f85f670c8a33c67
SSDEEP 1536:XMt1zDHfiqofYZGbvonRu+2fBJVfW9hOtXujgUEKKJGE5GBZwDkJ1ompE/dJ/4A6:S
TLSH
T1B4A6BD7B078047BAF3D447C4849B215E26F5E516BA252059F7732AEFBC2A9DB8078703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftDataEdm.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV\MicrosoftDataEdm.csproj.user
Size 409KB
SHA256 74b42c417ca4fedefdc8591a72c0a455b2301f0617bb520f8dac440a8a6d5cd5
MD5 c6aca857edb7e1c1277c66948df919d6
SHA1 8753c636fb5d97ebd9897c5b20e3958a786dc598
SHA512 69750d54256469639544b98f2fa25928363a37ebe77a24f0c016a6cafbb2eb6fc1dd657a28a9088c4f608d0a49d30e8b716558f1bb549f6b2bee55e64b5923c5
SSDEEP 6144:UVCZxlRaLn6gyZekO56TXL5h979JxfySDCvbaGBQIVgnif74JaUEUMxD1wq7KmWq:QQTgT
TLSH
T17294B4F498EE20B5F297D90025BCBD6481F270C7AFDA355423AEE2568FE97663B4004D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftDataEdm.csproj.user:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-41711-a8S3i0E2acKV\MicrosoftDataEdm.csproj.user:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

memory/1504-286-0x000001C872FD0000-0x000001C873082000-memory.dmp

Download

memory/2784-343-0x00000000029E0000-0x00000000029FA000-memory.dmp

Download

memory/2784-327-0x00000000002B0000-0x00000000002F0000-memory.dmp

Download

memory/2784-351-0x0000000008AA0000-0x0000000008DB4000-memory.dmp

Download

memory/2784-350-0x00000000089F0000-0x0000000008A9A000-memory.dmp

Download

memory/2784-345-0x0000000004E00000-0x0000000004E30000-memory.dmp

Download

memory/2784-344-0x0000000004EE0000-0x000000000503A000-memory.dmp

Download

memory/4492-273-0x000001D923790000-0x000001D9237AE000-memory.dmp

Download

memory/4492-260-0x00007FFB1166F000-0x00007FFB11670000-memory.dmp

Download

memory/4492-270-0x00007FFB114E0000-0x00007FFB11E84000-memory.dmp

Download

memory/4492-269-0x00007FFB114E0000-0x00007FFB11E84000-memory.dmp

Download

memory/4492-268-0x00007FFB114E0000-0x00007FFB11E84000-memory.dmp

Download

memory/4492-280-0x00007FFB114E0000-0x00007FFB11E84000-memory.dmp

Download

memory/4492-267-0x00007FFB114E0000-0x00007FFB11E84000-memory.dmp

Download

memory/4492-274-0x000001D923A10000-0x000001D923AC2000-memory.dmp

Download

memory/4492-275-0x000001D9237B0000-0x000001D9237BA000-memory.dmp

Download

memory/4492-277-0x000001D923C20000-0x000001D923C44000-memory.dmp

Download

memory/4492-266-0x00007FFB114E0000-0x00007FFB11E84000-memory.dmp

Download

memory/4492-265-0x00007FFB114E0000-0x00007FFB11E84000-memory.dmp

Download

memory/4492-263-0x000001D923700000-0x000001D923722000-memory.dmp

Download

memory/4492-264-0x00007FFB114E0000-0x00007FFB11E84000-memory.dmp

Download

memory/4492-276-0x000001D923C20000-0x000001D923C4A000-memory.dmp

Download

memory/4492-279-0x00007FFB114E0000-0x00007FFB11E84000-memory.dmp

Download