4176402bd2aa92c5e68395be75c13d2872b058118554e0b6bf4d76c7de4d2499

Analysis

user interaction
yes
max time kernel
281s
max time network
383s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VisualStudioSetup.exe
Size 5.4MB
Sample260822-ce9baazfqa
SHA256 4176402bd2aa92c5e68395be75c13d2872b058118554e0b6bf4d76c7de4d2499
MD5 cc248b120c3c31784f3c83de3e5c69e8
SHA1 1fe8cc896aae1ba0968fdee1c8428ba2f278a369
SHA512 84a7c6fd45fdd1e1a9c595ac6f8f1cdcf4424f4d8304613130e0e892ee0d5305a25e6adb03da89dcc9279c4db4164dd80bc4c501a23060a6d9ece4052b61bacd
SSDEEP 98304:sn+nyIx2RqWZIb76FHlEmMXTtOJHAXqcF70tUFLR4zrWetA3bkV+i/wmVh+Z3pMH:sn4nx2Rqdb7SH+3B4SCYLR4zrWkAgsI4
TLSH
T194463372B7ED40B7D133107313B48AD6622BA5651F15ABCB63912AAFEEB41C23037D16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence privilege_escalation spyware trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
480	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
199	discord.com
200	discord.com
202	discord.com
203	discord.com

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Assets\Installer.70x70.scale-100.png	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\System.Runtime.CompilerServices.Unsafe.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Microsoft.VisualStudio.Setup.ToastNotification.exe	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\PrecheckTools\Microsoft.VisualStudio.Setup.TestPowerShell.ps1	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\pl\Microsoft.VisualStudio.ExtensionsExplorer.UI.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\pl\Microsoft.VisualStudio.ScriptedHost.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\pt-BR\Microsoft.VisualStudio.Validation.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\ru\Microsoft.VisualStudio.ExtensionEngineContract.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\arm64\vcruntime140.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\Microsoft.Diagnostics.Tracing.TraceEvent.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\es\Microsoft.VisualStudio.Composition.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\pl\Microsoft.VisualStudio.Setup.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\cs\Microsoft.ServiceHub.Client.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\pl\Microsoft.ServiceHub.Client.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\pt-BR\Microsoft.VisualStudio.ExtensionEngine.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\pt-BR\Microsoft.VisualStudio.Shell.Framework.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\msalruntime_x86.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\pl\Microsoft.VisualStudio.Composition.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\pt-BR\Microsoft.VisualStudio.Setup.Download.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VSIXConfigurationUpdater.exe	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\fr\Microsoft.VisualStudio.Composition.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\Microsoft.VisualStudio.CoreUtility.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\Microsoft.VisualStudio.RemoteControl.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Telemetry.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Newtonsoft.Json.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\System.Composition.Hosting.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\System.IO.Pipelines.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\zh-Hans\Microsoft.Internal.VisualStudio.UserNotifications.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\ru\Microsoft.ServiceHub.Framework.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\it\Microsoft.VisualStudio.ExtensionEngineContract.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\pl\Microsoft.VisualStudio.Setup.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\zh-Hant\Microsoft.VisualStudio.Setup.InstallerResources.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\ko\Microsoft.VisualStudio.ExtensionEngine.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\feedback.exe	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\es\Microsoft.VisualStudio.Services.Gallery.WebApi.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\it\Microsoft.VisualStudio.Threading.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\zh-Hans\Microsoft.VisualStudio.Shell.Framework.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\zh-Hans\Microsoft.VisualStudio.Utilities.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\amd64\msvcp140.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\ja\Microsoft.ServiceHub.Framework.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.Xaml.Behaviors.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\es\Microsoft.VisualStudio.Threading.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\fr\Microsoft.TeamFoundation.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\Microsoft.Bcl.HashCode.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\Microsoft.VisualStudio.Telemetry.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\pl\Microsoft.VisualStudio.Services.WebApi.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Assets\Installer.150x150.scale-100.png	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\amd64\KernelTraceControl.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\cs\Microsoft.VisualStudio.Services.WebApi.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\it\Microsoft.ServiceHub.Resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.Bcl.AsyncInterfaces.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\pl\Microsoft.ServiceHub.Framework.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\SharpVectors.Core.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\ru\Microsoft.VisualStudio.ExtensionsExplorer.UI.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\ja\Microsoft.VisualStudio.Setup.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\fr\Microsoft.Data.SqlClient.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\tr\Microsoft.VisualStudio.Services.Gallery.WebApi.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\VSIXInstaller.exe.lce	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\zh-Hans\Microsoft.Data.SqlClient.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Microsoft.VisualStudio.Setup.ToastNotification.exe.config	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\de\Microsoft.VisualStudio.Setup.InstallerResources.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\MessagePack.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\pt-BR\Microsoft.TeamFoundation.Common.resources.dll	vs_setup_bootstrapper.exe

Executes dropped EXE 5 IoCs

pid	Process
3088	vs_setup_bootstrapper.exe
3404	setup.exe
5916	vs_installer.windows.exe
4660	VSInstallerElevationService.exe
3008	setup.exe

Loads dropped DLL 23 IoCs

pid	Process
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vs_setup_bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	getmac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	vs_setup_bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VisualStudioSetup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1752	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vs_setup_bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vs_setup_bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vs_setup_bootstrapper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	setup.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\ProxyStub\\x86\\Microsoft.VisualStudio.Setup.ProxyStub.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32\ThreadingModel = "Both"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ = "IVsSetupShutdown"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\ProxyStub\\x64\\Microsoft.VisualStudio.Setup.ProxyStub.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ = "IVsSetupShutdown"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\NumMethods	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ProxyStubClsid32\ = "{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\NumMethods	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ProxyStubClsid32\ = "{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\NumMethods\ = "4"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\NumMethods\ = "4"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32\ThreadingModel = "Both"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}	setup.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D30F05F637E605239C0070D1EA9860D434AC2A94	vs_setup_bootstrapper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D30F05F637E605239C0070D1EA9860D434AC2A94\Blob = 030000000100000014000000d30f05f637e605239c0070d1ea9860d434ac2a941400000001000000140000001e82df0ed78cb3d70234830edaabad65b9afb8ec6b0000000100000020000000fe229efc927f6d77b738896752a21803a59736baa17bf5be9a50c72e219cbcd20f0000000100000030000000c64ce3455898f871d11c14da412aac58fa2022d4213d8ac05f8dd6909b2fb0fcc76c19a1913df5bc0cb1662229ad15d1190000000100000010000000928311586be0737592bb924f9fee51645c0000000100000004000000001000001800000001000000100000003c70faea25600ce3b2cc5f0b222ed6292000000001000000c1060000308206bd308204a5a0030201020213330000001c489f81dfa1b0b77700000000001c300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3234303830383231333632335a170d3335303632333232303430315a305f310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3130302e060355040313274d6963726f736f66742057696e646f777320436f6465205369676e696e6720504341203230323430820222300d06092a864886f70d01010105000382020f003082020a02820201009a7d6b7d27c1762a2eaee3d534ffcc2b6deefc54f820a3fbb06489f4bf07681728653b395f525d12463f5c85b39a7a8e9b188b8718cc5e7a015d001269848d5f304f696f3d4e4184ddf0577d07a983c86048f93f75977f49170fd7ef8d47f5180b5712b889f30ec02cd695126f51b3878f03466c6076826d4e640542500d7bfbea169f39c420745080dc8df362d7f35f6bcec31f3bb8339a0aec8a39166287d737cd37fe4cb0b94182f28553019c35c41c33abbdac3dd834b222aa5d8115a9b9fcea0c5cb57a05639285d985bfbda59f61794ccd5d35e13a85f37b187a63300be1f9415a6f81735850c8449e9c4bc12739d5fb6e6ede1efb8e380c518e38f965d0e2ef6a75d0defd4e5278068a46fbe26e68b8cfb411a4bbd9b256b408f88e506cf4d03a39b1f902d04c25b12cdf337fbc03daecc8554e8160d53f3b7df0e24fd84a1a10eabc184f460a83768bbff80b6142c1f7f505209325664ed5672bd8cb5e244e94c4657e8a103c9cde7560f283d9d606a1ec2b5ef4730bfd47a14792be565fd267fd18712dbef91b255451a3a3c17f499de6df3b55bd6633f7c8a757b2a726b1997920a5c070bb296c3aada4495389e7004fa1a12cb0991e31c2a712ebaefbe50a7431e54b40edb188cdd109ceb9cbd3752b1dbe1cca3928c91775d5aabf5fd82f78e4b5d3e6bc4a20750810305c35853a04a0c31faadfa4a38e0928a50203010001a382014630820142300e0603551d0f0101ff040403020186301006092b06010401823715010403020100301d0603551d0e041604141e82df0ed78cb3d70234830edaabad65b9afb8ec301906092b0601040182371402040c1e0a00530075006200430041300f0603551d130101ff040530030101ff301f0603551d23041830168014d5f656cb8fe8a25c6268d13d94905bd7ce9a18c430560603551d1f044f304d304ba049a0478645687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f4365724175745f323031302d30362d32332e63726c305a06082b06010505070101044e304c304a06082b06010505073002863e687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f4365724175745f323031302d30362d32332e637274300d06092a864886f70d01010c05000382020100435ff8df3fbbe9948c3b5cf5bb68039d9105cd1754348131004cab1bb9ea15c7070b9cb545acd5706a0c33081421eef5ce98fd417e4cdf042208e7ba30292989873f87f810cdc04529a5ceba45e68cce271d01039154bf58e6a5d7ffd996eaa6f0b1971bff1b54782a3ad29a6a8f1f3b3a8a0c376fb4536e3ec1c484bc7ce224c18590841d9f2e3960fb71d2ac318f1488692095956a630847b6bbd8e1a89e375fe39aeca70a881eeca7654e1abf2f6bb81fd18616f09be7cc6fc04c79c21a4e6928871fc4659e4635670dea84d85b71b604cdc1dd8ce75a497db78b213fad1f32e7beda4b1d1c659213c1154dd4a6194763d23ad4738ea5195149212177fccc5cc6794d78fd4a872afe6734f812db3f23b9ae7e968b9cb6a5ccc476cc8ba118e0165acc1eb1b8ed173915505803476496f74dc8d172a56cf100eaaf1ea47189f6ba3187ce67b0429c04d530e12729ebc282a92a4505a2a2c95d6c91dfa5f14e7458d78f31bf41cf3d0e7c049a97cbf9b101be0d6d3590df88f9129421b339239d30263887ca6405343b1ba1b171f48f799821043d4edf519dd54ff1ce5156e4997ee5b480bf79002ee463bc7eef9c7844ccc9bbdba3150ce1d60d0be3f3a285317e60b40ee291c01db56d7f7e69cb88064c489b811ddced7dc3554ba00ed434e52e27bcfa350d96ffeabb7277ce3e5d9054be2a96009b9544f6be6429965577	vs_setup_bootstrapper.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe
3088	vs_setup_bootstrapper.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3088	vs_setup_bootstrapper.exe
Token: SeDebugPrivilege	3404	setup.exe
Token: SeDebugPrivilege	3008	setup.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3404	setup.exe
3404	setup.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3088	2348	VisualStudioSetup.exe	89
PID 3088 wrote to memory of 2620	3088	vs_setup_bootstrapper.exe	90
PID 3088 wrote to memory of 3404	3088	vs_setup_bootstrapper.exe	95
PID 3404 wrote to memory of 5916	3404	setup.exe	96
PID 3404 wrote to memory of 3008	3404	setup.exe	100

C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe
"C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\AppData\Local\Temp"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\SysWOW64\getmac.exe
    "getmac"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2620
- - C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" /finalizeInstall install --in "C:\ProgramData\Microsoft\VisualStudio\Packages\_bootstrapper\vs_setup_bootstrapper_202608220301105635.json" --locale en-US --activityId "32b3428f-7484-4e5d-801c-552614ea3206" --campaign "2500:ce7311496e924099aed87e6cfce5fab6" --pipe "b5ea400c-6aec-4a9a-a279-804a092adfab"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe
      "C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe" /finalizeinstall 6F320B93-EE3C-4826-85E0-ADF79F8D4C61 "Visual Studio Installer" "Microsoft Visual Studio Installer" 4.9.50.62957 0 "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"
      4⤵
      Executes dropped EXE
      PID:5916
  - - C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" elevate --activityId 32b3428f-7484-4e5d-801c-552614ea3206 --campaign 2500:ce7311496e924099aed87e6cfce5fab6 --handle 917728 --locale en-US --pid 3404 --pipeName e39998a66aff428e9167b16a78858dba --serializedSession "{\"TelemetryLevel\":null,\"IsOptedIn\":true,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":\"f144292e-e3b2-4011-ac90-20e5c03fbce5\",\"AsimovInstrumentationKey\":\"AIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\",\"CollectorApiKey\":\"f3e86b4023cc43f0be495508d51f588a-f70d0e59-0fb0-4473-9f19-b4024cc340be-7296\",\"AppId\":1000,\"UserId\":\"f2a96e1a-1b1b-4dc8-aa6c-07aea2207202\",\"Id\":\"23a2e538-6688-4110-ade7-a4feb0c8bac6\",\"ProcessStartTime\":639229608919135323,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[{\"AdditionalProperties\":[],\"Id\":\"a02930d9-c607-41c3-8698-0fd9196735a5\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.setup.*\",null,null,null,null,null,null,null]},{\"AdditionalProperties\":[],\"Id\":\"64a13603-6d89-42e4-a299-13f77e5ad306\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.willow.*\",null,null,null,null,null,null,null]}],\"BucketFiltersToAddDumpsToFaults\":[]}"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3008
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoLogo -NoProfile -Noninteractive -File "C:\Program Files (x86)\Microsoft Visual Studio\Installer\PrecheckTools\Microsoft.VisualStudio.Setup.TestPowerShell.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:480
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" queue pause
        5⤵
        
        PID:920
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" queue pause
        5⤵
        
        PID:708

C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe
"C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe"
1⤵
- Executes dropped EXE
PID:4660

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5520
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5F9E2FB9BFE79D15FBF63BD8197B6FB2
  2⤵
  PID:2796

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe
"C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe"
1⤵
PID:5404

C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" resume --installPath "C:\Program Files\Microsoft Visual Studio\18\Community" --runOnce --installSessionId c9a71b5a-1f62-4c4d-9cf1-40528fbc7474
1⤵
PID:2180
- C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" resume --installPath "C:\Program Files\Microsoft Visual Studio\18\Community" --installSessionId c9a71b5a-1f62-4c4d-9cf1-40528fbc7474
  2⤵
  PID:6032

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004E8
1⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc77a5c188,0x7ffc77a5c194,0x7ffc77a5c1a0
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,3544768374718786967,8213456913919923615,262144 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,7620220079466183664,3154701992534381513,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2756,i,10325478751365840799,9026364961437118171,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,3086189067093818668,16322161546153078203,2097152 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,8277356024225232582,15734403130221155441,2097152 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,3653716463963486438,7270711805042819643,2097152 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,1043387028847007655,6439253173163305238,2097152 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:9
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,1856015282324486269,8143213616994181689,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,9337612483103040681,411937931657558707,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:14
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3944,i,2934527393943680464,13783331217290793579,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:14
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,15920288221367582990,15305955065688975468,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,15920288221367582990,15305955065688975468,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,838345427268935338,5018218338995467581,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,7659697776435599700,6435843054866273951,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,13442340143123781394,13690049009394272135,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:6436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6628,i,3914806885161946053,13692514709702180946,2097152 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:1
  2⤵
  PID:6548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5220,i,2906510653443061842,6517456369034783668,2097152 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,5976883297102900300,12696044661132791521,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:12
  2⤵
  PID:6668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,16793773098872834678,17931475249721893089,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,814861503602578732,2701096938592097975,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,16243114714984543583,760657034469054774,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,15898742510276795234,8225224177482061390,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:6452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,7401727757809262292,2288618168142745126,524288 --field-trial-handle=2184,i,940834066152032347,17003252963907075349,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:6420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:8020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5dc960.rbs

Path C:\Config.Msi\e5dc960.rbs
Size 888B
SHA256 baaa724a482a231a7248171c9edcb62698c7d2c4bc7fac6bdfd3951e37bc20ee
MD5 59ac0bb7d9024e6dcab9f55c74b995a8
SHA1 d098ea3f8e86bf35b5b649b17dcb73f0ed2b392a
SHA512 f88f1a0ef4a14461e80ca5228c06cec7d71c52127dcc60465993e6c84691ad9ea2b67934b83c9f634de049597f82f39185e15363fc65aaad006421f44af3a8c1
TLSH
T16711264F8B4AAAD2C18A8634EE530F017777C1B4C3714756194D93745E837D88FAD685
MD5 SHA1 SHA512 TLSH

Submit Download

msalruntime_x86.dll

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\msalruntime_x86.dll
Size 2.4MB
SHA256 522a28a0f14ab13ca177957e4f4db0201879960d43cc6594e3f54dc60ca4ca2a
MD5 d5b31869fbb789651ca4b126654a7f8a
SHA1 820850aa9fa7cd70d7daabc9ba55ae5f6d8cdace
SHA512 8c458913b3697225d36d76fd4224d8112184afee2ee17cd0f7db52e901a1f533901c754f504297d25e771a006593d43c434250fa37b720b5b8ef175c0035a9d8
SSDEEP 49152:jzriYZlmIzijxFz17NBqFgUZwn//P2taZxeDkD3S2gL6jCV5LyDH3pt04Le:jcvRqFgUO//utaWDkD3o
TLSH
T149C54BA375054122F5FF1173595E8FA9C62C85320FA056C3A2D4EB29FA350C32A76BDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommandLine.dll

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\CommandLine.dll
Size 221KB
SHA256 8c01437b13eb375c7a798adce26c90a56a760311e27d6c322c5c87a6400e1259
MD5 6f1672a8495eb1f9655b051decebe69c
SHA1 91d13fdb2b594011f2f58138c3e11e7460ea437c
SHA512 5bc9fee72a09282227a4a285e708965a29621e7b7fb342320f6faa69298d974869097fba8beec8e3b4660df7d3aed6c27a917b44b4b6e03da6689d3f19064b97
SSDEEP 3072:0o5LAk8+YfkQRqP9RhBh1uirTB+3Lr/guqCwtipIllWf1/IFacBC4:0o5Mk8XfkQRqP9RhduirT+OXllCwk
TLSH
T183245E54639D0327D6FF2B72E470219F87F4E962B891EBDE6589B8F30DD23829840359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Markdig.Wpf.dll

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Markdig.Wpf.dll
Size 43KB
SHA256 a1716dbb31bfa99465f760ebb3ecd5958b3fa9fb192fc4041bf46e1c1d4e17e1
MD5 949dcf7ec479da00a95732ec7b1e2d9d
SHA1 4587f7418bd6fbf03bd4a82917c8b71b0c65923f
SHA512 d26e9f3adfe0d276c4b52a33103545b974e5a5bb865d44267fbe0670c73d3407434567ca085c829a060e766a1adc8cb838c16a571ed64f40c1af8548f34ed5af
SSDEEP 768:uo5LV5SlI+9YvUTDv7uZylXv6NtBdLqJTyKT9zuQ:uo5LVv+9pWyJv6NHOyK5zuQ
TLSH
T104134BC0EEADC119EAFE1570E8B2DE5634B2ABC91601D95F0D8164FF1C67B824211FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Imaging.Interop.14.0.DesignTime.dll

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Imaging.Interop.14.0.DesignTime.dll
Size 21KB
SHA256 21e9388960143eab0323b9b56443b6c47439973b1682653c37e0e50217e3bb08
MD5 b340a021abaa327244b5f02542bd1def
SHA1 c4471b8c3bf60ed300ebce0bd843f017d205ad5c
SHA512 1970ebe87910d0b7759cae3139bdb78b73e04b3c5a8a22ede42b772e1dc73bffa05d82a5684aba1b90fa265e30e510806bc5e782117ddd620612625c0a6b2d64
SSDEEP 384:8rnvcezWjkWY6F0GftpBj3RS/yc4HRN75ulMY:BeMz+iJRS6Ba
TLSH
T1C2A22996CB7C9643ED935E3066A9CA433C3DE3C35920961A116AE1A81CD37C4EB1876E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Imaging.dll

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Imaging.dll
Size 536KB
SHA256 7efefc9326536b95b74cf7d4dd1014c4928d6937aadfb28e4b76c8c44a9a554e
MD5 83e105b9aa14de29a797de7c4ce9693f
SHA1 51064762644b315ae4a49d11966b580e8ce1ffbe
SHA512 971f429be419a77815773af7ac9ab0350a532cc7ecdf17b6bdc354e885f9d92b17a53f90ec3452287f0f5e854ec6da280eaef0aa43c01da616576a47964172b1
SSDEEP 6144:7qDWQguW04TR00QIyn9PzPuhn+7bWzcJMEnaRSUICI2IKvQWInRm5tuplXlsdVIu:sWQN4Tit9b0kbgyplXnkgbS
TLSH
T131C49202EF9C9F25C49E5B35BC7B0B0507B9E69199119B0F306DE06C4ED73821EE639A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Setup.InstallerResources.dll

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Setup.InstallerResources.dll
Size 173KB
SHA256 3f57dffab7a7c49cd68b92b63c00bdea646cd33a7da0169fad7483f697b6cbec
MD5 a031c76a357ad1beedb112f26aca191d
SHA1 688eb324ee1c1c6c0643d359441b24ab14926e4a
SHA512 af0884d772fb0f3a3aca5f3dab3f82dd831964b3ee3f30781350bc1ba725d477798267484338d997178f2373b55959a1df277981a8df295acfc8278a2c0caf9f
SSDEEP 3072:1sXsKq3bkrM4TTA9coUGSoz+iXgjTZUfxsK:1sXzvjNU2
TLSH
T155044D817BFA112DF5F72F35BF7960A0893EBE661D03C02F5960654E05B2684C9A2B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Threading.dll

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Threading.dll
Size 615KB
SHA256 cfd5ba53d6bd1ddc97ef568335c500a0dd2e8b1e584aa78e3c8f373f3db1bf26
MD5 7d28bc45137c1c98b14ebc54dbac0e94
SHA1 4ac3a86e298742ae5bd900bfb51e35d2baa08e8e
SHA512 a009821e041503314d3431cb6e995507b6e75f2b87405ce6153767e71e47d60dafa75086d45bfc62236df4ad6cd6024406e3c051d0c1e3cdd099bf15d0b7de70
SSDEEP 12288:XX1fI82FNrzXv87iadZ8mPgPPHVEFS9cuYz:HWT8tdWmPgHVEFGYz
TLSH
T1C4D41612F76E4FBBC519467AB476030613B9C54D930273BF568CB9A83CA6F448F902E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Utilities.dll

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Utilities.dll
Size 1.4MB
SHA256 993a6f4ca8f65dd93cc2ddf0c76f1524cc20edb2785f7a9d5930993855c9f906
MD5 443a49fef9485b90d4b3535b94edb8fd
SHA1 2e779331b65ad48a7c7494979dd98a2255f89257
SHA512 19ac91c2324d72b3301bacede38984a2c2fc3e9e6137e6fa37116b4b3416b6d6495e305b3799a7a45307776f0ea61eb9ecfe8eb70b9fced1976c4222d167b931
SSDEEP 12288:cCvgHKbV7xhNoeC9B4KYEGrPXzZv5R3tpQFhg87NFqJUbvlXSpJUta:CHk9drPXzZRxvuCGAIU
TLSH
T1C865D486FFECCBB5C16E8B3AAD730346477DC68E6519570F1228E4AC6C9F3551E80298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Validation.dll

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Validation.dll
Size 44KB
SHA256 c71a29348790ad1b51c7056c5c395dd572ee31135677dc0e30e15154f43e4282
MD5 58a5584b56a4c27cce45bef54c2ca4fa
SHA1 b0d99c75f61ac663405008b3a6be3c1b29127da4
SHA512 c8f48c6a0c129ce66c77cdcdb6fff8e68abe84ca5b561d2227596593bffcddcf705bcc8422a27788022677eeaa8a11463aa4702805015222490ad83249fe774c
SSDEEP 768:fk3RpQ282STUE/uO3pfvIyRoO+pxS45w+VM1a9aORMTDqHV9zfc:M3AD7Iu+p84O+VM1a9aOeXqHnz0
TLSH
T1DB134D2253EC4353CBAB2AB0F9B0A4530B36E3CA3512D72B64C8D5992E07F857761766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Newtonsoft.Json.dll
Size 714KB
SHA256 4137c4b9f687d907338e3b01aa7fba3a060acad452454c8c1b6fd7187ccbb6fd
MD5 c6ba74371eaeda93b6633fd3009f8d07
SHA1 e84ba5b6c250cd68e0d9790f4638a8fe733da41f
SHA512 c06de54ccef0a78155d233194d95b7d78ba046329375d996b03af4a6b99b64c090116c54c1130063b3fdb2c2c74e7425d0e1b91fa3352f1a0c2207b1cb7d8c2a
SSDEEP 12288:n5RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qT:5m2VuaOKdKSUNz0IpBXyov8fC2
TLSH
T11EF45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Imaging.resources.dll

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\en\Microsoft.VisualStudio.Imaging.resources.dll
Size 33KB
SHA256 6a0631dd4d368d4d6bdd546248bda26a14b7292fd6b88cf163555bb670d2e6aa
MD5 774615d15815526e75b482d6b82074da
SHA1 ff70144475107c420adc612f98fbcceb9348400b
SHA512 e17ee370a3e7c522e805bc8b5e48f895878a61491dbefdd9988aef9c3f021e41bc9d913087a43fe4b23bab2da057453cc5f36377db4ba5b98e28633a7cbbf60b
SSDEEP 384:iLQYIb/hVal8Qi90Pl8Qi9pl8Qi9Nge1gDdiSVy0dVVC2xjiwjpPZhWDmNW0LHRQ:+QYI7hy1rq+1whdnr9p1LyG7Yl9zF
TLSH
T1A6E20614BBB54486FAB30F32287898456D3EB6D31B71CB9D9008611C9A37782DB357B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
Size 3.0MB
SHA256 1585adca958b1eb585003f1b134a98820fc1d8cb85642ee940e4b505652e3ee8
MD5 db705de78c002e978b3087a812199fc4
SHA1 572aa5a0800e45c5855e22fca8aa4d33e31aec19
SHA512 82dcdd8b13aa48892586275b3c74f49f6089bac2ce6d65e5495d27102d4a8b1e5d58cd992869ee10a6c61a720529b2724a2c6d54d2b6a50bb45dbc21e63e148d
SSDEEP 24576:SHcn0eO1X3WKSPqVjXZ5gH/+uVt73kKIY2VLsYIDqEZS/T03VIdMt2s/lr9D7nDx:SHc2WKSPqRgrp2VLCRl7drdff5
TLSH
T119E57C04E76C0F33C56B5B3A2439453046B9AA4B6372DB7D3A8E386DBD43B05CE16693
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.config

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe.config
Size 11KB
SHA256 59e15809a178ad6f32935462180d0e4e1399ae380433c53269c3c4448a65089b
MD5 ec6d45642bd1f5771ef1101a73a47dbd
SHA1 d5e93c8e086379d7c27678c6939bfbcfe2927012
SHA512 dd7be33267cd32e8af1030232553a60d657548c248cce70ba62b86fc75dfab7086b9b26b200a6e5b95f9e8dd7b48502d5f83a1327c8249ea687c7efe88ea9ae5
SSDEEP 96:hrTRUEkVc44hj4U4ae4ve4p4cu4L4T4s/idhomG5EhG6SjGRjGMjqf3j6m7kKjjv:hrTKmW55EcvaRaM2fNddf/fD
TLSH
T174326C20D1C8ABE98F7155E23D6B6428CB6D03B7298D019D70FE6E4B8F35E96520B077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vs_installer.version.json

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.version.json
Size 119B
SHA256 6b737a39c5f3f65d7a0e0d1bb029b8eeaf3c9bb884ffd6c7fad7ba8f87570579
MD5 31c39e5e6db23823403ada34fd53fc49
SHA1 7132d46eb7572b59aafa0a8b8dd79429f16a63b3
SHA512 0408cac4da89552d16a7ba32b00ca19b72db04a49f7eedd4d2a0b9dab3d58ca6c1ed6b9a4900b588af99432b841826216e33f7771ad1aabdefa2e69422434829
TLSH
T1E8B0920620AA10231CE14B2F041AC8F4AF2A0A0F1249982808067AB5C3A34F82E02BC2
MD5 SHA1 SHA512 TLSH

Submit Download

congrats_tutorial.png

Path C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Editor\congrats_tutorial.png
Size 14KB
SHA256 c6033d0f8a531e212ff65b4558b652f25afa309b39eec8d5ad99b0e5fee63507
MD5 8efdaffbf407c5ae11914ecc954f6e8c
SHA1 e28e6746b22cb56526d207c4c314d2762dda506a
SHA512 f1da670c1149043873c0bfc0098c33f974ff1131e4ca502b360f6908863fd4717ebc944b9ddcb87f719858c90b4b59226c924526b47e628bfc4ced6560166cea
SSDEEP 384:tJ2c+DZaey0638tlAOcHkPzoeMMiTslxM4yl:32b5636lAOzoelZlhC
TLSH
T1E362D08E40D64EE4142A38BA14B3239EB5E5D32E4FFFDC1C39105E4892EE52B5D19868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Welcome.Python.Run.StopDebugging.png

Path C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Welcome.Python\Welcome.Python.Run.StopDebugging.png
Size 608B
SHA256 d0e80bce5156459548b965dcc651515d247e5ff3ef6590c3e2ece7853947b5d8
MD5 99d44b5a0fd8c60bb3c4ea826042034b
SHA1 762eef5c36b386004f520236e09a76b0f2042583
SHA512 08cd7bac9e35a783582d8e46963809357aa6f32deccbc53cec5b4a930be036881f6cd2e631c9ef75c8580c76b073069b1216ae3aacfc38112a6d5c394a0edf31
TLSH
T181F002CD57558824B1D9C073855C365825E3285A101B260F3D45C9BAB99CBCD49921D3
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.Python.Run.png

Path C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Welcome.Python\Welcome.Python.Run.png
Size 23KB
SHA256 822ca512a32744427d3d0d307a0eff7fa3b1e27c8f84b9af5c4a00865ee53a51
MD5 527539837e09fd6e8f3461b5a5356aae
SHA1 4e795a202c5196093f6ebe8ff57ce266faad3f03
SHA512 e3a2363fb0c80bf66f65c7aa9c37009f0fe8218bece77d9736bd62d72af87d67aff53d8d4b7c39d228839082a3eeb74b34195d4b6f98aeb43cf7bc8fe709ac0e
SSDEEP 384:PdkZ7Lk0PNPxwwACNy3aWMTyCs9e0rY+Uz1S084MllmwkjQ/oq2xo5gMOyx2NTUp:1sNPxwwACNyKyCsQsG/8ZllPkjQQndAp
TLSH
T1DFB2D0DED986CCD1A5697AC6E2CEB1CCB9C124F9908D12E0DA1228513F9BD1F0C12BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.groups.json.temp

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.groups.json.temp
Size 149B
SHA256 9aa27811cd663e9b4e81edce1a1b10bebc9a8470f3c7ca95bd9d7a7070d9555f
MD5 f1232688ccf34152a0bf11cb573cbc14
SHA1 85cb0a17c1b413e85979cdcea628143d17621590
SHA512 1afde2c1a815465d43acdd2df2244e3cff24a0bb41f0ef68cb80fafd87ddbe4bfc7d931e6350b30a285b50516189dd603dcaab7940484054425e99bbf53e6a40
TLSH
T1BDC02B14866DCA637F62F05CC3041C8A7FD17B8187E48422DBC4712EC08130DC5AD896
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.json
Size 14KB
SHA256 f940dfecedeead27d830321954b1ae98d56e75f9817265e0a0a02ef0d6722da2
MD5 1980710d3837961fd94943ddb7bd14b7
SHA1 30708a96f5c2fd2cabb625fb8220d69611af9c7a
SHA512 9ac0a60dec74693e004fa1daeec24db900fe7bbb9858db7911df2fddc01f5004c6a0e1131ba269478dd0e103b42a3699236c0991a3018d8e01fdcfaaff77b648
SSDEEP 192:CLc9NPWKOkvhOFG9VtFYBVuyVL1Z+KSioqVsu:CCWH8OgjY6yljxSXq2u
TLSH
T12C62035581504E3DE75452971EDB9CC4E5AC339EF1E97CF88489C82402B8BE4D22BEAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.ngen.json

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.ngen.json
Size 8KB
SHA256 67dd18c7371bf444ab7b4f0bd238dc2f8e695131a84d441b0e5b08a94bf6bede
MD5 b7112032f8a6d1d89c0bfb42f4cbc172
SHA1 a51674f7f5650fbfe4d3ede1fe31be25f957c1c1
SHA512 5d14a63cf472ce5657f6471492c5b68b471918ef7026846c195fa42bb147fadc29f956d24d33311e53d8fcadbd139be8dd907e7d61bd2b96e0ba7c3dd07ad91a
SSDEEP 96:o+Y+c+VJ5zXbP+IbMhbd5abrN+gxH5ZF528g5r15T+SHL6HwbS815WJS5Ub+M5/1:p4JRsJiW
TLSH
T14802EB766E4CCF57EF222199ECAB3ECE5EDAB3624BA06C7400173424C5C4D6E45BA247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.ngen.json

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.ngen.json
Size 4KB
SHA256 6c66156aa9c753e6607c294d3fd226ce7b323b8086a1d0a51b276423636a7b3b
MD5 0c385b6d0b6dfec7109fc1af845d1591
SHA1 6f8f303981612f20dcd328bf9c859644a479c83b
SHA512 40fc2ce30d5d0b0bf0201ae93a3bca76e7943e6653cb383f0227d7cd767835525d069c29d0de66cfa0fb151e0b4a64f37a422e307a7fc7c3692a78f9e6de71b2
SSDEEP 96:oWbrbMh5zCH5ZF528g5r15TL6Hw815WJS5Ub+M5/F5+bC5K5Hbc7L5d545O1H57q:5QmIW
TLSH
T1C8B1D7322E88CF57DF226589DDAF3DCF5ADAB36147906C34001B7818C4C4D6E46B6217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.ngen.json.temp

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.ngen.json.temp
Size 10KB
SHA256 d4ba04c12a27920368beaa3233104fe7f9fece45236e3674057888f405362482
MD5 46e1304fceb3b5d9afef6d43288c9664
SHA1 1835c26d9cb5b0186b6828527316a802cb2fe27a
SHA512 be0d0b01fb51650a593aa9c80b9b94c15f582ca32bd7697b324ed4ec16967a8ee19a3f607fc4d0fac7e4b17df6f0cc44ff74329740c81e8e029547b0bde00e80
SSDEEP 96:o+Y+c+VJ5zXbP+IbMhbd5aubrN+gxH5ZF9Po528g5r15TH+SHL6HXwbS815WJS5+:0As56VMysyKW
TLSH
T1B732EA766E9CCE56EF222199ECAB3DCE5EDBB3624BA06C7400137424C9C4D3E45B6247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.ngen.json.temp

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.ngen.json.temp
Size 8KB
SHA256 add32fb70f2db4185d1c035ef426986ce291fe88c3e6794024c7a33555bf2c44
MD5 7938d2d01f3846c3d66aa5b75f0b434e
SHA1 a17bc301e35971370e095792bae655ba95c3a487
SHA512 deed97b43e6334cd9fc3610aba562146d842ab9cd7bd389d54d5fb6ccd55503b933d90189bc8e125df459d0ee6ac5b623a7ceede66405c812f5a54e3f9a03d06
SSDEEP 96:o+Y+c+VJ5zXbP+IbMhbd5abrN+gxH5ZF528g5r15T+SHL6HXwbS815WJS5Ub+M55:p45RsJuW
TLSH
T12012EB766E8CCF57EF222199ECAB3DCE5EDAB3624BA06C7400173424C5C4D6E45B6247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.ngen.json.temp

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.ngen.json.temp
Size 9KB
SHA256 93aa302241e8f97b4028e1227ce4bce31ea41678ac924d99e3350471c0a0a1d9
MD5 400e2c04a0f2c7d32751d622c4baf8b7
SHA1 e04f80f1106126d665122a05f1766d0c4e53b2a7
SHA512 cfd0d44339c74a2ef1d14c282571f263d53976ff955c03de79835773b3f9ba9d0fd5664a2c49af9c44e85e6da47a14c18cb2cfbf45dc91dfac6b520b4b97fefe
SSDEEP 96:o+Y+c+VJ5zXbP+IbMhbd5aubrN+gxH5ZF528g5r15T+SHL6HXwbS815WJS5U0b+8:m45lssPuW
TLSH
T15512DA766E8CCE57EF222199ECAB3DCE5ADBB3624BA06C7400173424C5C4D6E49B6247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.ngen.json.temp

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.ngen.json.temp
Size 7KB
SHA256 cd922c2c07f9b1e48f1bfb7e04a5c67b1509eab5e77ca4bdd3cec2c196d04295
MD5 c955278481ae795fbf44053659ac6e7c
SHA1 6bdb63caed611e3984eeeed0a9067a158152e2ff
SHA512 e0174a8f5364b41850e0e485a6e11d54add8dfe5d0d1327fc2ff72a1c54ed78fc4811aa555db6224f817ea56c30bc22cd22e3eb5c9b6cca97c4f35fe3a2550f6
SSDEEP 96:o+Y+c5zXbP+IbMhbdbr+gxH5ZF528g5r15T+SHL6HwbS815WJS5Ub+M5/F5+bC5Z:J4JGsnW
TLSH
T124F1EB726E48CF57EF222199ECAB3DCE5ADAF36247A06C7400173424C5C4E6E45BA247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.ngen.json.temp

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.ngen.json.temp
Size 8KB
SHA256 555111e9b5749a4a3dc83d764587828ebe81c2fae0fc59d809e6f076bd9299fe
MD5 9062cbb0b8b62302bed85ae5d28e1942
SHA1 efd9be5cb4db51af6fad0743d184bf07606c0c0b
SHA512 50be39fc43869764f50795b3fe9b74fc78d6854db0040a5cef3b6551422ae8ecc3ec046eaa275355f6848f32a501fc84c1eae4fd45845462580d5f18e5cd0be4
SSDEEP 96:o+Y+c5zXbP+IbMhbd5abr+gxH5ZF528g5r15T+SHL6HwbS815WJS5Ub+M5/F5+bx:W4JRsLW
TLSH
T11002EA726E4CCF57EF226199ECAB3DCE5ADAB36247A06C7400173424C5C4E6E45BA247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.ngen.json.temp

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.ngen.json.temp
Size 10KB
SHA256 dc2fe1628a9cae9c267fd7bb7dca8b985ceced66669a0653a6e0a9991377042d
MD5 1e128532465d223a186f08d504761980
SHA1 321bfdf517af658d9fd545da08f5dae8f04bfc21
SHA512 530b26022fac0391acf4a8d4ddd9f10299b3f675a4a6945903cdef341c08d41daacc805b3b2a3c8c92a1ed94d422aa3eee1cde499d896666400b39be3e7de27d
SSDEEP 96:o+Y+c+VJ5zXbP+IbMhbd5aubrN+gxH5ZFo528g5r15T+SHL6HXwbS815WJS5U0bI:V45PMysyzW
TLSH
T18D22E8766E8CCE57EF222099ECAB3ECE5EDBB3624BA06C7400177424C5C4D6E45B6247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.ngen.json.temp

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.ngen.json.temp
Size 6KB
SHA256 6de363548db5ae9966f964a8a60555750edcc5b7772c7f53b887f8430498904f
MD5 b3de20c2107252f0fbc85906585c20ea
SHA1 07dbb5689c371e0dc301643fdbf53499eb3169b4
SHA512 966c074e6ca6f460e98ea09e2ec183305b556cf510e3d121b7a1d4bbc15907969eaace555df6c73667c67645949f2e280f762f19f39bcf9cabd5b80f3cb82d8a
SSDEEP 96:oW+cbrbMh+g5zX+I+/H5ZF528g5r15T+SHL6Hw815WJS5Ub+M5/F5+bC5K+F5HbK:B4mh6W
TLSH
T182D1D8722E48CF57EF226199EDAF3DCE5EDAB36247906C7400173828C5C4E6E46B6247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.ngen.json.temp

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.ngen.json.temp
Size 8KB
SHA256 08615e67fadac083105298995378bad78b2e0c49f2d898ac4973541f8a66ff6d
MD5 dde3901b47ea214238bd323253c769a3
SHA1 345cbe1c6eaa0e6f7e5b6cd617b14d1a30f6ee6f
SHA512 bd59a0409ca3ecc17be6972e4ca7d04e2b89c4b6e553b81d9bf3ea18cfd7add464ed24dee619b7a0fbc892e89cf2762f4efc258504e64692fe2e83a6c402d658
SSDEEP 96:o+Y+c+VJ5zXbP+IbMhbd5abr+gxH5ZF528g5r15T+SHL6HwbS815WJS5Ub+M5/FQ:f4JRsLW
TLSH
T13302FA726E4CCF47EF222199ECAB3ECE5EDAB36247A06C7400173424C5C4E6E45BA247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.ngen.json.temp

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.ngen.json.temp
Size 6KB
SHA256 4cc812532a6a14f2d63c42a0721740f28cc144ec61cbd102a5bca46da5b9c1f4
MD5 fe95c10a82e4e67242669f29c6a521cf
SHA1 e59fdf29668459368cff454bd7e95de1e8ffd5db
SHA512 a36ce12beab7b0c83744c31facd3f08baa9c5d46ba61190f1d1ec141c33a480eaa9f102e95dcd2e3f3aca3c64a879b78373d6668bb075ceffb15f17c779e796a
SSDEEP 96:oW+cbrbMhbd+g5zX+I+/H5ZF528g5r15T+SHL6Hw815WJS5Ub+M5/F5+bC5K+F5H:V4mhDW
TLSH
T1E0E1D9722E48CF57EF226199EDAF3DCE5EDAB36247906C7400173828C5C4E6E46B6247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.ngen.json.temp

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.ngen.json.temp
Size 5KB
SHA256 96cdba857f9c00ea48c11b8cf1709a846f15ff0e0e18074a1f5c7c5e6611fbd2
MD5 6c05b6b84fdd9cba39e86fc1346f244d
SHA1 91ddfdee4f0b110407a233edfee3243ae9742855
SHA512 44aec8dfff79f1ac89a6fa8898733328095e19c028201e07ee8af7cb84c9e5fa35c79a4793ae37d881a7b4e88ef6a7b2a6658a6d3b13e9a3e341a55b4943c85c
SSDEEP 96:oWbrbMh5zCH5ZF528g5r15TL6Hw815WJS5Ub+M5/F5+bC5K5Hbc7L5dTF/P54TFR:5QmQfW
TLSH
T1D5B10A722E48CF57EF226589DDAF3DCF5ADAB36247906C3400177818C5C4E6E46B6217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f6050036a89e1275f78d63633ee4d3c99c47283b0c9861c6423bde5f12c73c33
MD5 ee3f57a51a5e0bc5daba502ab324bf39
SHA1 87d375fab29cc2e9b668aabb35d1bae05a14d588
SHA512 eb1288f2ddd6c9c7af2ad6ad064e68db8cda97785c237cb775b5ecc851e267f33d12b77f8701da1906e89f6ad2e8cb9ec982c9590fdab5b4ddb4985980986f05
SSDEEP 192:sxRuRdx4/fmsZ99t8bNcQUoA8pJv/g6+WNPHc/YlyiRGPIgVWJ:sxRu54/fmsZ99t8c4h/5E/wGk
TLSH
T12042C6566928A93B8CCBE21DFB15BB93D3F9503261D45E58EAFC861C04E76CD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1c1546f91a5c8f2a1a8421396bf57e62b138c1fa977c2b21fc7ade1f89c4d894
MD5 cb040d42af49e27e22da78056c7b6b6c
SHA1 9e6291699d8b4178d8ea09dddc4ea17a8328d7b5
SHA512 6da2feec8982ccf9f0a43333881d38343493dac276bffb3d9fabf0c7850f1d93c9f8fcba64636f2893a3ef80340a1c4cb458ec979765347a694507adebe7a72b
SSDEEP 192:sxRMRdx4/fmsR99t8bNcqb3a2oA8pJv/6U6+WNPHc/YlsZYiRGPIgDCWZ2a:sxRM54/fmsR99t8cEAh/ME/bGlr
TLSH
T14C62E7566924D87B8CC7E61DAE257F52D7F8103398915E5CAAFCC90C04EB6ED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 24e6c3aef4171feb26744bb5259d329aa9ac978dbd7fb03fc2c0f66c328a2c7e
MD5 c4d73ed6d44598b961e89e815fc27150
SHA1 218188e81fcd6532360d02f89d676dcb1b673f23
SHA512 26b863884cbc270f43f52dbccc68961d5521c5f493769d739d1e0c951e4c86f8e78e3e0785dca62079040437b892fd384a28771d094af101fddb979e7ee724f4
SSDEEP 384:sxRMK4/fmsR9Gt4feZEAZ/MjGl/ebzGLr:sQK4/fv9SBZz/MjoebzOr
TLSH
T10572D616692498778CCBE51DBE257F52D3FC102398925E5CAAFCC90C04EB2EE2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dbb12b7111d9bb4d05c8c2e3edbbee466ee5930ef9cabd260636fb143f409f0c
MD5 8aa3a49fe1dbd91fe61088501940b7e0
SHA1 4237063ac0159e03dce27bbc63dd072c013df8b4
SHA512 f4263aa9e4e7d93b1f0942f7d72a51bd8a4e30edb2cac205e7dafbe6ead3b12488e5144c294e7227b2f2febd95b3027d5635d1035edeaec56641766190434c3a
SSDEEP 192:sxRMRdC4/fmsR9Gt8bNGqb3a2oA8pJqQ/6U6+WNjuKu7qHc/eBKJO9ZMiRGPIgDz:sxRMK4/fmsR9Gt8GEAZ/MjGl/ebRGLr
TLSH
T10172D6566924987B8CCBE51DBE217F52D7F8103398915E5CAAFCC90C04EB6EE2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e1348c73d8b1224e025465f6223484f2160f7d1216462b7e67415e53cfa248cc
MD5 bcaea1c94f56b8dc1cd108a35e9e992c
SHA1 079f25eef7b87b7411964b6143d21a0871ca7517
SHA512 df476eef6dc14bb7b8aa032939177b56935154b149a02bc8520d3530eb53ace0727e2d91c8fb27d9f085a235eab653f1866c669fba8aef1af3645de5598f33fa
SSDEEP 384:sxRMD4/fmsR9Gt4feZEAZ/MjGl/ebdG4r:sQD4/fv9SBZz/Mjoebdnr
TLSH
T17572D756A924987B8CCBE51DBA257F52D3FC502398915F5CAAFCC90C04EB6ED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0801dbdbf69eea0a48bbb5fc3c92c7872c1c907b9b5dff240774770904bc79b7
MD5 e89a0011400cf877d10bc1379a82634a
SHA1 6a6e39c45804954386802ad663ffd9b195cdf2bb
SHA512 a71bf134ab3317e409322864006408ec6725eac55fc90441f2e6bdc791773bc973df8336aa592ab402840d266a6cadc0f7fcbaadbd100f8aff09c63d360fb1ac
SSDEEP 768:dofAEj7pLuL7AxWgg+fJJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVn131Fro6i:dofAEVE7AxWgg+fJJu1jaol1+6i
TLSH
T1CAC2EA3B640CCA7E4F804ADDEC19BA9B6D6802CB96D8C98047FE951C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dbc21efe-494b-4aef-aecf-6b4521d42992\index-dir\the-real-index
Size 360B
SHA256 6afe7ad647cab049a3494589b1566720fa31e56d717a39d5c610f90df6e47770
MD5 b6aa4ee4026611fd9a3ea8f4d0e78034
SHA1 b398a359932ad468a24c7ab5290a48510cb9f5c6
SHA512 8fc6aec116a038db6c1047725c7c3f0a4a83f669a0f1c1fe32739793d3abd000f24ece6b78f2f24c0c2e40cbdd4652dce5cf513c866c4e9535d84ebb534f8152
TLSH
T1BEE0EB4B9C92090BCA336C760633602F333B02FD2504AE0640FE041DA541A3C824120A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e6520.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dbc21efe-494b-4aef-aecf-6b4521d42992\index-dir\the-real-index~RFe5e6520.TMP
Size 360B
SHA256 e2b50dbbf3fe86d2c26d742181f38d155844c7bfa560d2a8aa944d2742482d49
MD5 ac9adda6e3cc35f6d80ab1ffbf295821
SHA1 84b9c87e0fda59fa6f6ba51d6c47f882d1edf234
SHA512 ecc6afe922763cc030911cd6142f0eac2c36a9e3a58c9b2ecea0c84c9e0f3df70684c89da6ea5bb132f506334eb64a5e31a4153c402f5754b38ebdfd41ddc880
TLSH
T13DE02BDB41916E56D93659351502512A333F08242505E61A10AED45E15617AC854560A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fc78bb28-bf64-4f27-a287-71b933260204\index-dir\the-real-index
Size 72B
SHA256 4ddbc4445e2f34528c0af4e29032dda623df6c8abf5c95bfc0cadf7a3a3f1235
MD5 578849aa7ae399c4584f3cc84baa18f0
SHA1 4a21aeb9ab4bb178d304f102e607945b68657a55
SHA512 4566a132bd70fcd510a57c920c5ea9ce036dc986a1bc2a2ac5f74dc4be0aaf4e20ac47b3aec3bdfb4aca97d0a4b7da81b175f924e674592ff27eeebcb5e3c54a
TLSH
T150A0021003D0C746D01211B35552C24232C0C85051163B1E70D10158CC508C0458100D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fc78bb28-bf64-4f27-a287-71b933260204\index-dir\the-real-index
Size 72B
SHA256 01b2ed0621e4d72f45777af1ed0e2b1237ef6dcd27d9f0365dc67bdfdf0a9f76
MD5 5cd180b330cece46f7da5b6832f44d3e
SHA1 08faa9ad962af547a6e41145ddc9c455978350d2
SHA512 b6551aea81f5928d0ce9940272e664e4786e502557f233916b1c5f238adbfb711861762e3944ee8fdd468bc10373572d7d79930adeb67fe27f78f0fbf62f605a
TLSH
T111A002190B860122F84212B02A9665A16710CDD0420153674593118CEC726498E4201D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f9204793eae21f427ae96becef4123057f593b1d351f9d4d6411b8bbcb33d986
MD5 8f6a7408f974167e74198c6952e7db58
SHA1 df1da7017ebb36c77d457fbd7887c74914103321
SHA512 5f49ea1620d8ecf595ce43899aa0f983feefcb5ac76bbcf120bb28adf220b56f9b1794f43794d2d240009221ab3d0956ab1ceee5a79142e43e7a7dc84f0bfa37
TLSH
T110A002229B4DB521C46D06B0206D5294B3504C9943A513716899A0E9AEE9BC551C9141
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ecc56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ecc56.TMP
Size 48B
SHA256 2580e44ce9878f3f7bdc9606807d2c0ec7f6199d343604c770847e61154c8493
MD5 c048091070e4ed4a2b79579435d04acd
SHA1 526e4ef555f81bea03dace154a209be4bd9ca27b
SHA512 8787ef8688a2e69658127ed4408ecefe20d30875a93231e8edeb63888ab463d3af76133b2c0e7913c879cd3222c9c89a4d9ae0557a553a11bf5b860034500181
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b5abe615cc4850f716b6e6917f066673ea5c26eda8ee16b35640ed209a412624
MD5 0ce5fce44f50ea55bbed62d6a866329c
SHA1 8c9051bc0e01921d4a56e9804b934581740bd878
SHA512 da0455ae4d0b73c33e9fa4a59041e37a630b49709755041247a5b8748a00f733ebaec44fcf9323b4155ad55ed506f41f08af8a368cae5a6a4f232464309f4514
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHGbqGAoouWYN1gmuK4bgUucumFExcgKh+2:CdqjXNn7Oj4XfV+gBkldQzLkHGbqGAoU
TLSH
T1D8B1232431BA06413C3E760C85F4DE9FE6C230613125A66B7BA805628F66E439EFCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4efbf4524d3f9604ec94444d83af99473e1c761dffb9cfc7650ffb9c5e74fe48
MD5 394248eac4f9ef29a25b3052add97c8d
SHA1 c008a79e4c11b26d9b7fe45ba41668d07312ad8c
SHA512 777dc1995318e612832878e354da2350fe15b822db61f3bfcf72ff06b5500005b242a68af9bacb73b7e23bdab70128ad1dde682c092e6f619dced8b688166c4f
SSDEEP 768:eh3ZMgWKvN5cFbhMNHXmTWTbc+HifBu+F:eh3ZM8reWn1CfBfF
TLSH
T1E3F2AE71DCA59A73ACFAD7C4A60BBA46AEF8016391D81984CDDD6B0D018759E0317C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 82d9e4e3657c7289ea4610b9d7a0827dd86bd87c4501af8e195ad06e99273eb0
MD5 4af77a9bee796618666ce2d0a2c3d739
SHA1 6e102bfe0b36c79fcc3dfbea62423e3e32b71236
SHA512 9e56700de92c479ed0d008112e27713af3fbd197dcb4977035b655e198ced473b2bf613b495d2585494b4733716a97ef0e114082dfc91c46ee00a100c0cb01c2
SSDEEP 384:njZcIR38NTxTjEtgq86OYfOCzRfY9bYb0mhqDgfKQPlLJQXmIkdP9IimIMWEfMbi:7R3AMgWjFiJbhQNHXmTWTbc+HifBu+F
TLSH
T174F2CF709CE59E73ADFADB84A60B6A46AFF8016391D81984CDCD6B0E018759D0317C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 4f507f5302a394228a3a081bcb76a029db57d7d16a1d6531d0b22785403b0f32
MD5 52ec97d75aa23061421a7143df753f86
SHA1 a5cfbb054dfacf619d51656f834a1126d4314330
SHA512 698a5471a984b1040e81cd132bf4cc4531732a24b10e45ea85525769331d69092ca7a026f4929ca1207241b6d25ee35dadce83579e6f37b8dc97086778faac30
SSDEEP 384:nEZcIR38NTsTjEtgq86OYfOCzRfY9bYb0mhqDgfKQPlLJQXmIkdP9IimIMWEfMbi:iR3pMgWjFiJbhQNHXmTWTbc+HifBu+F
TLSH
T1EAF2CF709CE59E739CFADB84A60B6A46AFF8016391D81994CDDD6B0E018759D0317C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5cab47014910fd0ffa4dc014119054b3fe732859af829eb9fa83e123afcfe8ea
MD5 5c7b4f9a70fb4ea8ea33d3278eef116d
SHA1 0334eed64ed29ba73a31833f33a280878f8c39f2
SHA512 67ad39bf4d6017ab406e6fc5126af847b4e90de194b7397597d3ff07b6622d65f83bd84477180927571a584507fd31761de93d60edcd8ae0c39add3f81411aa8
SSDEEP 768:Zrv+4UNbd23wMgWXFiJbhFNHXmTWTbc+HiFQ:Zbsbo3wMRyeWn1CFQ
TLSH
T10103BF31ECA99A77ADFA9B84B10B7A477FF8015395C80A98CDC93B4D018749D131BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 86b6bd39e198fadb38efc369d48dd11492371b1dc9f604c50d9604f480565b5f
MD5 c605979adeac735036b2e3a05a93d07a
SHA1 2a60cbd2294be98f40f1ed74a3a89818d9c6d546
SHA512 5128e81a54cbc87333456192e97a5de7f0892d53da0dc2e4c3d4f688606dc5814a33f1f2fc9f8e7cbdb3c96be4838fe5e91254ffd9f9c57cde217aaaf9a51161
SSDEEP 384:n5ZcIhR38NTQTjEtgq86OcUKOCzRfY9bYb0mhqDgfpQPlLJQXmIkdP9IimIMWEfF:Rb3ZMgWp5FiJbhnNHXmTWTbc+HifBu+F
TLSH
T102F2BE709CE99E739CFADB84A60B6A46AFF8016391D81994CDDDAB0E018759D0317C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b75405ff71a5b9c7a12c8685590fec5c788df1e07bfdf911b107762df27953e1
MD5 d68daba2224e971f1799716c5a666cb5
SHA1 faa994d312eeb9959c17bfe1f7e8b1bc5a95c5b8
SHA512 0f8652ba1180c6df4862d4e5ab3c38159b870bdd4be1e6e3d09d07f6ac6f412b15c469916056e61e571edc2cdba9d85d67c7a0b816f809b83af20c21c49338a1
SSDEEP 768:arv+4UNbdM35QEiJbh3NHXmTWTbc+//eVH1SvyZ:absb+3VIeWn13EH1dZ
TLSH
T1E103BF319CA98F37ADF65788718BBA573EF9016399C406C4C9C96B4E428B48D170BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 57da0ba891373d1c6cff060c1fb00cebb0c44ff930a982303ebdb5050d84fcd9
MD5 d1528dfe3c1c611c90c51ee8d35df74e
SHA1 c1b41253c54de33ee292f1df86daff630edb44f5
SHA512 b7a8370914446e6f75f187afe723b8bbbe35252d5df28ac2072ba5aa7830a04b7876e08f0e402ae0789b60263ff7349b5d7a7a209744acbb255db2b73ceddecc
SSDEEP 768:Frv+4UNbd23wMgWEFiJbhFNHXmTWTbc+HiFQ:Fbsbo3wM+yeWn1CFQ
TLSH
T1E303BF31ECA99A77ADFA9A84B10B7A477FF8015395C40A98CDC93B4D018B49D131BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3d314dccc1badc00a084d5d21d694d8f434e3ed73e964148e9bbb1f93e949637
MD5 f76bf52b70a065b4245dc27e8f2c9d69
SHA1 fd9b30a2ea405ddf26705463cf3ef3a4b7bda3b9
SHA512 4412429dc216d6961d8910b2f5369624b65096b17e363401ceb6f0e9857a144fdf0f12038c5e103d09413d58935bd0528a4c3139f50c144e0cdf2ded164af093
SSDEEP 768:Vrv+4UNbdM32dXiJbhFNHXmTWTbc+eieVH1SvyZ:Vbsb+3YyeWn19EH1dZ
TLSH
T19D03BF719CA99A37AEF69B84B44BBA077FF9015395C40A94CDC92B4E028748D030BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f91d5824-28ea-471d-a624-d0842d24d6a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f91d5824-28ea-471d-a624-d0842d24d6a4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

20260822020142_431e8928d6fe4056b1af3bb7a62d5a00.trn

Path C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20260822020142_431e8928d6fe4056b1af3bb7a62d5a00.trn
Size 10KB
SHA256 6fc5c27a4bbd665e3e4aa18ef09cc80de27fc993808d8b1d4c64e72a36654830
MD5 99c1aa355873d50887366fbfe1fff3c0
SHA1 cc2ad6f29a01316e190d8e0fba44ec658afaa94d
SHA512 a5d6f5703feed8d7da772022da76db4e4fb1830ff343f7cf9f0f7a2a3205ce7d65aaa8194c216de73347c99b5bdfb1dc0cadda0163690e9e7cf28a953ab2bcbd
SSDEEP 192:qEpqPMMtYf4CLqo4UM8YG8bcvj0NHVurZH9mY5DycpzS:q+kWf4MqxnzbthVurZH9m4DtpO
TLSH
T14B22BF74FD9F6D838086389884E6F3786CB441DFB5469C7B8507E59C64133470296BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20260822020149_4d515bda66694d88be69fafa0571597e.trn

Path C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20260822020149_4d515bda66694d88be69fafa0571597e.trn
Size 2KB
SHA256 0c248a2402e2b08c7929f1303b5e611f85f7a136a0fb2b2dd4cbb5ef1b31c7e5
MD5 feea5af295073a2e2db0a989a037d14f
SHA1 f8187f9f6e6a6b62a5bc2b67a3a2c91bbb2bbd57
SHA512 f70d7911f23c65a33bf5a9f3e7874f0ac60ea73aed4f4ba44a858c5a8bc8b9f4351703d2393a470dfad0d1afaebf8ea8633b3c1071e51baea4b953fc995675b2
TLSH
T11E516AE27C6AD4D40B01CFFC572ACB2CDA531D2DF800F2C9846911F28D9EB964E38960
MD5 SHA1 SHA512 TLSH

Submit Download

20260822020210_223a129e843a413a9fb7b355b598ea51.trn

Path C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20260822020210_223a129e843a413a9fb7b355b598ea51.trn
Size 18KB
SHA256 68507da025991775435e53842b2c0acdd193354475979265e50806139f6ed1f0
MD5 7c0872f0887843a1d6430b53bc363abf
SHA1 6640f43b163b024fc0ba6f36515199152d078c2f
SHA512 74f10b7cfeec8e8717bc1f6da72ece8c402b945cfb086c255d4903f0f93ba29e31ac5c233da28767bb5cfeccbd48e127df7e48af286d0e14263aa15c9e891262
SSDEEP 384:6fJD/M/pBwHiiB1iufslMrTYbpHqWTWyR+KM/IwTtgb:Ik/pcWp6UXBBeOb
TLSH
T15B92E0203E90C44A2E5C6BF977435AAABD3B5E5D0ADDB974C2008B88220B3555DBA09C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20260822020540_6cffb03e858747d7a3b52612508ca773.trn

Path C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20260822020540_6cffb03e858747d7a3b52612508ca773.trn
Size 4KB
SHA256 156e09b5c411f6f369caf2ca75a5cfc456d2d6f0c9426cf7eb7e3282332c84b2
MD5 2917ee2aaa6080cf268b9aaa58fff55a
SHA1 6c407b39d23c3291ee8c783321db875590b08e5b
SHA512 c924389e7b10e1a447e4bbef14ef5580453354f33cf2faba2246a9ce4154dddb5032b255b7b4ee8bd3cac2db2fe2cc77804bb1b2ff8cd878474a6e000755a4cd
SSDEEP 96:iNM7R2EeOBiV9oojFBMYmMViHGkyyU5HKHH4go4IeVPkO:r7AEfMV3FBMJUiHlyyqHI4FeVcO
TLSH
T12FA1AF4218D6CE381298F77D77549A194C823665C51B52034F37F2193613E9DE97BE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20260822020610_070f95629bfe407fa86976935d090906.trn

Path C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20260822020610_070f95629bfe407fa86976935d090906.trn
Size 2KB
SHA256 8bc94bf70cf70bb24e1ae9e68abd6f272320bfc99cef885a3dab7b7e153dc5c8
MD5 af66876b8e59bff846b5ef1387172ca9
SHA1 5f0161cf97b406e3b5f1e57496e6f588a809682b
SHA512 19a2a3c90a6b81e7455f854750d09a2b0f3e69586ef72837184ae298d3930845d409a1c4f838fdbf2fad605c532484fea593f2e9bbbd1ad63a00f335c2331a36
TLSH
T1C3516C343C5F638059CE7172590954E504AFD9CDB05C7A43E3E26F05ECBA342E224299
MD5 SHA1 SHA512 TLSH

Submit Download

.updateUri

Path C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\Packages\_ChannelFeeds\F4D08EA8\.updateUri
Size 26B
SHA256 f4d08ea820b816e2822bdd3351613ed185e4e36503ccc348f4a8a7957fadfd6f
MD5 e3c9f3c009c49e91b372ce3be05da610
SHA1 df98879fb7402b9b08bdc18fc2f3d4d5ccec12cc
SHA512 444aa325d744a7fbcdc5a48cd7b51814e3cca5caf58b0e16316e015f898773a5d3476059399a704a9b4dc6350d06430ba42a78058f2cd8c03669147b346f22ca
MD5 SHA1 SHA512

Submit Download

channelManifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\Packages\_Channels\a98b6e91\channelManifest.json
Size 115KB
SHA256 415b4477eac9d47c69ecfca90c20476ca90032b3fc72d1a7a79e7ec23178abbb
MD5 9f6f2a5250aaad55f6756c7ad2d7fdaf
SHA1 3b3fafd84ef0a6dda1882c2fe41ca78820af4b06
SHA512 76a1689f5438c62cea43aff641abfcd6ae8b6f6b45e9302bb4f0875a87593f6e665d4b727f800c2455582a1c8669ece5071bbe37eaa951793dc14f132c3f6f9d
SSDEEP 3072:YJV7D9JVZTJVZkJV1JVEJVLvJVLrJVabWSg:YJV9JVRJVaJV1JVEJVLvJVLrJVig
TLSH
T1E6C33B7BCAC6093D6704A2A3999FA98AF02C474E0AF06DFCD5C5E72441B57E2C4474EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\Packages\_Instances\cfa70353\state.json
Size 69B
SHA256 d0bdd7043aa62bf0549aea0bd92a3ae1155848828aaccd5d0bd3a5a16445d1fc
MD5 47ccb1697b44c1ab3a80a719426fe3ba
SHA1 94a8a4124e3843849ef4485b38acfdd9ff6a9d8b
SHA512 f1cc25fdb0f230e823cfd72b89fc437063f5e4b424419a3840698bc2420427b7e477cf187b1945299db7517a36120fcc22569d8cbaaf0db577f28595accb9567
TLSH
T104A02400D303FF303C511334D1705704C071004C34D01704040440CC1D447151377433
MD5 SHA1 SHA512 TLSH

Submit Download

channelManifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\Packages\_RemoteChannels\3ee420b2\channelManifest.json
Size 122KB
SHA256 535873a308bfd75ce61faaec88ec3614837d74b2ce5d3ee12968858d53da8aa4
MD5 717152fa238bf277a42bfc31c200cf1f
SHA1 9b2608c194dc2fc951a001aa4abd5b1dc0f9dc3a
SHA512 2c35f3ee2b9b34d9f70ddbb3654439b75ac5832d05f2da1f4c8827172b255e1502e4931a0ee7a8ea9de279dc4e570af7ca17cfc46fe25c1a9d167e7ae63bc9b8
SSDEEP 3072:YJoYq3JoCmJoCnJolJosJo4mJo4OJo+IbP+89F:YJoDJovJoWJolJosJo4mJo4OJo+23
TLSH
T11DC32B6B8ECA1A3C6700B6F3999F744AF02C478E09F16DECD5C9E62401B57E6C4464EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledFlights[1].cache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AHRAY41H\DisabledFlights[1].cache
Size 78B
SHA256 619374db8a2521ef5adddf7f763c135d1772366b222a4e11f1d69334bc1cbf69
MD5 3786de4b37bb410ed52bc580689bdb9a
SHA1 4c21a9c9f84e16a2b969873c343c801bad22201e
SHA512 c2163e5693ea5ec7babd29af72320950dbe1af1ea0da2a298ca622937c36c73467773115cde8a8a664fcf3aba578b11f8882b5099b25dbab5ad8b47ddd3df808
TLSH
T10BA0222800A3282CAA00CF83B00C880A833F0AECF30C082322C30030820F0EC802EA28
MD5 SHA1 SHA512 TLSH

Submit Download

RemoteSettings_Installer[1].cache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AHRAY41H\RemoteSettings_Installer[1].cache
Size 876B
SHA256 40d9c8cbce568fc20c94194f4e3ff0c2f43cced06e94e29e283b8de4b31e9ced
MD5 36bee3c9a29a9b752a6761a703b1a65c
SHA1 7f6219109cbca0d2ee7cfac638cf7032b73c7e2f
SHA512 cc4db85c765c9a5fae07dc17a2d8d0f80af9ff021c33478e17e0b0fa18c2d2dd4532eedcb9b84b678354f476fd4e0ad4b12a8e52fa13a4a50f4d776c66494029
TLSH
T139111E8514521434DAC2EB5B662E2F156FFE2BF68208210E743E302C93B336D9130E33
MD5 SHA1 SHA512 TLSH

Submit Download

ShippedFlights[1].cache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y3NYWQ12\ShippedFlights[1].cache
Size 205B
SHA256 c4d74f90d4c39536c6b003d7340121350c8190320c6c455984b8170d2d041711
MD5 bd644dcc993d4c0946837f66cbc0189c
SHA1 6cbc48e805986374145c5a1972a5fd05f2802f69
SHA512 61479d42f20edbc61c00d8ff4c63a637b82b7c88ddfb443c2596bb6aef7df831673250ce146e16e770e7050fe978da46662bfe9ea3f03a1444c4e55dcb9c92b7
TLSH
T174D02325A1538C7937D0C6C702908D96412905D87F15C85C54C305F05E465D4591F578
MD5 SHA1 SHA512 TLSH

Submit Download

dyntelconfig[1].cache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y3NYWQ12\dyntelconfig[1].cache
Size 27KB
SHA256 661a2c8f4461ea50e4fbceaf1b83652525f20bcbc07a3418c7c13ed82c941231
MD5 27207c2e9fe216900d5844f5ac09be55
SHA1 2cb1e742f9a4e6a73b8cf58862e7a22cb21e3613
SHA512 38e796c37026f931feb2c76203e216611f8c87d4bd6cd9d785ac195266366fec5690aee530a3ef8167eb01c0bada868dca0c071632097e973057d94330c7299a
SSDEEP 384:fM7fOC2qP6CmTFZ9tg0DI1x8mi+DZPL7awst:U7fOC2qPxyW0DI1x8mi+hL7awo
TLSH
T10ED21495F13DCCB9425F3E1BFD2B640671E0A18160E4F859EFF0AE0993C8B9C915627A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.C2RSignatureReader.Interop.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Interop.dll
Size 28KB
SHA256 0eede17765a0028e3d4840a3196807fde1b0bb109130d37e7107c5dd37d9f4e9
MD5 36d57a1f63a99d9322ed0e709e6b082f
SHA1 73c1340609f1082b305be01b60aa33417eeabccc
SHA512 55a8342eec046fa9ce1c3f9ad1aa6df2b90bce1ecd29b9533d8544620af038a71ab874fad7a6200c7fef470aa42c39857d92ca2a125052150061dc3ac6ab4610
SSDEEP 384:MOIEmJ6RN1/sZPT4OZMSETSbv+cokuc/VKPZlhDSWNNacaGAh0q4ki+R9z3DW:MgTRNOFUOZMVTdwueu1rmbh0U9z
TLSH
T170D25C27475C5337CE464AB0A8F1E9432E34A3C73643DB3F5698F2460E5B79897A027A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.C2RSignatureReader.Native.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Native.dll
Size 133KB
SHA256 df468811f547b66779dbc885a384f7e3fd3c6aaeb8abd3a2a5e714e1638210cb
MD5 42863fe1cf3d93e5fa092f42db2313e4
SHA1 b67f613ff6c17427665f373a76b5dd3387147093
SHA512 58c932b667d7d7533a8421c325f502194f0aa71de683cb84d3c39c237e6288b176bd062109343a308927eb0f1efb3596829d1680232ab724fe4b042a438edfcd
SSDEEP 3072:NQLjUBulBKJhxTYc/92ExlWQ+9E3mEuR9ywKqSY2sqEgU:NNiKmcF2MllMQM1hz
TLSH
T1F1D35C11B9A1C033E6AE0D788824CA56DF3E6D91CFE0ADDB63941DEA0D346D09F39917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.IdentityModel.Abstractions.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\Microsoft.IdentityModel.Abstractions.dll
Size 19KB
SHA256 de168bcbc53946ddcc19f466cc40e685c56b5461859667033cf83553cebe4ad8
MD5 9196dbae4300ba943d0f5f71e0606ac4
SHA1 87fa1f6230415e5bce91a587df7130c0694a76b5
SHA512 fc6c2034f50dbcd189ef7f1557a4c43886b6fa5e740a76c28336c788605abece0d0bc1590f2959c12ea5f2418c9413004a533a19d631cfcf4c5622e45da04831
SSDEEP 384:Ruw+9Em2OXyQ1VIumJzWdloW31+aHRN7E+YMTR9zfZ0:Rull7QC7+28g9zx0
TLSH
T10E923A56C76C9212ED5B2B31716AEE432E3DA7C69921D23A074CF9091C537CA9B3133E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.RemoteControl.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\Microsoft.VisualStudio.RemoteControl.dll
Size 46KB
SHA256 cc52e19735d6152702672feb5911c8ba77f60fdc73df5ed0d601b37415f3a7ed
MD5 355c1a112bc0f859b374a4b1c811c1e7
SHA1 b9a58bb26f334d517ab777b6226fef86a67eb4dd
SHA512 f1e858f97dabeb8e9648d1eb753d6fcd9e2bab378259c02b3e031652e87c29fbabfc48d209983f7074dfc256afd42fa1d8184805534037771a71db517fe16c8b
SSDEEP 768:E3DOuy2r9MhdS0+Mg/n+FbK/lCxkQZ2XJP8MbLVSav7C9zAH:ETOK9MhdStMYn4dtcXJPzbLVSaDez0
TLSH
T1DD235C05937C8B23EADB5E7D69B1D6624A36F7036812E75F4C8CA0D92D93780CD107AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Services.Common.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\Microsoft.VisualStudio.Services.Common.dll
Size 558KB
SHA256 d5e2301598be15b8fa91bbfb0510478c3c9453a7434974fb823e3cb86c19a383
MD5 783424b5a70ec55fff15ca174b3f84d1
SHA1 41d2d8ded0a710f4c4d35af0328761d9899dd20e
SHA512 3fa72329db7333af9dd2a331b1265aaa31a736301683bc3d7f0cdaea9ecfd7c145c77845c0e361448c94dd0854a38c8b9c24992816c33ce536be7c1107d3ddc2
SSDEEP 6144:/rJ0rFyWGbl6hSgbdORJsFQgGz40J5zQKI+ISCAyBttXhrmSqF9MK7kZ1V3bbRy8:/cFYeKdMKI+ISCAo/r0F9TQpfEu
TLSH
T1ECC49E01B7DC4B2BD5EF0B74B4746A5843F2F70A6A96DB4F1904E2AD1D923448E21BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Setup.Common.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Common.dll
Size 627KB
SHA256 3ff33a0ceb7e0615fc405bbf4f065ac2f87351f83e2fa2de52498206962a46f3
MD5 af202510cbc655fa780f2c1561ce5d8b
SHA1 10b540e7c4433076c73b9ee931fd7d858010782f
SHA512 65a482377fcd293a5c9e3e650417627ce1e16462af4687c5c0a5f42301c8a7574457691fafa7befc8db0acd11aab4f8f37a7e230bfbc6849c299a745e9fb3914
SSDEEP 12288:MBVnKg49BheYUpaYZAjd95zYTz91tORREI0QQsvwEQJN1V9hvpgtlrfnPXg3Ta3O:O5ar7fYOjd95zYTz91tORREI0QQsvwEx
TLSH
T1F6D44912AB6DCBBEC95A4A39B831001665FCE50AB301B57ED70CED1D2D63F928D506E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Setup.Download.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Download.dll
Size 319KB
SHA256 d1511f387de0e5072d80c509dcc8b5d4d18f4f5c71d67691e3ef635483e239a0
MD5 485e7f928f5d85159c75c83da31fc6dd
SHA1 dba1a7ebbb7b6fa93de2d748f2fc2856022ce014
SHA512 2e441c4db75e0aa09668e737b78ad2d614cb2301ab6c3bf0f1e8fa9619fc4e4028dd3178fdde6615c71b2b93efd21b81fca86a5406d7e6a7906e7bcc006d6a28
SSDEEP 6144:43RU8k2pGRArl581Rl1yO2OuiRmiRyGucgMEhw9BSuEHpby0:D204l5i1DgMEh3p
TLSH
T167641816F6670B3BC649C639783107020DB97A096219F63DB5DCA88D2DE7FB11E206E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Setup.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.dll
Size 1.5MB
SHA256 a18036b773e74f9c565aef95705d73ec6844e64bc0eedd12c708d4eb46cb41c8
MD5 c81e4b9dc479581647e2440c5ac7d9d9
SHA1 7aa7fa56c36b5263b798d092a26bcdc7a02ee5de
SHA512 cee8a4ff1e94b26a2b187c1fd70a61402a919044ca561df7a05712a85256e3b2c1756205a1adfea8686a9ef874cb6f928b7d69dfcfd9b4060658c66509cdebb6
SSDEEP 24576:kpplUeQxLKgImFK/JwBIgxGktUMzqRI/aRsa3:IlUTLKglKhZ+tUMzqRI/a
TLSH
T14D755980BBE88B15E5FFAB79E47015210BB9FD426772E35E3554A6AD2C32B008D543B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Telemetry.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\Microsoft.VisualStudio.Telemetry.dll
Size 1.0MB
SHA256 305d0c0e832fdfb6f457a7cb92af7b0187b1115cb38649c05afa06d1293a8c60
MD5 8d1a680ac1190669a14cf7869b9f1e1e
SHA1 99b0d507ba75a1b5b4c33c8dc334b2c50a70ea4f
SHA512 e728afa188df5794adf9260643be2f5f39a7559affb0875bb9f63bdc8678d20bb50e3a1066e8a36610001df50128c694aaaf156e1192135dd07a668ae0fd0681
SSDEEP 24576:7+clYMc+ZwghVCgCFFCgnvN5ZigFCLsTBm6S+c5w:ATZbc5w
TLSH
T16B355A0233EC872AD1EF1A3AECB4052507B2FF176B66E75E2214A66D3C633549D507A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Utilities.Internal.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\Microsoft.VisualStudio.Utilities.Internal.dll
Size 61KB
SHA256 4d1d5efd28d72c332ba87e1993cb35e46404753543c5563700b98a97aa3c42a6
MD5 370769c79ea79463adbf0c6476225935
SHA1 2d340026691f83e069c4a87125ca096b9f26c97e
SHA512 5d3af80c54fda6d4d0de06f7b22722d400857743203a745bfcd1667e5e48ea8c2ef7b0c6ffede84b2ea2bd4b74a2ddc766c17392ed07f366d1f0a9b34eb5c63c
SSDEEP 768:3xzXLTPDE2gLJHKjhmpYWPEK/yPmjBkbxfm9OQbcj3gvA9zgH:ZPdIJHKjhMY42bxO9WL6IzgH
TLSH
T164536C00979C8327CAAE0B78A5F4819B1F71D2877942EF67188DE2B81C637C69D117B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\Newtonsoft.Json.dll
Size 714KB
SHA256 c93678ede5bf3c28b88acc564683cc40bda8348be83b38af686417278d84d0ae
MD5 4e44a14d03f9628ce60efba001e4ff55
SHA1 aed1fa363e1673807519cd562455e06b7df205db
SHA512 5e00a72488631a298522113cf140098d74b48f6365ad13cc281b8d314828d37f43f3d9bb5eb9e7575dd14ed38cc15f80cf6579d8bea04537ebaf8938eb5e0314
SSDEEP 12288:D5RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qU:Nm2VuaOKdKSUNz0IpBXyov8fC
TLSH
T1ADF45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\System.Buffers.dll
Size 23KB
SHA256 2d78d770c9cb997199154ae8c018b9f1d1efbc86729f7264dde6dbad2a12cac3
MD5 902760412abffbd10be14842e83f0c09
SHA1 d87680e1a96549cf45506d17566ec08c27a770d8
SHA512 016a283723e32eedaa3b3c6d92bbd0d4c4d2663ab0f0b74bda56d6d2d742632ea0005b3c0c982ca77dd152b839deed0af07228172f059c9e0840e31b530bd0f2
SSDEEP 384:7RJyzxhqFAB5n55560IZplFuA6ccxReXWd2WkRnfLXmztvGHRN7LgFA9bFs0R9zJ:FJyYkx60InTuP0njQtaUFQZs49zUS
TLSH
T187B27C11D79C422ADE7F1A716AF9DA862E3983C16102E66F144CF5040EE37C9DB31BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.DiagnosticSource.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\System.Diagnostics.DiagnosticSource.dll
Size 195KB
SHA256 6eec678b2197c4b77fb93a59140ac843be93c5e459757f96bffd69de451df8b8
MD5 f4e26aecd027254ea1f5de100f71304e
SHA1 150d06f83d09287bce445f125d0b3aba3841632e
SHA512 4d2d777b3e8a4bcba7cc6d16c977067c73e858846ceabbf57fb8eb6bd0955dc6595a789bb4d973b154fe2307de03acade21d72988ea53ca178b86abd2e2a736f
SSDEEP 6144:lHMA/vWlQoXkWgCfFzhzSY5zhzSYCzhzSYSRJgXRFK:qAHW2BoRuK
TLSH
T11E147D50B3DC42AEEFDF2771F0609C024BB6E95BA106D7AD3A49B5ED2813742C60176B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.FileSystem.AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\System.IO.FileSystem.AccessControl.dll
Size 27KB
SHA256 e6026501ad4056ff2f1655b0afdfe8923bc6e8fbad67e1e9ef56e3002f49fbb9
MD5 3409c581f0c5083f0c2a93a7a5ac9790
SHA1 18ea7bd41d31247148abf184527c9368a26f39e7
SHA512 ae877c6fddad0e4133274e6372d783eaa4dd6bdcbbf40ab66302fb89bd2f76b215130001186b5c9a135abd16336c5bfd4d414177704d7d359539da91918e82ed
SSDEEP 384:nmjoB5y+MLi9VYp/OiRc715ZkSAcE1l2Yd5zqNz8TWgVbWqdHRN7NfVlGsa9x:yCN9VYp/OiRcnZIfk8PpET
TLSH
T174D24A01A7FC436AEE7B0B316A76D5122F35F2D93913D11E1940E18E1E93BD89A32B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\System.Memory.dll
Size 141KB
SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
MD5 bd7f42207f4fdb9c7eafb0013abd7334
SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
TLSH
T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Http.Formatting.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\System.Net.Http.Formatting.dll
Size 174KB
SHA256 7b58adc6e23b24cd6615b35e848a002bda053a26d48f9ddafacfc8098e97c49c
MD5 b676d5e9828d6010339743f236f54ec4
SHA1 0dff461be2e04ebf6da5f4f2d3eb639cc2e0a8b5
SHA512 cca0ed47b391b12f44716db1921314e7dcbf2a9f6b0916c78642b4aa814825c570569b103a7f5e298e9c02dbae22e7cb905f08f80f94ad6dcb69fe09085cd8a8
SSDEEP 3072:BXWun8Jw8fCk/Dvf5eso7DpGbG8pwp2xuRLYs8ZS:BXWu8Jw4L/D3UVVGbGbMS
TLSH
T112044A2967FC4B1BE7FF59B8F430A454CE7AF2066416EB4D2C49A0EE1493340E521BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Numerics.Vectors.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\System.Numerics.Vectors.dll
Size 107KB
SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
MD5 a57f205ce75d4e4a19020e8b627469c4
SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
TLSH
T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\System.Runtime.CompilerServices.Unsafe.dll
Size 18KB
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.ProtectedData.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\System.Security.Cryptography.ProtectedData.dll
Size 21KB
SHA256 37fa9beebb4f6613a635378a7e145f9187e093471ba2aed5cdf9ae14874a5f7b
MD5 a318ebf2f27758e54c0ea57b15378f74
SHA1 12ccb75acaa049b5c3ff159f1150409fd88749b1
SHA512 1ba08929f6922240d99d5f5b21ad5ab662560e33b71ff2647511a574466f298bff3d38eed443ab4cedacd63a79b171d1907c86d11e32054273ac4b92eaacffc8
SSDEEP 384:9LQU2P9kG10HWAf6jDWPTb2HRN7Xvm1nR9zZiaN:Bv2FkkJU/iXvm1R9zZLN
TLSH
T1D3A25A31676C837BDE6709B0A171E5422E3EC3963512DD6E6788F2061CA738DD734B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\System.Security.Principal.Windows.dll
Size 17KB
SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
MD5 be2962225b441cc23575456f32a9cf6a
SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
TLSH
T153824A61D7AC8323CDB71A31997AE0533E3DD3C66822862A5689E1061D677C6D731738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.Extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\System.Threading.Tasks.Extensions.dll
Size 27KB
SHA256 af4e13ef418fd89b432de20cd1dfb7fa10a7179c8dd049c9856316e50c5949ca
MD5 0fff41795a1107691ec1e5054211c04a
SHA1 3439da9b7918fa0c17836acbe1fa4e05c40119ec
SHA512 1333847b76025af23a4a4dd421707732078673c96dcdb726a38b477c51606395002574fbcdbf224fd0ae5b80e8da8b2f02dd4972d88f31c36c3dcbf595510e90
SSDEEP 384:F7PVBSE/ug12sib05JCw0p8CUQefpnQKwU3RymGWuXWJwnHRN7rpGR9z04RI:9PV0iug12TY+bUKmGfXrY9z1
TLSH
T15FC28D6183B85113CF6F8E77D2A9CC175F74A3466A02E7391AECF2D40C5338A8A31275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSInstallerElevationService.Contracts.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\VSInstallerElevationService.Contracts.dll
Size 33KB
SHA256 8729a37610b4845617c687f7381cc729dab1b66e43126a23f979fa13308b2fc7
MD5 2f3563395b884a1103020b9d8dc814fe
SHA1 086f439b24b81e9211352d433faa997d43c9a317
SHA512 9445561871764441d2047be10fb1dc95f97c91500d551ee24e604b966fe3fc767c0fb9a93ed3d82e579364ed3f4a59172c7b95a4e060266ccf44fb140f608a3b
SSDEEP 768:ePBXzkGLA3cCUefj4F+51ZUXJtKbQ6a/9z7Er:ePVIMBe1ZgtKsHzAr
TLSH
T1F0E25D9B57A84373DEAB4AF0F8F496C31A79E3C73401F93A56D4F14A2A837858620735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

detection.json

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\detection.json
Size 8KB
SHA256 c828a2e5b4045ce36ecf5b49d33d6404c9d6f865df9b3c9623787c2332df07d9
MD5 782f4beae90d11351db508f38271eb26
SHA1 f1e92aea9e2cd005c2fb6d4face0258d4f1d8b6c
SHA512 0a02beeca5c4e64044692b665507378e6f8b38e519a17c3ceccca1e87f85e1e2e7b3598e598fc84c962d3a5c723b28b52ee0351faaec82a846f0313f3c21e0e4
SSDEEP 192:c5RL5JW2ppB82Bp12K/1xXKuFnXquoI8qguTnoiAOXbsECQxV3mb:qqUUs6maY6L
TLSH
T15B02E122D8A4CD33A1F8E72AA2394506F69503EF95901B6F363C548C9FF3C99144CEB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msalruntime_arm64.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\runtimes\win-arm64\native\msalruntime_arm64.dll
Size 3.0MB
SHA256 b8b2515790b693af8a0c92bcca12572023a31673972860971cbb752d96b603ea
MD5 7d1fef4da46c483734fe70812f0fcb66
SHA1 f7174068da3d342c402c91e29cd6a1ddcc4575e9
SHA512 23f55ef8cd48a206e03f34e8c0dffcdf1bb3fb37f1bd58f22b0f1946046daea747567f31f1c70d78bda25f86316c2a600f8815c3944a244037f63f87dd3a574a
SSDEEP 24576:WIYmr9UBqQHCHxqi8hpVKddlf0fPyHUQFg1e1K0QDiPiWBADGxVN98uhL2EQIcoI:Wy96nCHxqiWKPK1edQDUkGJ2EQvo
TLSH
T13FE55D65EF4E6861D5D6D238EF6B87A8713BF5609534C2CB740B030CF9A6BE285D7022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msalruntime.dll

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\runtimes\win-x64\native\msalruntime.dll
Size 2.8MB
SHA256 bcd4776cf7b0320e413836b8023edc684a26ced6929da4e08b26e079b772fddc
MD5 152736d13555f16433f49ca1fe976a92
SHA1 df1df5e816c7acd01a6516366fbc379a5bf799aa
SHA512 a29e0c6ecabf3f7066e9ac75582f6a65634ebbc52907be5b7906ae60563079477edc4671650f01977b4521de0ca89514ea6d45ea92480c34ddb8ec9a136ea1a9
SSDEEP 49152:/gmW8Kwy8RQKOwlMCAorW7+hC2zA3t/xUPHBB4Or92rU6mGB:L+KfAoLw2GvUZBM4WB
TLSH
T1E8D5285AB35417A2C4F6D37C8A0B9183D2F1B68B037273D70A665665CFF76D0873AA02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vs_setup_bootstrapper.config

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\vs_setup_bootstrapper.config
Size 617B
SHA256 61da9115f9709a5e8b73f2a3b712131b38ac40468682b461002079a45eff2354
MD5 164aab7ab18f27436d234a9ce544fc7c
SHA1 7d333688c3a18ba5fdce4f1038447b27084dcbea
SHA512 f2ab39e257735032f8d9a0fce26df7c00670f67894b1aac7bbd1e67f03d51d6c4e2b30c6540027eb4ad349086cc636c339742ee035d99c6dd3a80631efe1cfe4
TLSH
T1DFF022B7C04850A78FE2B2C39410F465F363338F2CA28C8CE0E984040B11A5BD48B2FA
MD5 SHA1 SHA512 TLSH

Submit Download

vs_setup_bootstrapper.exe

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
Size 325KB
SHA256 36a9031acd109b0e69351a97556b02a3ecd5b066be191b814677a728a932fff1
MD5 9de84850113232b54adab43381e993a0
SHA1 c09a48b8fc496b857df2587fe8043a27192271dc
SHA512 32c8f0a61b19841469df4ea50225ae7897c72d47881fd18ee29c8a839062daabb22a0b9c88fa1e17a5843b03fc2113439371f15e494144d4ef4fabda88b2428d
SSDEEP 6144:rLiVRfrPuTwtnrBp0XPMpHkRG/aNnx/fdGquvsAn:niV1u0ERG/anx/fdTcsw
TLSH
T1C9649D5467FC8665E9BB1F34643416108EB1FA877B26EB9E6D8520CE1D32782DB20373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vs_setup_bootstrapper.exe.config

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\vs_setup_bootstrapper.exe.config
Size 6KB
SHA256 0946e735be14174e0e5ff0b0917e7b206907756c712fd736e282335052eb505b
MD5 7a732e1a3dfe159c727aa4e8829aabd4
SHA1 179e78bc71fb7b6e6cd0fb6e736c9069e26392ce
SHA512 b5795394309ee3191d5db1b5ef44255bb3a32a9283f4541fb1c2418198311de12e9366d14eadad1984ff185f8d6bf9e279a0dc69640bed1fc0d216f1b89cad93
SSDEEP 96:hr24644hj4U4ae4ve4pdomG5Ehqf6m7kKGjRjpjrbD:hrA+5Es0dff
TLSH
T194E16E20D1C8ABA98F7255F23D6B6428CB6D03B7288D059D70EE6E4B8F35D96520B077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vs_setup_bootstrapper.json

Path C:\Users\Admin\AppData\Local\Temp\3a455ba396876a2c2e1f22\vs_bootstrapper_d15\vs_setup_bootstrapper.json
Size 161B
SHA256 f6ca4d89c697c1c5383b8a1c8b00068b75e21d02223a2fc50c21d903ebbb044c
MD5 e32e025f75552ec7ed1dd19e25c6f880
SHA1 b1c5270f006f606144891706d362b4dd233fc1bb
SHA512 94ebee8fc8dcde0dd8961f0c28a120c7931735686c5faac270dea098bad016822e57c03def86d64af242503079426c7daaf79de748b422ec77eee991c0d6ca16
TLSH
T1D6C08CDEC328C02342B0B09B60871984693DAB43A3B925A481861430D2309E2A539C8E
MD5 SHA1 SHA512 TLSH

Submit Download

fc73b8a9-8a24-42cd-b911-8a390f04e844.tmp

Path C:\Users\Admin\AppData\Local\Temp\fc73b8a9-8a24-42cd-b911-8a390f04e844.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

gc4zusof.json

Path C:\Users\Admin\AppData\Local\Temp\gc4zusof.json
Size 22KB
SHA256 b513eab2ca269686153292d3f2a766852aff3c374b032ec7c7cec72cb6ed59f3
MD5 584c1aab659621280dcf5b385796f0aa
SHA1 062e437ea7a86b6cb9d1e49fee7da9dce6b49ecb
SHA512 b2c2f4fe3b177d49c134eb9c5000952f7a4cc6d53e9184df7e27c2906708e0b59ff7edbfec4fa5291b617177e7176112fcd1c4fdc1b6cdbe6fcfc92a442885df
SSDEEP 384:GaBLFIcY3BgfTDugHQmAwAAQ9drYBW8L9Sb2YRaAQ2NpAZEfnRMXWYxRO5wkjn2/:5fM3OewXQ9d0xSbR7ginR2WYxk2kjn2/
TLSH
T14DA29DB35B70300C0D9BD940E9AD9BEA3C1CD7624DD264AA7D947C0BCD28B3621939DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.GitHubProtocolHandler.Msi.msi

Path C:\Users\Admin\AppData\Local\Temp\jgpllgtq\Microsoft.VisualStudio.GitHubProtocolHandler.Msi.36269944180BD9256E2F\Microsoft.VisualStudio.GitHubProtocolHandler.Msi.msi
Size 224KB
SHA256 1b3420d0efbd263d7150f6e5a2c4fa4f26afb7888d67a6cb782453411a6eabf3
MD5 7ee4331f0dbd3d306ad4aa195ba77d00
SHA1 ee9bea07fb9676aacc5c1b4ff1dd9b95bc6f5e17
SHA512 6143665d33ed8ff2c9b64ba9742a0abd5b6904be588fa8684c89bf5a0c7347dbd0ebba5d036e3a495876beb1c4e97ace0c0d8a6084e0ec19fc39695b3e76424d
SSDEEP 3072:iJvi4iurkdIjcEAJS6c1lwiTVUQRwKs4vq7ry1wcw07x8y5mi01:0vFOEAJtc1qWyg+Iwlax8Kd0
TLSH
T168249D02B080C036DABE16754978CAB26F3D7D504F609DDF6394BEAD2D303C19B76A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aq2vzhq2.json

Path C:\Users\Admin\AppData\Local\Temp\punjkqen.tk3\aq2vzhq2.json
Size 115KB
SHA256 838ec42fb29104909d50dbfdd0efc8e32b597bef7fa83d869e958d2552b2bfcf
MD5 e11262a89557404d4909d2ed14c84501
SHA1 575df4f90894239ac6ab89be57a13043285c5d6a
SHA512 e1c95228a2346de9fd54252dd2b124b463b9ee01309545b7d263237b565509f5c2b4f01b7339f2d2311b8a892ba4b45ca8b1ad40ff6fbe2c9c312e35ca15dd67
SSDEEP 3072:wJV7D9JVZTJVZkJV1JVEJVLvJVLrJV+eaHk:wJV9JVRJVaJV1JVEJVLvJVLrJVak
TLSH
T186C33C7BCAC9093D6704A2A3999FA98AF02C474E0AF06DFCD5C5E72441B57E2C4474DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5376_631736473\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zaw32mr5.13g

Path C:\Users\Admin\AppData\Local\Temp\zaw32mr5.13g
Size 412KB
SHA256 f1cb095715625a399901ad62a8e269277a692b2d0ab50be51f88d13cd635ac0a
MD5 e5a7b0a3d168980d9f1085a8da5dcd51
SHA1 6dca4cb056e4ee7ea67fe715ee4db7f43994045f
SHA512 1201e0ffa5352c1daa18cd4a0560f2eb95902cdd8e31f8a61181458df63fccdb7538256b46ded7ae4d6f5f08858c9abebade33964812cf9b34f10c170e5c2cec
SSDEEP 6144:g+XvsdiUJOpAZIpzezU+TfJ/igT5wdbEBQaXhuYhvpN8:pIZJOp0Id27RBdX4Yq
TLSH
T180945A21A556703BE6FA0972F528CB706D3DBD1823D8849B83D0B84E38745E36BB7716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3008-1432-0x00000221E15F0000-0x00000221E162C000-memory.dmp

Download

memory/3088-236-0x00000000091D0000-0x000000000928A000-memory.dmp

Download

memory/3088-241-0x0000000073870000-0x000000007402C000-memory.dmp

Download

memory/3088-203-0x0000000073870000-0x000000007402C000-memory.dmp

Download

memory/3088-207-0x0000000006380000-0x0000000006434000-memory.dmp

Download

memory/3088-219-0x0000000006310000-0x0000000006318000-memory.dmp

Download

memory/3088-223-0x00000000066C0000-0x00000000066D0000-memory.dmp

Download

memory/3088-215-0x0000000006330000-0x0000000006358000-memory.dmp

Download

memory/3088-211-0x00000000062E0000-0x00000000062F4000-memory.dmp

Download

memory/3088-224-0x0000000007230000-0x0000000007296000-memory.dmp

Download

memory/3088-190-0x0000000005D80000-0x0000000005E20000-memory.dmp

Download

memory/3088-227-0x00000000074D0000-0x00000000074F2000-memory.dmp

Download

memory/3088-202-0x0000000005E20000-0x0000000005E74000-memory.dmp

Download

memory/3088-230-0x0000000007540000-0x000000000789B000-memory.dmp

Download

memory/3088-231-0x00000000079B0000-0x0000000007A42000-memory.dmp

Download

memory/3088-232-0x0000000008010000-0x00000000085CA000-memory.dmp

Download

memory/3088-194-0x0000000005F30000-0x000000000603A000-memory.dmp

Download

memory/3088-1310-0x0000000073870000-0x000000007402C000-memory.dmp

Download

memory/3088-186-0x0000000005950000-0x0000000005AD6000-memory.dmp

Download

memory/3088-238-0x0000000073870000-0x000000007402C000-memory.dmp

Download

memory/3088-239-0x000000000BC70000-0x000000000BC78000-memory.dmp

Download

memory/3088-240-0x000000000BC80000-0x000000000BC88000-memory.dmp

Download

memory/3088-198-0x0000000005930000-0x000000000593A000-memory.dmp

Download

memory/3088-242-0x000000000BCB0000-0x000000000BCB8000-memory.dmp

Download

memory/3088-243-0x000000000BD00000-0x000000000BD3E000-memory.dmp

Download

memory/3088-244-0x000000000BCA0000-0x000000000BCAE000-memory.dmp

Download

memory/3088-245-0x0000000073870000-0x000000007402C000-memory.dmp

Download

memory/3088-246-0x0000000073870000-0x000000007402C000-memory.dmp

Download

memory/3088-249-0x0000000073870000-0x000000007402C000-memory.dmp

Download

memory/3088-251-0x0000000073870000-0x000000007402C000-memory.dmp

Download

memory/3088-252-0x0000000073870000-0x000000007402C000-memory.dmp

Download

memory/3088-257-0x000000000CAD0000-0x000000000CB20000-memory.dmp

Download

memory/3088-258-0x000000000B320000-0x000000000B332000-memory.dmp

Download

memory/3088-263-0x0000000073870000-0x000000007402C000-memory.dmp

Download

memory/3088-262-0x0000000073882000-0x0000000073883000-memory.dmp

Download

memory/3088-182-0x0000000000C90000-0x0000000000CE4000-memory.dmp

Download

memory/3088-271-0x000000000B300000-0x000000000B30C000-memory.dmp

Download

memory/3088-272-0x000000000CB20000-0x000000000CB42000-memory.dmp

Download

memory/3088-273-0x0000000073870000-0x000000007402C000-memory.dmp

Download

memory/3088-274-0x0000000073870000-0x000000007402C000-memory.dmp

Download

memory/3088-275-0x0000000073870000-0x000000007402C000-memory.dmp

Download

memory/3088-180-0x0000000073882000-0x0000000073883000-memory.dmp

Download

memory/3088-276-0x0000000073870000-0x000000007402C000-memory.dmp

Download

memory/3404-1207-0x00000220FE040000-0x00000220FE082000-memory.dmp

Download

memory/3404-1201-0x00000220FE160000-0x00000220FE2CE000-memory.dmp

Download

memory/3404-1182-0x00000220FCD90000-0x00000220FCDAA000-memory.dmp

Download

memory/3404-1175-0x00000220FCDC0000-0x00000220FCDE2000-memory.dmp

Download

memory/3404-1170-0x00000220FCA30000-0x00000220FCA60000-memory.dmp

Download

memory/3404-1168-0x00000220FCD50000-0x00000220FCD8C000-memory.dmp

Download

memory/3404-1166-0x00000220FCEA0000-0x00000220FCF54000-memory.dmp

Download

memory/3404-1163-0x00000220FCCB0000-0x00000220FCD4E000-memory.dmp

Download

memory/3404-1161-0x00000220FCC10000-0x00000220FCCB0000-memory.dmp

Download

memory/3404-1159-0x00000220FCA80000-0x00000220FCC06000-memory.dmp

Download

memory/3404-1157-0x00000220FA140000-0x00000220FA44A000-memory.dmp

Download

memory/3404-1181-0x00000220FC9F0000-0x00000220FC9FE000-memory.dmp

Download

memory/3404-1437-0x00000220FC280000-0x00000220FC28A000-memory.dmp

Download

memory/3404-1436-0x00000220FC2E0000-0x00000220FC2F8000-memory.dmp

Download

memory/3404-1435-0x00000220FC320000-0x00000220FC35E000-memory.dmp

Download

memory/3404-1434-0x00000220FC250000-0x00000220FC25A000-memory.dmp

Download

memory/3404-1433-0x00000220FC240000-0x00000220FC248000-memory.dmp

Download

memory/3404-1431-0x00000220FC2B0000-0x00000220FC2D8000-memory.dmp

Download

memory/3404-1185-0x00000220FCDF0000-0x00000220FCE04000-memory.dmp

Download

memory/3404-1429-0x00000220FC210000-0x00000220FC21A000-memory.dmp

Download

memory/3404-1187-0x00000220FCA00000-0x00000220FCA0C000-memory.dmp

Download

memory/3404-1191-0x00000220FCA20000-0x00000220FCA28000-memory.dmp

Download

memory/3404-1189-0x00000220FCE40000-0x00000220FCE68000-memory.dmp

Download

memory/3404-1193-0x00000220FCA60000-0x00000220FCA70000-memory.dmp

Download

memory/3404-1195-0x00000220FCDB0000-0x00000220FCDB8000-memory.dmp

Download

memory/3404-1197-0x00000220FCFF0000-0x00000220FCFFE000-memory.dmp

Download

memory/3404-1199-0x00000220FDF60000-0x00000220FDFEA000-memory.dmp

Download

memory/3404-1183-0x00000220FD070000-0x00000220FD17A000-memory.dmp

Download

memory/3404-1204-0x00000220FE2D0000-0x00000220FE38A000-memory.dmp

Download

memory/3404-1206-0x00000220FD040000-0x00000220FD04C000-memory.dmp

Download

memory/3404-1220-0x00000220FE3B0000-0x00000220FE3CE000-memory.dmp

Download

memory/3404-1208-0x00000220FD050000-0x00000220FD058000-memory.dmp

Download

memory/3404-1210-0x00000220FE3D0000-0x00000220FE3DE000-memory.dmp

Download

memory/3404-1209-0x00000220FE090000-0x00000220FE0CE000-memory.dmp

Download

memory/3404-1212-0x00000220FF240000-0x00000220FF294000-memory.dmp

Download

memory/3404-1287-0x00000220FC260000-0x00000220FC272000-memory.dmp

Download

memory/3404-1286-0x00000220FC200000-0x00000220FC20E000-memory.dmp

Download

memory/3404-1285-0x00000220FC220000-0x00000220FC238000-memory.dmp

Download

memory/3404-1282-0x00000220FC1F0000-0x00000220FC1F8000-memory.dmp

Download

memory/3404-1272-0x00000220FC1E0000-0x00000220FC1E8000-memory.dmp

Download

memory/3404-1271-0x00000220FC1D0000-0x00000220FC1D8000-memory.dmp

Download

memory/3404-1264-0x00000220FFEA0000-0x00000220FFFD6000-memory.dmp

Download

memory/3404-1221-0x00000220FF210000-0x00000220FF22C000-memory.dmp

Download

memory/3404-1219-0x00000220FE120000-0x00000220FE12A000-memory.dmp

Download

memory/3404-1214-0x00000220FF3C0000-0x00000220FF448000-memory.dmp

Download

memory/3404-1215-0x00000220FE140000-0x00000220FE152000-memory.dmp

Download

memory/3404-1229-0x00000220FF300000-0x00000220FF312000-memory.dmp

Download

memory/3404-1218-0x00000220FF450000-0x00000220FF4A0000-memory.dmp

Download

memory/3404-1222-0x00000220FF5A0000-0x00000220FF69C000-memory.dmp

Download

memory/3404-1216-0x00000220FF2A0000-0x00000220FF2FE000-memory.dmp

Download

memory/3404-1217-0x00000220FF1E0000-0x00000220FF202000-memory.dmp

Download

memory/4660-1261-0x00000170080D0000-0x00000170080E0000-memory.dmp

Download

memory/5916-1260-0x000001BDE06F0000-0x000001BDE06FE000-memory.dmp

Download