hxxps://www[.]rust-lang[.]org/tools/install

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.rust-lang.org/tools/install
Sample260822-mtyhfagl21

Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
51	3100	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	vs_setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
5280	rustup-init.exe
1476	vs_setup.exe
5644	vs_setup_bootstrapper.exe
4300	setup.exe
4688	vs_installer.windows.exe
872	VSInstallerElevationService.exe

Loads dropped DLL 23 IoCs

pid	Process
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\pl\Microsoft.ServiceHub.Framework.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\InstallCleanup.exe	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\de\Microsoft.VisualStudio.Threading.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\es\Microsoft.VisualStudio.Imaging.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\pl\StreamJsonRpc.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\pt-BR\Microsoft.VisualStudio.Setup.Download.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VSIXAutoUpdate.exe	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\fr\Microsoft.TeamFoundation.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\MessagePack.Annotations.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\dump64.exe	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\ko\Microsoft.VisualStudio.Threading.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Setup.InstallerResources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\Microsoft.VisualStudio.Telemetry.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\tr\Microsoft.Data.SqlClient.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\tr\Microsoft.VisualStudio.ProjectSystem.Query.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\tr\Microsoft.VisualStudio.Setup.Download.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\tr\VSIXInstaller.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Assets\Installer.150x150.scale-200.png	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\de\Microsoft.VisualStudio.Extensibility.Framework.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\es\VSIXInstaller.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\Microsoft.VisualStudio.Utilities.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\zh-Hans\Microsoft.TeamFoundation.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\zh-Hant\Microsoft.VisualStudio.Extensibility.Contracts.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe.config	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installershell.exe	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Assets\Installer.70x70.scale-100.png	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\OSExtensions.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\runtimes\win-x64\native\msalruntime.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\tr\Microsoft.TeamFoundation.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\cs\Microsoft.Data.SqlClient.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\cs\Microsoft.VisualStudio.Extensibility.Framework.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\es\Microsoft.VisualStudio.Setup.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\ja\Microsoft.VisualStudio.Setup.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\fr\Microsoft.VisualStudio.ExtensionEngine.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\ja\Microsoft.VisualStudio.Services.WebApi.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\Microsoft.Bcl.AsyncInterfaces.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\pl\Microsoft.VisualStudio.Utilities.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\System.Diagnostics.DiagnosticSource.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\zh-Hans\Microsoft.VisualStudio.Setup.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\zh-Hant\Microsoft.TeamFoundation.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_layout.exe.config	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Resources.scale-125.pri	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\ja\StreamJsonRpc.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\pl\Microsoft.VisualStudio.Threading.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VSHiveStub.exe	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\fr\Microsoft.Internal.VisualStudio.UserNotifications.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\ko\Microsoft.VisualStudio.Threading.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\Microsoft.VisualStudio.Interop.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\System.IO.Pipelines.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\de\Microsoft.VisualStudio.Services.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\ja\Microsoft.Data.SqlClient.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\ja\Microsoft.VisualStudio.Threading.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Services.Common.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\cs\Microsoft.VisualStudio.Setup.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\fr\Microsoft.VisualStudio.ExtensionEngineContract.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\Microsoft.VisualStudio.Shell.15.0.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\tr\Microsoft.VisualStudio.Services.WebApi.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\de\vs_layout.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\System.Security.AccessControl.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\it\Microsoft.VisualStudio.Threading.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.Extensions.Primitives.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.Toolkit.Uwp.Notifications.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Threading.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\VSIXInstaller.exe.lce	vs_setup_bootstrapper.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	getmac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	vs_setup_bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rustup-init.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vs_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vs_setup_bootstrapper.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3100	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vs_setup_bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vs_setup_bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vs_setup_bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318691759869485"	msedge.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32\ThreadingModel = "Both"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\NumMethods	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\ProxyStub\\x86\\Microsoft.VisualStudio.Setup.ProxyStub.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\NumMethods	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\NumMethods\ = "4"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{1E8B5B91-1D13-4D23-B222-97738ADB2296}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\NumMethods\ = "4"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\ProxyStub\\x64\\Microsoft.VisualStudio.Setup.ProxyStub.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ = "IVsSetupShutdown"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ProxyStubClsid32\ = "{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32\ThreadingModel = "Both"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ = "IVsSetupShutdown"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ProxyStubClsid32\ = "{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}"	setup.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D30F05F637E605239C0070D1EA9860D434AC2A94	vs_setup_bootstrapper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D30F05F637E605239C0070D1EA9860D434AC2A94\Blob = 030000000100000014000000d30f05f637e605239c0070d1ea9860d434ac2a941400000001000000140000001e82df0ed78cb3d70234830edaabad65b9afb8ec040000000100000010000000c36fa33c215586085991904a6602bc8a0f0000000100000030000000c64ce3455898f871d11c14da412aac58fa2022d4213d8ac05f8dd6909b2fb0fcc76c19a1913df5bc0cb1662229ad15d1190000000100000010000000928311586be0737592bb924f9fee51645c0000000100000004000000001000001800000001000000100000003c70faea25600ce3b2cc5f0b222ed6292000000001000000c1060000308206bd308204a5a0030201020213330000001c489f81dfa1b0b77700000000001c300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3234303830383231333632335a170d3335303632333232303430315a305f310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3130302e060355040313274d6963726f736f66742057696e646f777320436f6465205369676e696e6720504341203230323430820222300d06092a864886f70d01010105000382020f003082020a02820201009a7d6b7d27c1762a2eaee3d534ffcc2b6deefc54f820a3fbb06489f4bf07681728653b395f525d12463f5c85b39a7a8e9b188b8718cc5e7a015d001269848d5f304f696f3d4e4184ddf0577d07a983c86048f93f75977f49170fd7ef8d47f5180b5712b889f30ec02cd695126f51b3878f03466c6076826d4e640542500d7bfbea169f39c420745080dc8df362d7f35f6bcec31f3bb8339a0aec8a39166287d737cd37fe4cb0b94182f28553019c35c41c33abbdac3dd834b222aa5d8115a9b9fcea0c5cb57a05639285d985bfbda59f61794ccd5d35e13a85f37b187a63300be1f9415a6f81735850c8449e9c4bc12739d5fb6e6ede1efb8e380c518e38f965d0e2ef6a75d0defd4e5278068a46fbe26e68b8cfb411a4bbd9b256b408f88e506cf4d03a39b1f902d04c25b12cdf337fbc03daecc8554e8160d53f3b7df0e24fd84a1a10eabc184f460a83768bbff80b6142c1f7f505209325664ed5672bd8cb5e244e94c4657e8a103c9cde7560f283d9d606a1ec2b5ef4730bfd47a14792be565fd267fd18712dbef91b255451a3a3c17f499de6df3b55bd6633f7c8a757b2a726b1997920a5c070bb296c3aada4495389e7004fa1a12cb0991e31c2a712ebaefbe50a7431e54b40edb188cdd109ceb9cbd3752b1dbe1cca3928c91775d5aabf5fd82f78e4b5d3e6bc4a20750810305c35853a04a0c31faadfa4a38e0928a50203010001a382014630820142300e0603551d0f0101ff040403020186301006092b06010401823715010403020100301d0603551d0e041604141e82df0ed78cb3d70234830edaabad65b9afb8ec301906092b0601040182371402040c1e0a00530075006200430041300f0603551d130101ff040530030101ff301f0603551d23041830168014d5f656cb8fe8a25c6268d13d94905bd7ce9a18c430560603551d1f044f304d304ba049a0478645687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f4365724175745f323031302d30362d32332e63726c305a06082b06010505070101044e304c304a06082b06010505073002863e687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f4365724175745f323031302d30362d32332e637274300d06092a864886f70d01010c05000382020100435ff8df3fbbe9948c3b5cf5bb68039d9105cd1754348131004cab1bb9ea15c7070b9cb545acd5706a0c33081421eef5ce98fd417e4cdf042208e7ba30292989873f87f810cdc04529a5ceba45e68cce271d01039154bf58e6a5d7ffd996eaa6f0b1971bff1b54782a3ad29a6a8f1f3b3a8a0c376fb4536e3ec1c484bc7ce224c18590841d9f2e3960fb71d2ac318f1488692095956a630847b6bbd8e1a89e375fe39aeca70a881eeca7654e1abf2f6bb81fd18616f09be7cc6fc04c79c21a4e6928871fc4659e4635670dea84d85b71b604cdc1dd8ce75a497db78b213fad1f32e7beda4b1d1c659213c1154dd4a6194763d23ad4738ea5195149212177fccc5cc6794d78fd4a872afe6734f812db3f23b9ae7e968b9cb6a5ccc476cc8ba118e0165acc1eb1b8ed173915505803476496f74dc8d172a56cf100eaaf1ea47189f6ba3187ce67b0429c04d530e12729ebc282a92a4505a2a2c95d6c91dfa5f14e7458d78f31bf41cf3d0e7c049a97cbf9b101be0d6d3590df88f9129421b339239d30263887ca6405343b1ba1b171f48f799821043d4edf519dd54ff1ce5156e4997ee5b480bf79002ee463bc7eef9c7844ccc9bbdba3150ce1d60d0be3f3a285317e60b40ee291c01db56d7f7e69cb88064c489b811ddced7dc3554ba00ed434e52e27bcfa350d96ffeabb7277ce3e5d9054be2a96009b9544f6be6429965577	vs_setup_bootstrapper.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5644	vs_setup_bootstrapper.exe
5608	msedge.exe
5608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5644	vs_setup_bootstrapper.exe
Token: SeDebugPrivilege	4300	setup.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
4300	setup.exe
4300	setup.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5504 wrote to memory of 6048	5504	msedge.exe	86
PID 5504 wrote to memory of 3100	5504	msedge.exe	87
PID 5504 wrote to memory of 3148	5504	msedge.exe	88
PID 5504 wrote to memory of 3148	5504	msedge.exe	88
PID 5504 wrote to memory of 3148	5504	msedge.exe	88
PID 5504 wrote to memory of 640	5504	msedge.exe	89
PID 5504 wrote to memory of 640	5504	msedge.exe	89
PID 5504 wrote to memory of 6072	5504	msedge.exe	91
PID 5504 wrote to memory of 6072	5504	msedge.exe	91
PID 5504 wrote to memory of 6072	5504	msedge.exe	91
PID 5504 wrote to memory of 5608	5504	msedge.exe	90
PID 5504 wrote to memory of 5608	5504	msedge.exe	90
PID 5504 wrote to memory of 5608	5504	msedge.exe	90
PID 5504 wrote to memory of 4848	5504	msedge.exe	94
PID 5504 wrote to memory of 3384	5504	msedge.exe	95
PID 5504 wrote to memory of 4848	5504	msedge.exe	94
PID 5504 wrote to memory of 3384	5504	msedge.exe	95
PID 5504 wrote to memory of 2868	5504	msedge.exe	97
PID 5504 wrote to memory of 2044	5504	msedge.exe	101
PID 5504 wrote to memory of 2044	5504	msedge.exe	101
PID 5504 wrote to memory of 1604	5504	msedge.exe	102
PID 5504 wrote to memory of 2044	5504	msedge.exe	101
PID 5504 wrote to memory of 1604	5504	msedge.exe	102
PID 5504 wrote to memory of 5124	5504	msedge.exe	103
PID 5504 wrote to memory of 5280	5504	msedge.exe	104
PID 5504 wrote to memory of 704	5504	msedge.exe	118
PID 5504 wrote to memory of 2220	5504	msedge.exe	119
PID 5504 wrote to memory of 5844	5504	msedge.exe	120
PID 5280 wrote to memory of 1476	5280	rustup-init.exe	122
PID 1476 wrote to memory of 5644	1476	vs_setup.exe	123
PID 5644 wrote to memory of 5616	5644	vs_setup_bootstrapper.exe	124
PID 5504 wrote to memory of 6004	5504	msedge.exe	129
PID 5504 wrote to memory of 6004	5504	msedge.exe	129
PID 5504 wrote to memory of 6004	5504	msedge.exe	129
PID 5504 wrote to memory of 5748	5504	msedge.exe	130
PID 5504 wrote to memory of 5748	5504	msedge.exe	130
PID 5504 wrote to memory of 5572	5504	msedge.exe	132
PID 5504 wrote to memory of 5572	5504	msedge.exe	132
PID 5644 wrote to memory of 4300	5644	vs_setup_bootstrapper.exe	133
PID 4300 wrote to memory of 4688	4300	setup.exe	136
PID 5504 wrote to memory of 5608	5504	msedge.exe	143

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.rust-lang.org/tools/install
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffeb52ac188,0x7ffeb52ac194,0x7ffeb52ac1a0
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,3541214921873503922,12152740562550515750,524288 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,11653728514925222384,1110385312085394359,262144 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,8367410499551607854,1744826893028484332,524288 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,14356522936403125425,8550283119924309265,2097152 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,4716677065700180164,1848450345558419224,2097152 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,12998367769823452070,17075058769823728471,524288 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,12132854889894334468,17617550343100894306,524288 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,16253022397205600035,18049805852547144198,524288 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,16253022397205600035,18049805852547144198,524288 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6132,i,8545580743327769339,3213845740832541337,2097152 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,10749770789567181887,9325070798643311075,524288 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,14977246973166471917,18223938520137270267,524288 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:5124
- C:\Users\Admin\Downloads\rustup-init.exe
  "C:\Users\Admin\Downloads\rustup-init.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5280
- - C:\Users\Admin\AppData\Local\Temp\rustup-visualstudiovSmB1w\vs_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\rustup-visualstudiovSmB1w\vs_setup.exe" --wait --focusedUi --addProductLang En-us --add Microsoft.VisualStudio.Component.VC.Tools.x86.x64 --add Microsoft.VisualStudio.Component.Windows11SDK.26100
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
      "C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --wait --focusedUi --addProductLang En-us --add Microsoft.VisualStudio.Component.VC.Tools.x86.x64 --add Microsoft.VisualStudio.Component.Windows11SDK.26100 --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\AppData\Local\Temp\rustup-visualstudiovSmB1w\vs_setup.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\Downloads"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5644
    - - C:\Windows\SysWOW64\getmac.exe
        
        "getmac"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
    - - C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" /finalizeInstall install --in "C:\ProgramData\Microsoft\VisualStudio\Packages\_bootstrapper\vs_setup_bootstrapper_202608221146465006.json" --focusedUi --addProductLang En-us --add Microsoft.VisualStudio.Component.VC.Tools.x86.x64 --add Microsoft.VisualStudio.Component.Windows11SDK.26100 --locale en-US --activityId "15320708-9d87-4b5e-9c0a-d3b53964e20a" --pipe "4d2d3ca2-def0-42bf-8c87-6b6fdb3d41c4"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4300
      - C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe" /finalizeinstall 6F320B93-EE3C-4826-85E0-ADF79F8D4C61 "Visual Studio Installer" "Microsoft Visual Studio Installer" 4.9.50.62957 0 "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"
        6⤵
        Executes dropped EXE
        
        PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,1440362749088081091,7044636968175582967,524288 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,8794868354852193354,9160878301261530573,524288 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,229465523456317171,9548361671042100419,524288 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6200,i,17778498005802625697,2290908074011801920,2097152 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,9839259195091637702,12721169429688844886,524288 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3984,i,4573003268766480546,13291899837162758800,524288 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,8071711247988100492,6926135083274719882,262144 --field-trial-handle=2384,i,6904724258658518918,7346606348640662741,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:216

C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe
"C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe"
1⤵
- Executes dropped EXE
PID:872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
Size 3.0MB
SHA256 1585adca958b1eb585003f1b134a98820fc1d8cb85642ee940e4b505652e3ee8
MD5 db705de78c002e978b3087a812199fc4
SHA1 572aa5a0800e45c5855e22fca8aa4d33e31aec19
SHA512 82dcdd8b13aa48892586275b3c74f49f6089bac2ce6d65e5495d27102d4a8b1e5d58cd992869ee10a6c61a720529b2724a2c6d54d2b6a50bb45dbc21e63e148d
SSDEEP 24576:SHcn0eO1X3WKSPqVjXZ5gH/+uVt73kKIY2VLsYIDqEZS/T03VIdMt2s/lr9D7nDx:SHc2WKSPqRgrp2VLCRl7drdff5
TLSH
T119E57C04E76C0F33C56B5B3A2439453046B9AA4B6372DB7D3A8E386DBD43B05CE16693
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.config

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe.config
Size 11KB
SHA256 59e15809a178ad6f32935462180d0e4e1399ae380433c53269c3c4448a65089b
MD5 ec6d45642bd1f5771ef1101a73a47dbd
SHA1 d5e93c8e086379d7c27678c6939bfbcfe2927012
SHA512 dd7be33267cd32e8af1030232553a60d657548c248cce70ba62b86fc75dfab7086b9b26b200a6e5b95f9e8dd7b48502d5f83a1327c8249ea687c7efe88ea9ae5
SSDEEP 96:hrTRUEkVc44hj4U4ae4ve4p4cu4L4T4s/idhomG5EhG6SjGRjGMjqf3j6m7kKjjv:hrTKmW55EcvaRaM2fNddf/fD
TLSH
T174326C20D1C8ABE98F7155E23D6B6428CB6D03B7298D019D70FE6E4B8F35E96520B077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vs_setup_bootstrapper_202608221146465006.json

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_bootstrapper\vs_setup_bootstrapper_202608221146465006.json
Size 162B
SHA256 186c4b16ee009564819730b358dbdbb0792fc27e602698c5f0a16e20104647c7
MD5 ad891c3b02a02419dc60db8c273a8315
SHA1 141a08ca0e25d56bdb35fc71e1c767667079114a
SHA512 64cdaf1d6d1b4072e24f3926f91103abf946ff044cda34a9070586c2d2927bcdfc53381c955e447a38965ee426373259759025f97b715158afc429080956196f
TLSH
T142C08CDEC22CC02342F0B097A0930880793CAF43A3F961A891861430E3315F1A53AC9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 24f73fab613459e9914fd375037c1b2b98b0c0c80cf770f5317a84726e7eac2e
MD5 fcb114a1e1ed100dd725a8394b0e01c8
SHA1 3aa4ee6b1b320fa019e8186eec8647a2087ba91d
SHA512 7b81de606de7b6cfe7676a462062998b3ab7873cb79079ae3403537b926da41f18b45b65f425e44cb3193f122abb1ec5ef7103e152b5f15038a2fc3896109953
TLSH
T1C6E02BA5C925FC3718FD0719A0598646E74013172A80495F3A3D82088FB473A45C985D
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000be

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be
Size 72KB
SHA256 2ee450e82bb3e91cb1f98f0dcbd5286846f0d560c09001da28f5f29c00f1b8e7
MD5 c3245e892cab7e4ead00b48327b6e155
SHA1 39b9590213ef742b22456d1d57d7e2bc59d073d5
SHA512 de96cc0c709cd23fe62d317764831a159f1b68d6639c07cf0429a5df43574dd49d2b22d4e1588323f8b679ea42593839e7695997fa52bad1f6dd8258a2b6f458
SSDEEP 1536:ZCIgCoUHcMbCc03Q1Ep5J1L8b7umiVOsuHaoGtQaLDzPjm8NfY:d0U8gy3gEp5x7eaiOb/Y
TLSH
T14E7302A1C412FE652DF10DADFCFA82093624527D256FFAE42A2D67CFDE95130A4C4CA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
Size 52KB
SHA256 3986cf7d2844766a8d8f698490b93e6965240268b9ef9deb24a2f3d584141d16
MD5 f91b13feb0cd154988badca90dfc5960
SHA1 3d19ed832cb561b6af2588eea630cec507817ea0
SHA512 40898196284e1aea03db6982f946eee12f2f5ca10c71810e6930abe60f601f6b09ee1066c8b17a08da59e3fdc1e9539bf73d4516f45ef81cf5e5730575edb8c9
SSDEEP 1536:Rq/NbGOLlRlVhrppIGYdg/fcSXgpOSbwYrdVe6y:RuwKVhpLZ/tRSkYZVzy
TLSH
T1F73302B010C3B8E62311B9D281EA0FDDD9B5E76B53DA4D4E2CE5B962D085BC08E50A9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 3b1129b12f6327bd4b9bfbdd924ff02a9b856446fe8dcd8b9fa4045434d8987b
MD5 4032e9f983bbd012a69f74236bf704cc
SHA1 0bd715b9b97cf6de8c8a46692f912669a1405df5
SHA512 c341e5b5a64c0832f699f67083f40449465e87b2bd7c4cc122c2014f6c6c2aa7cd5dd7b81cc018eb174f73b12eaf7fb71c47acf030cb1be4c9f0363c28a376d7
SSDEEP 192:AOUuTUzkgjk48OvBz+wnSUH/MMKZq/ZSNmg:AOUCUETq/MoZSv
TLSH
T18FE1E8B945A535F4DB221232E4B689963939B4F8FD377E4208C03478270379A75EAF87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8cd9e4c13c657975426606223420bb07cf3e564c9d74393b68710e1fdd402a44
MD5 efbde41614e9542f4713bb06125bb7a6
SHA1 cb5194e9669752d27c7e09a2113b5fa55e947c3c
SHA512 9df27dee69262b2aeecbf29dd6f55010b92b1ad82a97785317cdb6a7d55d2110471278a81034acead0a076dc5dc03e5f806d96970f8268127153f735332bde5e
TLSH
T16771B53D855676F5E3324332B8E286023C3DF9F8F907BE96099025792703B527968F88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586099.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586099.TMP
Size 3KB
SHA256 104e19dd701288fb0c6f152ae5af0bdcc126e900cb6c2b8400eb86ebfd58d8e0
MD5 20519854d972f30c3697175f921c72d9
SHA1 b679f00bf8061c4a438eaaa9aad1ebf640a63f7c
SHA512 0f3c44a6b6376737a6245533be7ccf01fab4beedc58b7141016ce0b826d50c152a2dc55763a3fb70f2686bfac27274bddbfe2b21ba7a8fc77d94fe680c5e024e
TLSH
T16C71C73D855676F5E3324336B4E286023C3EF9F8F913BD96099421786707B527869F88
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 28KB
SHA256 f5e4004daaa002f81bf8fcfcd7d72279464bd664f1e37e988b249e0c930ccf71
MD5 908cb27303e94ee6a89a7f29dc7c1958
SHA1 a24f912b644078bcc219eb943e2a8e5f084c648b
SHA512 66a2907eec2c851acd097d0c024e41da4990da228970dcc0b7749dfcfc8f8d60e4a6ff521de2a0d0799fe0b041632291be3e58027153d284006e1ddb848d1f19
SSDEEP 768:JuCNeAPqyaXao4nT9Z6cFGIkM9MsziZlxAs:wAd9gcwDxAs
TLSH
T17ED25852B5F9121AF2B75E7BA9B65BA14C7ABE462D04CC2E5860620D4C31F40CD73F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 343B
SHA256 6ffb33e88fd83b80123683055139b9cabf48f0c25f650454fd07049ace0a0184
MD5 ee7fce3769cba2bf59cf6f3e9eed59e4
SHA1 e43110e71a8fdc97e64762d481482dc7d73183ae
SHA512 019a37928da0959b066f7b983dc8b1aec5f1a858a0e6e0b05194f76635aae02fff84f7176245fe8f5617789c6a0caf407ae70016cfc5ef7872e9b2923c10d715
TLSH
T147E0DFB888CDC26FA21468E7153CBB4D96BB660E97C8BD865F1DC804B04A084B97E5A1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0d3d80c78108045e822814ed7e82bf4e58ceb5a50dd2c6d62532f3584cbbb84d
MD5 f5f904762dd9a9a6e4cb2b7c247f8bb4
SHA1 4a592dd64d1bb17e0353a03d804f9cbd1ba87ebf
SHA512 e003f783ff0a4e922832d73f46c69e023c84817eaa3766ded90dee80c535000f2b552cedafb91acf9842b24929d61a49c50dd8dbc50fd1edb812650342c363b5
TLSH
T1E281BCF383B6862ED91195F0AA19BE1BCE1D0451436C3C5A89E07F5B93F2461E142B8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3968b53e9f4b58cb2202507ecc21815fa582acb44d06ac8fe2a3725896809253
MD5 a3765eb4fa782d1f69994a2849c7d523
SHA1 1ce2abc237afe3549f805a08fda9ae947251b702
SHA512 e64fc63bb62bbfd3e6462abd3fc6bb12906131285154c6ede15e3eca2ae9202a934eb1c2fe128c59a7a179c833094aeba70374e7e946b30b7494a90410e70890
SSDEEP 192:sxZbRcyMqZjK1Ml8M9n/fHsXnCaZdq5zodpciHW6+WN9caXYv8uX9rk2BIg5tYJ:sxZbB1n/fHs3CazqyHHb7XYrkmj8
TLSH
T11962E915AA385A7B8CDBD209F645BB53D3F81123D1915E849AFCCA1C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 b030da358abca88664c81bfa8d2eb01f52558d7e2a6eeda28fda2c08ea68210c
MD5 9f78666840f5faf391a7621da6eec288
SHA1 5388533fd51f1900c0bb934b66f2a14a9e098908
SHA512 ffdc4480b9880586b7355beb709814818470c64dac09c82e7b51912a74c4d1d2f380a1c1986877454d45e764e8b5cb1f89d67ea5bc8ff81d638e775201729268
SSDEEP 192:sxZrRcyMqZjK1Ml8UQQyn/fHsXngZdqYMbuZYodp45iHW6+WNBuCS9GcaXYvw8se:sxZrBqXn/fHs3gzqYDZdxHbegX9rkmj8
TLSH
T17482E806A624597B9CDBD119F945BB93E7F80423D5905E84A9FCCE1C04E6BED222382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 86ece13c22bddd2532483000b44581ba8bce4c757670db97462a5ea8720546eb
MD5 35510ac9ed6371784b6b89536d07fa0a
SHA1 c1ec585c3bebdec82896d99c0fb7e8dbf971d433
SHA512 1ec513b1c3726f0237ac4a8109837758dcbbc8b120fd875116c0cf29d7c3e37f616db4bf4ccdc87016c8c2d244556d3ce8a50b638775489ddc1a24248b04ec80
SSDEEP 192:sxZrRcyMqZjK1Ml8MWPn/fHsXngZdqYMbuZYodp45iHW6+WNBuCS9GcaXYvwxB9A:sxZrBuPn/fHs3gzqYDZdxHbegXZrkmj8
TLSH
T1C082E906A624597B9CDBD119F945BB53E7F81033D5905E84AAFCCE1C04E6BED222382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fdd9071df340df93d235199b326514b93e59cd4085643b5952732fcdd63749fe
MD5 758f51cf022190b92ed6f08846bf1efa
SHA1 ba7283cd5e7da0da6ff1fb18a70853811bd77af8
SHA512 f0257c4290516d872551d11ca02429cbb348565d3255e56227b0d226a1bd658b912efd3af3fdc7d2c74e8c8c8c51bc61b90732dc8a1a20eb7dc349c55c8c2885
SSDEEP 192:sxZbRcyMqZjK1Ml8Mkn/fHssfnCaZdq5zodpciHW6+WN9hq/YvZuX9rk2BIgjYJ:sxZbBMn/fHssfCazqyHHbq/xrkmj8
TLSH
T1F062E9156A385A7B8CDBD209F545BB53D3F81163D1914E449AFC8E1C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\29cd4c3e-3721-4716-aa4b-d15fbb00ec27\index-dir\the-real-index
Size 72B
SHA256 5bec41d9e76000f2e49303d30e376cb2b7a1fd5c181940c060dcbacd47c661fb
MD5 0ab071e0f7e4021adcc39ba4f36d0d64
SHA1 53e34d17550af15c8559de72780b84e4d1578095
SHA512 f7f0895e1d67bedf758601494c2ee496f7e34c9a457e28a266116421e73e47c503633fc959cfdfd0dc8b0cb9fb239b499a1b225d7fd2978568071bdd6fe20e8a
TLSH
T1FEA002D00340444EC909A67C37D34140233E5D7081432605D2E1E9B9CCD21444202185
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592cd3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\29cd4c3e-3721-4716-aa4b-d15fbb00ec27\index-dir\the-real-index~RFe592cd3.TMP
Size 48B
SHA256 408c0d2238d95e61f8afafd906287f263ca239ef61b95130ae3e93c0b8ea3512
MD5 67cb72319b59fde553ebbe702f2ff99d
SHA1 d2bf61552a10d18922a4b232b8bb0e5858b1337e
SHA512 3c49b27336e771002d5fc24a514bcea95dfde6ac3f52a0ae064a45c44143d3b41e8c287d6296fde71d75ecde443e175e3ff0fe702c3d3e38e123fbd4cd73f049
MD5 SHA1 SHA512

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\4f2277ea2139c475_0
Size 81KB
SHA256 cf1fe4ca1e2bbf03096121124cd53067fc3ec66dfe444f1a990683d64c23d534
MD5 34156138f5ebe8dc049e39ae91c5426a
SHA1 22a8b3fdfd11c5edd7f92bcad42f5b580d45fe5a
SHA512 a226b9c9aabedf98acfc23f24b79d5aaa7becba4bada13999d74649047ea6ce994c44178dc621b94587bf80e4f500fb1f9c7cb72fcb6d16cfcf166edf07c7ac1
SSDEEP 1536:cTAbZAK++HqsJ00izhh2VMGz4XLHAyOAqUO4P2CsXEoTr7f+vdJbYqHPwqYzGQ/O:cSv+nKrVMGzALgyOpY2d/n3/O
TLSH
T110833BA6B262703587AD11D59456BB01F22B07561448C8FCF07CAA963F18ECB53B7FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index
Size 72B
SHA256 f88fa9818ef871e0aa5728321643f44f12c12e4ff805b067a2d8c5a0fbf4baa8
MD5 e2d6ab04fdcd533018320cb95a988e9e
SHA1 51b588fafc48bbbb695e08707965041b9cdf60bc
SHA512 9d23f2639e998e556be8ff97ca2a7128f1b2f72b091ae27430cc1e2985c41e8d5d0787df4aaf867a02664271044da8c53d42de5c69e1daf152c43dafc42f0eda
TLSH
T15FA0026005E40462D0D046B3956109512725DD521515438741E857D9CC5515D4B0D283
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 eb635a4c6004cb69496f9761966c04f48f1d13dc78f50701a8e98f521b145154
MD5 1d4821218c1b569f903432f075d90dc5
SHA1 756433a6c9499011faa6faacfd1d5ffda0272df6
SHA512 bd6f77a4ee1679b0f6f5cb15a5f860e96248baca7292b2a59e42e6bfba962cb5c6151b5d2bfec479e6dc43a022b437419312fcfbacd5aff9b5998d079adaaac4
TLSH
T12E51954E4D871F1AC5AC02B214FA185037B878DE57584A9774ACB174A88732A2D1D7AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59458b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index~RFe59458b.TMP
Size 2KB
SHA256 d93af11201e60bb1f9cad5908c6351cb0662fec86f2a6303f8a0ec496b2d365a
MD5 58bd481aeae4595d323334a37884cc35
SHA1 a062e86a8c5f03aacb081948496deb2e7301e9ae
SHA512 9ea5992136ee038e3ae05ae40b351699a2cad943c6ec95c37ac4a6a8efd4b8400aed79e2097a43e77057a395fff0c31e83a7465321c56dc8df6033fb6ae29cef
TLSH
T15751665A4D824639E8D441770DE3A4A437391900C616BF5374FC9636ACD37AE3D1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 3df38e29c445d60e2f29971087cb35887107f1f44b1fdca56805d44284e0de54
MD5 d296ebc3c8540a14512fff0ebdf604e2
SHA1 7f2d170b531768e8418bd390a59f03d9c07381ed
SHA512 f553ba0be49378f31e7b0c591403c5b9f65273ff7c0bb42d9d985e340ce9dcdaeaba49f72b38e4fc72aaf36a58746a068497ed3678e2158ad1cd733bb1432e0a
TLSH
T14DA002954681304AD18616F476AA03412314CD9002111387469151ACCC90B455F4344C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5924f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index~RFe5924f3.TMP
Size 72B
SHA256 e82b1c0d6566a8ec1cbade3c89a1ee7a67c071c44022515d84f7fa8a71c1baa6
MD5 141fc0662fb5671356672a0e4bdfa309
SHA1 d96e1bacf2aa023cae4f5b9f871cfb7ff025399c
SHA512 6e8785ab9cdc1d6b827c0047b4f7922a4dac5802dfc43aa03bb0293b981ef45fa5a985c93b96d91996615ba19939cf72696a6fbe7ceefc9f97e277248a5d608a
TLSH
T114A00414CFC40147C11713F1155313C31301CDD57344174740D7544CCC54540FDC504C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 b63bb7000c5661faa066d8250b0636c660cf62e52e76d19dc78c283e4bcaee2b
MD5 2d065cb29b2d68a567e69d585708c9af
SHA1 a07b0953e669ccb6dd8f629d7f9e30126bad6ae0
SHA512 33e59893d376878d4ed3a06f7a48a3e3d4e815df4124f105faa973c02edc580a88eb74ba5f14c13a95e9a025b2fe1765272eec60aacc943167414ea68c5b7325
TLSH
T1A1F020B77FFB1850FDBBD3DA203108B0010AB954D860EC1F6426F69794F1329206ACB6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 de2101ac75bc552910cc397038f88421598ecd1022fc42d6ac3be38210c2ddf3
MD5 e815696cbb611a619da73a32986c712e
SHA1 052f249a69576953fa6f7f753b2a2b92f6675b11
SHA512 1f0865fa2ead24ba05398e63ef4c7b5c0727ee65a2ae4c1f0db8268678ee77c43359415afffef4aaf926378a7bed9d098187443722524e43cd08cdb32886fed4
TLSH
T164F027777FF71850FDAB93C62131046004097D54D891AD5F6416B69B90B131D205DCA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4f70eb0322148a0b37af0fff4bc36ec987bfedd0a0caa59fbdd46b9ef3d39a22
MD5 ff749a9cf53719465e13157a8dc5074c
SHA1 f9f48fd89cde343c257f5e16b1e3347df305cb4e
SHA512 53649b6b9509f8f545e158590f115ad7eb6cca25176f66ee83d808e49d30d25c39d6817f6e0484bc60dcd2db3920a604c92560888ef0baaccd7bcd473ac1e31a
TLSH
T1E9A0026AC9648441C0240370907912946215CCE856A9233560FD0194DA68BC449A2144
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59404b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59404b.TMP
Size 72B
SHA256 30d40c8f268850fb288314b9e9ad8c6b8b9016dcd448535b919ed20f41933012
MD5 000add3e147bc535f3a6b0fab98b6067
SHA1 06a94d4b7318a76b9624403536924b79bd9b7da9
SHA512 ea26eb88951a80369345169468d5e8d67b5abc28e0f4dbe88ee467421194b4459869f5138a8ed5d7206c3a11861cc71a0fcbb0190ee81b83264a972a87e2e29a
TLSH
T1D9A0025283891848C43005B5550753602300CD699604175388D0F09CAED1451D571149
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e22c33e82fcf02573b0623db84b342157f238bed6185ed7e92dd41d4806c4b01
MD5 69fb0321e5b007a563fe84744a85dfbb
SHA1 cc7b1a9d5e8dbd1e8c7d25ec9da6919fe8bb4230
SHA512 da3bfc054b2052c659912250d9fa2f83b2dccb10dd21d4794eb9cdd0650295192bc18cd28569ebf47c8063998de0673f59f1a5a7e3cf4be6cda9287fb47f0a28
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGT:05ppxnY753RNBvRJJdt7p5J9XP5N
TLSH
T173B2575A703E0211397E2988B39696364F4235A37058E4AF7FB814A14F67E224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 7040851c719bb752c883adc6d3b50e4c24b24511ede73d811d991987db63ab64
MD5 71e7dbdbb5d7cf04088b63dc654e205f
SHA1 d86497f2030f8e141da4cfedd755570929751d1d
SHA512 54feedfcb088b58027b073e92e76455c2e5a954136324cbd2811b668e87e72490e59572dceb72294b699b8fa32b6ed6301ca7f0c5542513d97b16630d631b97a
SSDEEP 768:pyFccps3fwgbkU3nPkkGgGJc9KEI8p0YM:Is3p9ncTcQEI8p0p
TLSH
T159B24B36EC58DEBBEDE34F89B74A7A07DEE0126785D85AD4DAD85E0D00871DC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 a96d0c559fcdcba53a5ded3754d2e0d4652bb91b62a5b80169dacc4322c079c1
MD5 6fba21ff2aacaf14ab5657c20a87393f
SHA1 864aca97f2d2db9ccc9e7f5513bf0abd7a08c092
SHA512 9849ae767f0d2094966e6204a17c6bb1db6a363f44f6c8ec5ff4d0633aef748b80a058a15a1b22b05417ce924ee3bebd5479a963de3308c5f1a070d1aea37ed1
SSDEEP 768:GiFHvwGwg9kBvjus5AokGgGJccD+KCQiqB:Gkvw8WvjusRTc0hiqB
TLSH
T1E1E2B3F198D79977E8AE8787A73E2D069EBCC113B5885980B7D85D1CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 f3da9e7f75cb934871e77ed7b3088ab0635281170d170c1d90ac7ca2a8dc6bb3
MD5 11671ef7796888996f19699b98a1b570
SHA1 aa049622ce7a03fa6fc1fd33911ee239aee9f80e
SHA512 5b198a131f2782cf17a80090481c17036d51913789664dcb00e8c6580fe13bc4f2b8a12d8ada1f3c65a20fce21d5093d6efa5d1930e0e880e20e7a542d9edec9
SSDEEP 768:GiF2yTnGwg9kBhkus5AokGgGJccDoKCQiqB:G3yTn8WhkusRTc+hiqB
TLSH
T1EFE2B3F198D79977E8AE8787A73E2D069EBCC113B5885980B7D85D1CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bc9e7bd247eae52e4ed8a369e20bcb0105338d5b27637ea14cbbbbe47b08da23
MD5 14242d40a8ee0948a38097dc29e9dc63
SHA1 223715f5e5937d841679ed35b3b9adbce9dd4fcd
SHA512 59b912b99aa35caf1038bfaf3f121054f85c251fac0af7f32831557e4ca5c8e90e0e2e64baf566505744ef1634037db7e65d57679f1f2fe0bf1330f42087c901
SSDEEP 768:GVFvX3wGwg6kBPIus5xkGgGJccD9KCQiqB:G7X3wVWPIusxTcRhiqB
TLSH
T1D1C23976D868DABBBCE78BC5A74A3507EEF4415389CC9AD4D9D85E1C018B1DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bf1aad64f8d7466c05b07d5c8677b7673ab6b76be635b59204bd4a5f2583b06b
MD5 5d4ce44ad707d8d051bc4e9d3027bf93
SHA1 acba5925fe5f5bf1abee2f4ee432fbec099397dc
SHA512 126b871aca7d9c23b53fc46fb4d5fb243fcd7c1fea934f7e2c008490e851d571f6ba970c1aae22373ebfe3f47267442d2a389fa812b53cf60bafa5ed04301a37
SSDEEP 768:plVFvX3wGwg6kBPIus5xkGgGJccD9KCQiqB:T7X3wVWPIusxTcRhiqB
TLSH
T1F7C23976D858DABBBCE78B85A74A3507EEF4415389CC9AD4D9D85E1C01871DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 c3952f12c6d380f6b4376940f3ca3d6e40421e2b5f54b3a29335abaf72152e80
MD5 7b786bc39b64cc31c6e82e5590c64182
SHA1 6056ce1aeb2b9aebd80a3202857696f1573e7770
SHA512 f01f1774480e10ec6d8abb8e3b8d26b92cfa8190f81a45001b2ae60c9eaffbe163dd64e16d81bec9b398a9d86000b05cf12981e4bb617187a90daad0538b30b3
SSDEEP 768:GiFarTnGwg9kBv6us5AokGgGJccD+KCQiqB:GPrTn8Wv6usRTc0hiqB
TLSH
T12CE2B3F198D79977E8AE8787A73E2D069EBCC113B5885980B7D85D1CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ab4fd4164eda1eb93e495124ff3b300f85729556aade9258f6b2ec669e0c1da1
MD5 778ce9f5f46b427517af29c0877649c0
SHA1 3fa700484d04263149e47fc5b9d5a2adaf1b4d8a
SHA512 577e1ba049964d7b6f7f93d6e04dde546b4f2b79babe49584873970df7c86e91c39217f566980041af358129937c1803289261a4c0d76bcd2aecb482e8ef9a8c
SSDEEP 768:GVFHZwGwg9kBv9us5AokGgGJccDmKCQiqB:GDZw8Wv9usRTcWhiqB
TLSH
T114C23936D898DABBBCEB8B85A74A3507EFF4415389CC9AD4D9D85E1D01871DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 642a19e5a71522e22810b013e57753e0b7fcc4db9ae42996e02436bbfbaa246d
MD5 429cb31c863b149a55e2669416e0a8d9
SHA1 66c0a1ddf11dbe148cbb7c188d3ff6278f2fac3c
SHA512 cad273a54fa0b2431d18385a09d059bea0ce5262edd700053af5dbca9fba1948f9d1741b10287c99585fded9c3ac6ccce440ad9e6694c71f02726946526e96c0
SSDEEP 768:plVFQu3wGwgekBRIus5xkGgGJccD9KCQiqB:Tku3wlWRIusxTcRhiqB
TLSH
T1FAC24976D868DABBBDE78BC5A74A3507EEF4415389CC9AD4D9D85E1C00871ED030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ec32b2f8928b289281dd708af95a72eb8b9c95f4cc13f153ac1924b211a75545
MD5 9dc30cf0124415cce33fc151479e9b13
SHA1 bcbaa85da8b6db282c5021daefeaeff08ca14e3e
SHA512 510d0195654fba0a1414b0246810158bb76b6e7ec3d5d9a0f030dece7a4a42c36199bee928b63206391aba4dd26c81c9c8a76a4539dcc53217f58ace0f6a44be
SSDEEP 768:psVFccps3gGwgbkUPOXP5qkGgGJccDdKCQI8p0YM:mRs3go5OXhqTcDhI8p0p
TLSH
T1C1C23B36E858DABBFCD34B89B74A3907DEE4426785CC9AD4DADC5D1D009B1EC430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7f3edea11bb8a13b22ff8083cee41a766db5c443859a309bae1896a0b5e078f5
MD5 b28b095a778760f0545f9db0804c4023
SHA1 59932d7da4484f4b40f80aea2024cd253da574ac
SHA512 9008f89f6bd6831864f9221cdacdaca426b6aa458b1422587de36673c361c4fd278a3537d47cd5e9f39c306ad9b46e5fd4abcadd30319f9ae68a180690133cd9
TLSH
T15B411658A6EE1148B3772F5AAFF7A86E047ABC372F0AD45D00020D4F0A63A41C961737
MD5 SHA1 SHA512 TLSH

Submit Download

20260822104718_56182aac30a0449b86eed317c94e9707.trn

Path C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20260822104718_56182aac30a0449b86eed317c94e9707.trn
Size 9KB
SHA256 a9eca4d7ef8d9ee6ed28ba5670ed445bee88fac17af531b07d281eca22bdb0ad
MD5 4a0877dbb5bac177d1f2f392d416d22d
SHA1 e698b15bbc02e4edac1317244b0095b61804af66
SHA512 7d375fee32574ae9ff6e072c3b7250bbc2fb64494c60a2933c103e6fbfcac8d8f73a4b97e6f11c529e38932bb5e12bbe9d03d62a71b47078c376e9ce656c8385
SSDEEP 192:GlkN77hcvN62xKX+Rm2Lh6jc/GsRC/yOMkFCqCJuugQdGnR/G:P7h6xKOb6Q/VRqyOMXqCJuugLpG
TLSH
T18F12B0703EFC5A652E2E026F7380408F9E654FB58190BF7B02623A1478B1EED445E3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20260822104748_1ca18180ded74d6898e6521db3ad3ffc.trn

Path C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20260822104748_1ca18180ded74d6898e6521db3ad3ffc.trn
Size 2KB
SHA256 d7bff92b24e79e2e6f8a9e54a142de23bdd4a47aaa976e80b19773b74ff58f32
MD5 111da2854136c0fd4d709f4203f8b46e
SHA1 4dba5544b3c1fd954954885fb82e0ea34d2e3e31
SHA512 866c247eb53f2248bd7423bb7cd6b8ad450590e55efeac762983695f44a78aefdaeaee47401cb32333510fefad0b1fcbae531160f6823707427ebe4dc2e9ab66
TLSH
T1E9414D78B06915C0AEC8F53BA093A8E15064335A5C5DF0D0815F592941090298F086EC
MD5 SHA1 SHA512 TLSH

Submit Download

channelManifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\Packages\_Channels\75434614\channelManifest.json
Size 89KB
SHA256 5d79fda930a3d55bc85ca6810b8864f219a00ea3a3761f7775252fe5b1fdc4d7
MD5 e05004a9a5a508593b13a28530d7a254
SHA1 d50187827b32b9f7aa9e707095b3d77203ffed26
SHA512 75275a80adbfbb8ef63835df597f3d221db230beaa39c784d48003dbcc3be0ba0364e63fa180d0505399f82da4ca32f1cf10f80e377e93852529797aa9334789
SSDEEP 1536:CQdxwLaLrw4wRtE0tEaQgxO1bteHPEOxPr:CsxwLaLrw4wRW0WaQSIbtUr
TLSH
T170931B794688197A1B84E7C1F8E9D90CE12C03CE9BD16EB885E4CD14027EBE6D55A0FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoteSettings_Installer[1].cache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BF3JFO81\RemoteSettings_Installer[1].cache
Size 876B
SHA256 40d9c8cbce568fc20c94194f4e3ff0c2f43cced06e94e29e283b8de4b31e9ced
MD5 36bee3c9a29a9b752a6761a703b1a65c
SHA1 7f6219109cbca0d2ee7cfac638cf7032b73c7e2f
SHA512 cc4db85c765c9a5fae07dc17a2d8d0f80af9ff021c33478e17e0b0fa18c2d2dd4532eedcb9b84b678354f476fd4e0ad4b12a8e52fa13a4a50f4d776c66494029
TLSH
T139111E8514521434DAC2EB5B662E2F156FFE2BF68208210E743E302C93B336D9130E33
MD5 SHA1 SHA512 TLSH

Submit Download

dyntelconfig[1].cache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BF3JFO81\dyntelconfig[1].cache
Size 27KB
SHA256 661a2c8f4461ea50e4fbceaf1b83652525f20bcbc07a3418c7c13ed82c941231
MD5 27207c2e9fe216900d5844f5ac09be55
SHA1 2cb1e742f9a4e6a73b8cf58862e7a22cb21e3613
SHA512 38e796c37026f931feb2c76203e216611f8c87d4bd6cd9d785ac195266366fec5690aee530a3ef8167eb01c0bada868dca0c071632097e973057d94330c7299a
SSDEEP 384:fM7fOC2qP6CmTFZ9tg0DI1x8mi+DZPL7awst:U7fOC2qPxyW0DI1x8mi+hL7awo
TLSH
T10ED21495F13DCCB9425F3E1BFD2B640671E0A18160E4F859EFF0AE0993C8B9C915627A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.C2RSignatureReader.Interop.dll

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Interop.dll
Size 19KB
SHA256 00d99aea0c36fe93d05d9c24352de156c19ae032e0a01b9c3a2001290214f520
MD5 202942ed32a0115bf860bf92eb374954
SHA1 69e1ee6138cea430900d35009c6ae695c34b8c22
SHA512 2453b9506980f60ab0ce24e2c26e7ac112db2c74bc37949c82a73d62fc3016d4352976d8b1e428a8d9d74945aae2f047ef5a28eb00d020799721d7fc5f6cd4f1
SSDEEP 384:IosnYZccOlKPZh51WNZzcaGAh0TpoR9z1p2ZW/:IoPZ+uv5uNbh0909zLt
TLSH
T126925B25D7A86373ED6A5E70A1E5E5837D38B3C31C919D6E10C6E34A1C9B389D72023E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.C2RSignatureReader.Native.dll

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Native.dll
Size 122KB
SHA256 63afece6d6fc4c9a88a151c01925e5aeb8e6e3df6b89d20c7dd75463d7bf4802
MD5 b12c31c93238d500cd06df8d39808664
SHA1 91ae6f2e3a478699c4f7d9acbe0ec72c192f2b9f
SHA512 9255ba4be9473d77bd4e081afb50bc6426ecd2066fdc43af7f0a7ba4f16e8f1f26d6af5a39c8a1f00310c67f0917c0112ccb5a5f0323522e98bd71ea2f3d9927
SSDEEP 3072:W0Ywks7oSAhAvk/pWXht0hXOz5MJoZJwi5jE3ibzoqasI:vH7DAAapGj0Fs5MW5ECoi
TLSH
T120C37D507590C072D9BE59390838EE669B3E7990CFA08DD773980BAE0E746C19F31D6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.RemoteControl.dll

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\Microsoft.VisualStudio.RemoteControl.dll
Size 46KB
SHA256 cc52e19735d6152702672feb5911c8ba77f60fdc73df5ed0d601b37415f3a7ed
MD5 355c1a112bc0f859b374a4b1c811c1e7
SHA1 b9a58bb26f334d517ab777b6226fef86a67eb4dd
SHA512 f1e858f97dabeb8e9648d1eb753d6fcd9e2bab378259c02b3e031652e87c29fbabfc48d209983f7074dfc256afd42fa1d8184805534037771a71db517fe16c8b
SSDEEP 768:E3DOuy2r9MhdS0+Mg/n+FbK/lCxkQZ2XJP8MbLVSav7C9zAH:ETOK9MhdStMYn4dtcXJPzbLVSaDez0
TLSH
T1DD235C05937C8B23EADB5E7D69B1D6624A36F7036812E75F4C8CA0D92D93780CD107AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Setup.Common.dll

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Common.dll
Size 584KB
SHA256 8d89246368be6a0487feeec7ca12b2f06c588c5f53ba51393f7f14440f95dc3e
MD5 05328e64241a99a127895efd72246abf
SHA1 c4754d09df835a837574d1fdbf364665d0c70ffc
SHA512 268fc0ef144952b31b3837e40eb8925a8b7b5b4f161cbe4e29aeb460caaa7ed2209f3a12c13d5a435b672e61295bbee6df426575b3093db85dfb0390e540a366
SSDEEP 12288:Tkro+PWvBzybe5/BKNnDBqDYDvoBqfQGov8U5XXdcpROzLnqkknRvaaVq2e2w1Md:4r9UKB5oBqfQGov8U5XXdcpRWLnqkknH
TLSH
T18ED4591277794F7ECA1A5A76B0380A0B56B8E50A630CB17EC55E69493C63F09AD313F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Setup.Download.dll

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Download.dll
Size 307KB
SHA256 a3e3e9983cb5dca2b447e81dad74b9c5cff6e84a767beaa675a5efd7064d1955
MD5 b6e71294c71d32f804ac3b9bec82313c
SHA1 e85afb7780067726d30bd79a007de33b2d748872
SHA512 31cdb07124fb056d3f14ccbaf61615eb47a83923343ab1d4bd8870c4d0fe6fe34544139be26470505c0a0690908485f57fc1ba73876d62693a426cd4df27f962
SSDEEP 6144:Xj3watgARHW3l0Uz1EXZ5w9BEcTRp3sn0f:Xj3/P210Uqp57g
TLSH
T1A4642915BE351B3BF665AAF934311503C9B86A0F6106B63C94DCA98C3DE6F812E147E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Setup.dll

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.dll
Size 1.4MB
SHA256 83c2a462a4037c2884077ac9e0d7e631397517d9e1dac9b0ea7a130420ff268f
MD5 cc7e771f9e820b15c4df3d2ad39d826c
SHA1 b0e06b243a165250f4d5c262abe6f0276d8f0469
SHA512 50caaf599948e8ae4113cc35ed8718491e369cbec60aaff776ca75afa4b34824a8277d2df6a83f4785604b35cf624faf34a2a22f71f4bed19e20cf5d58590b36
SSDEEP 12288:7CnxlCX3hr9KY0up45O/msRgiMsCdlxvfXLvhqoDUKVRD8VYtNzLVMCLYk1GmL/y:A8RrbRuLf9HXVXVRD8V8Ik0mL/5IfA2
TLSH
T133655B00FBF89A27E1BF2B79947119140BF5FA47A775E34D060962EE3E623608D60763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Telemetry.dll

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\Microsoft.VisualStudio.Telemetry.dll
Size 1002KB
SHA256 c6b09bdb01fb84406fb95f77befd68b4f8f0b5d715bb00df817b5e691501c50d
MD5 171cc0c0119bc740d3908edbf2d79c4e
SHA1 34a68325dfc2f0fa64b84209cae3c452691c5a8b
SHA512 c6f69ce2e79636a60626cc6533800a8f301be370c3450b108bee101ff79eac777adf7c18d71c5b86412fcf8ee5120180a1c3fba528ff2b750633f08ad0f5f7c9
SSDEEP 12288:0CYJG3ReZqpwVK09O2xzSr3NqNoMcSSnJdW/jMMMMhv6r4qStkLzhhf1bsd+h2cf:d3XpwVKZ2DSMcS8psYvf1bsdhc5R
TLSH
T1F8255C1133F88726D1EF1A39B474151847B1FA06AA62E35F2A14B2BEAC56350CF617F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Utilities.Internal.dll

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\Microsoft.VisualStudio.Utilities.Internal.dll
Size 61KB
SHA256 4d1d5efd28d72c332ba87e1993cb35e46404753543c5563700b98a97aa3c42a6
MD5 370769c79ea79463adbf0c6476225935
SHA1 2d340026691f83e069c4a87125ca096b9f26c97e
SHA512 5d3af80c54fda6d4d0de06f7b22722d400857743203a745bfcd1667e5e48ea8c2ef7b0c6ffede84b2ea2bd4b74a2ddc766c17392ed07f366d1f0a9b34eb5c63c
SSDEEP 768:3xzXLTPDE2gLJHKjhmpYWPEK/yPmjBkbxfm9OQbcj3gvA9zgH:ZPdIJHKjhMY42bxO9WL6IzgH
TLSH
T164536C00979C8327CAAE0B78A5F4819B1F71D2877942EF67188DE2B81C637C69D117B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\Newtonsoft.Json.dll
Size 705KB
SHA256 d2d6558ed57deb56f75dae21c484e14c457ff607117a30d098a57a9886023048
MD5 b6063154ea48201a2eacf9163cfaadb9
SHA1 a0342ac3446f5acea7862c92f5147f7fc27872c4
SHA512 a938f3f3b7fca097770323d45bca54c4c0f14e574be67b2b474b6824326dded7acbc3673d2300d1ced8645fe52c9b0e7ee2a41181e0fb6b36215dc3f242dd6b2
SSDEEP 12288:OBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUE:OBjk38WuBcAbwoA/BkjSHXP36RMGF
TLSH
T110E4394163F88F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\System.Memory.dll
Size 141KB
SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
MD5 bd7f42207f4fdb9c7eafb0013abd7334
SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
TLSH
T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\System.Runtime.CompilerServices.Unsafe.dll
Size 18KB
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSInstallerElevationService.Contracts.dll

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\VSInstallerElevationService.Contracts.dll
Size 24KB
SHA256 0e1b890dbad83827ec47c7754569ad7b16216f6f39b08069966aa651c5bc6f29
MD5 3acaec331fa3409b94d7b66b333f4995
SHA1 b034d487d3c7b1d5d435b781a19bd9f8c5591141
SHA512 7432f381a0b8cccc0222c5dc019f5f02de9a594997da263f4942d0eda2f53edd8db76a8b34cfeeb2e1931f8209212b033754ed4bdce7d83493cf4e56de7d5d16
SSDEEP 384:ObaUhiB+EStueQ+MaqwyecYnPZmWEgcaGAQ6Sq/RJQNSLq9fPOxFR9z6s2o:ObA+tn7ye7+MbQ6ROSmPO59zWo
TLSH
T16CB26C615BF85223DAF74F71A8E6D0432D78B7836841DA7F1598F2491C9338A8B3272D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

detection.json

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\detection.json
Size 8KB
SHA256 c828a2e5b4045ce36ecf5b49d33d6404c9d6f865df9b3c9623787c2332df07d9
MD5 782f4beae90d11351db508f38271eb26
SHA1 f1e92aea9e2cd005c2fb6d4face0258d4f1d8b6c
SHA512 0a02beeca5c4e64044692b665507378e6f8b38e519a17c3ceccca1e87f85e1e2e7b3598e598fc84c962d3a5c723b28b52ee0351faaec82a846f0313f3c21e0e4
SSDEEP 192:c5RL5JW2ppB82Bp12K/1xXKuFnXquoI8qguTnoiAOXbsECQxV3mb:qqUUs6maY6L
TLSH
T15B02E122D8A4CD33A1F8E72AA2394506F69503EF95901B6F363C548C9FF3C99144CEB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vs_setup_bootstrapper.config

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\vs_setup_bootstrapper.config
Size 635B
SHA256 ea9f85c4a13797257c2489a67966b6405badc6750d3526d9623a1e82203bc0c2
MD5 c0224960b9a1581f2617e08864e8fd3b
SHA1 db7a299977b2db9779d2046c3498a65a8b0629fb
SHA512 5b91da083c69451e079230520f4a42bd230ea7250da658eba868c60bb60b9ffe4cdfc71f504f2cefeea4b2879a686d241d9c62abe168bff6fc86df868740be00
TLSH
T1CBF0F4B7844950968F92B1C38051F465FB67238F2DE18E8CE0E98510471155BD98B2FA
MD5 SHA1 SHA512 TLSH

Submit Download

vs_setup_bootstrapper.exe

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
Size 405KB
SHA256 40e0dc5b6407a5a5f03dd5927de5078848130541e37d7a2d179f76267cb4292f
MD5 8c512b58f8d96fb2a060c839d34a5229
SHA1 34a13b7fa25108e2fab1793ffc2dc97f581b4db1
SHA512 f54a35ee7406b9f035b985428ba57c02d7430abb94a7334d485bb9d403eed481451ca94c305dacc2dc310397762aebe6058f346e8fae1058ac3b16995c729098
SSDEEP 6144:OQqdtiSE/uHXm4D8ZOJP8wOUowVheNdPafjfRc05:kdNEG3mhZEAUomhe7aTRT5
TLSH
T12C94189136E8626EED6F0B38033BA6611F75BDD27751CA6D4F80319D0C3274681A9BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vs_setup_bootstrapper.exe.config

Path C:\Users\Admin\AppData\Local\Temp\7fec486d82f4779b8d94611e27b30df7\vs_bootstrapper_d15\vs_setup_bootstrapper.exe.config
Size 4KB
SHA256 20beda281b5684aa7443274971c3f5231896f3142a1e1b3dbd8f890cca1b295c
MD5 2ab0284f08dae43e95208a2e7ee49336
SHA1 b298b5ff13fc5f1285220c3a6a751e762d6dd463
SHA512 247172a411006d56715e7910edcc65e281479d73b8279df3da0b120d9bf49473e1fdb0dc4b9dc1822e6c44c0d7fdea596142366e059e562a4c9df7583d72a7dc
SSDEEP 48:cErK7h+1/g4az7h+Gglz7h+YgCOz7O7Rgdz7Eg+ez7Ldgdz76g+ez7Yg+Hqz76aU:hr2464J4vdom66mkKGRrbD
TLSH
T1E4917220D1C4ABA58F7255B23D6B6468CB6D03B3288D059DB0EE6E8B8F35D9A5207077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gnauw1aa.json

Path C:\Users\Admin\AppData\Local\Temp\gnauw1aa.json
Size 22KB
SHA256 b513eab2ca269686153292d3f2a766852aff3c374b032ec7c7cec72cb6ed59f3
MD5 584c1aab659621280dcf5b385796f0aa
SHA1 062e437ea7a86b6cb9d1e49fee7da9dce6b49ecb
SHA512 b2c2f4fe3b177d49c134eb9c5000952f7a4cc6d53e9184df7e27c2906708e0b59ff7edbfec4fa5291b617177e7176112fcd1c4fdc1b6cdbe6fcfc92a442885df
SSDEEP 384:GaBLFIcY3BgfTDugHQmAwAAQ9drYBW8L9Sb2YRaAQ2NpAZEfnRMXWYxRO5wkjn2/:5fM3OewXQ9d0xSbR7ginR2WYxk2kjn2/
TLSH
T14DA29DB35B70300C0D9BD940E9AD9BEA3C1CD7624DD264AA7D947C0BCD28B3621939DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o3qhypck.json

Path C:\Users\Admin\AppData\Local\Temp\mhiv3vuj.hgn\o3qhypck.json
Size 17.1MB
SHA256 3891c3018a07338b3880cbb28088bb22ef7762eb9206523655b2e3972b9d527e
MD5 559d4c92cfd3f46531a115a71bf6081c
SHA1 b5decacf2c25687da239c57f0770374aaa309e17
SHA512 dada11c513cb7777b55d835c4927b70bddc433b345423dfa42097a6a90ee9196599d82f7837bb2f75738d55aa1e576aa53c6b33a53ffb689ca810f030c14ae46
SSDEEP 24576:SdVkNGtp6G50T634pr4E+bYevjinwvhuqpsRhOVNlneZYF1Wnf4tvcBuiFj5/CaQ:Sd6T6ZpYYEaVgXf9SpOGOwWC0PPlxs
TLSH
T12207E91EE05C8C75EFF0134966439D92BA7F238B96F5EF88C5C18924C26A3B8551B0E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vs_setup.exe

Path C:\Users\Admin\AppData\Local\Temp\rustup-visualstudiovSmB1w\vs_setup.exe
Size 4.3MB
SHA256 9a3322a2b1b8c632fc5fc105c52990c71158f9ca8feb73690dc2e1317a7f41b9
MD5 3320f3298dba9d4c918708869424b70f
SHA1 36ab9e0a3d811bd7303c4113ae50631c87792b22
SHA512 5d23b3a07d6d1d2899cda8de6785213e1e8bb13deaa1a2e55b732081552aa0e6163c957babd8125a7c30e599294b4aed69050950a89592d6e0bfbbc44b7c31a0
SSDEEP 98304:I39Aky+P12XMj7c8Z/yBSoeOZARldmyK7NBxp:INQW1Djo8Z/yVeOSlMNrp
TLSH
T1E626232379C5583FDD2F0635531BE6B61A7AA8E03B9249AF2F91321D5C305C281B6EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rustup-init.exe

Path C:\Users\Admin\Downloads\rustup-init.exe
Size 9.5MB
SHA256 f574ea2bd6d798b6072b3a45e3053f3cabcc2cb48d6b4bd59b661b41d675b31a
MD5 839b085c2f4d58c79d22f55ef43c820e
SHA1 5c9ecc31a8a264a2c3876d156c3b434717077a7d
SHA512 38dc60c1dacfa520ad9bfab164de89eea13925508997d183d0e56766ce84a2ddbc8da358b6db5d653a5bbe3b0e6e68e3f1f0786c1dae71794014aca259082661
SSDEEP 196608:/lVNdpGQhYBS146r0axTL3q21ve80w0L8fBDKGHDV08:BdpGxB4Qax3a21ve8r0wDKGHDV
TLSH
T19BA66C42F642A1FBCE4741B0B83DF379853B656C972089D3A2949D68AD913F03D72B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-2187-0x00000184307E0000-0x00000184307F0000-memory.dmp

Download

memory/4300-2098-0x0000023F361C0000-0x0000023F361E2000-memory.dmp

Download

memory/4300-2099-0x0000023F36360000-0x0000023F363B0000-memory.dmp

Download

memory/4300-2022-0x0000023F32E00000-0x0000023F32E9E000-memory.dmp

Download

memory/4300-2023-0x0000023F32F60000-0x0000023F33014000-memory.dmp

Download

memory/4300-2024-0x0000023F32AE0000-0x0000023F32B1C000-memory.dmp

Download

memory/4300-2025-0x0000023F32CF0000-0x0000023F32D12000-memory.dmp

Download

memory/4300-2029-0x0000023F32D20000-0x0000023F32D50000-memory.dmp

Download

memory/4300-2020-0x0000023F32B30000-0x0000023F32CB6000-memory.dmp

Download

memory/4300-2019-0x0000023F16CA0000-0x0000023F16FAA000-memory.dmp

Download

memory/4300-2042-0x0000023F32CC0000-0x0000023F32CDA000-memory.dmp

Download

memory/4300-2047-0x0000023F32AB0000-0x0000023F32ABC000-memory.dmp

Download

memory/4300-2040-0x0000023F331A0000-0x0000023F332AA000-memory.dmp

Download

memory/4300-2052-0x0000023F32EA0000-0x0000023F32EB4000-memory.dmp

Download

memory/4300-2054-0x0000023F32AD0000-0x0000023F32AD8000-memory.dmp

Download

memory/4300-2053-0x0000023F32EF0000-0x0000023F32F18000-memory.dmp

Download

memory/4300-2039-0x0000023F32AA0000-0x0000023F32AAE000-memory.dmp

Download

memory/4300-2068-0x0000023F32B20000-0x0000023F32B28000-memory.dmp

Download

memory/4300-2077-0x0000023F32CE0000-0x0000023F32CEE000-memory.dmp

Download

memory/4300-2078-0x0000023F32ED0000-0x0000023F32EE0000-memory.dmp

Download

memory/4300-2079-0x0000023F33540000-0x0000023F335CA000-memory.dmp

Download

memory/4300-2080-0x0000023F33740000-0x0000023F338AE000-memory.dmp

Download

memory/4300-2081-0x0000023F33970000-0x0000023F33A2A000-memory.dmp

Download

memory/4300-2083-0x0000023F33060000-0x0000023F3306C000-memory.dmp

Download

memory/4300-2086-0x0000023F33B80000-0x0000023F33BC2000-memory.dmp

Download

memory/4300-2085-0x0000023F33070000-0x0000023F3307E000-memory.dmp

Download

memory/4300-2084-0x0000023F338F0000-0x0000023F33928000-memory.dmp

Download

memory/4300-2088-0x0000023F33B60000-0x0000023F33B68000-memory.dmp

Download

memory/4300-2091-0x0000023F36130000-0x0000023F36184000-memory.dmp

Download

memory/4300-2226-0x0000023F30F60000-0x0000023F30F68000-memory.dmp

Download

memory/4300-2095-0x0000023F36220000-0x0000023F362A8000-memory.dmp

Download

memory/4300-2096-0x0000023F360F0000-0x0000023F36102000-memory.dmp

Download

memory/4300-2097-0x0000023F362B0000-0x0000023F3630E000-memory.dmp

Download

memory/4300-2224-0x0000023F30D00000-0x0000023F30D08000-memory.dmp

Download

memory/4300-2101-0x0000023F36190000-0x0000023F361AE000-memory.dmp

Download

memory/4300-2021-0x0000023F32D60000-0x0000023F32E00000-memory.dmp

Download

memory/4300-2103-0x0000023F364B0000-0x0000023F365AC000-memory.dmp

Download

memory/4300-2100-0x0000023F360D0000-0x0000023F360DA000-memory.dmp

Download

memory/4300-2102-0x0000023F361F0000-0x0000023F3620C000-memory.dmp

Download

memory/4300-2225-0x0000023F30D40000-0x0000023F30D48000-memory.dmp

Download

memory/4300-2200-0x0000023F365B0000-0x0000023F366E6000-memory.dmp

Download

memory/4300-2128-0x0000023F36310000-0x0000023F36322000-memory.dmp

Download

memory/4688-2181-0x000001985E070000-0x000001985E07E000-memory.dmp

Download

memory/5644-423-0x00000000063F0000-0x0000000006418000-memory.dmp

Download

memory/5644-411-0x0000000005ED0000-0x0000000005F20000-memory.dmp

Download

memory/5644-448-0x000000000A900000-0x000000000A908000-memory.dmp

Download

memory/5644-447-0x000000000A8E0000-0x000000000A8E8000-memory.dmp

Download

memory/5644-446-0x00000000082E0000-0x0000000008884000-memory.dmp

Download

memory/5644-444-0x0000000007C90000-0x0000000007D22000-memory.dmp

Download

memory/5644-442-0x0000000007A30000-0x0000000007AEA000-memory.dmp

Download

memory/5644-441-0x00000000073E0000-0x0000000007446000-memory.dmp

Download

memory/5644-399-0x0000000005E30000-0x0000000005EC6000-memory.dmp

Download

memory/5644-464-0x000000000C6E0000-0x000000000C6E8000-memory.dmp

Download

memory/5644-419-0x00000000061D0000-0x00000000061E4000-memory.dmp

Download

memory/5644-450-0x000000000A950000-0x000000000A95E000-memory.dmp

Download

memory/5644-449-0x000000000B1F0000-0x000000000B228000-memory.dmp

Download

memory/5644-440-0x0000000006AE0000-0x0000000006E34000-memory.dmp

Download

memory/5644-484-0x000000000ADD0000-0x000000000ADDA000-memory.dmp

Download

memory/5644-431-0x00000000068B0000-0x00000000068C0000-memory.dmp

Download

memory/5644-427-0x00000000063E0000-0x00000000063E8000-memory.dmp

Download

memory/5644-467-0x000000000C730000-0x000000000C742000-memory.dmp

Download

memory/5644-439-0x0000000006AB0000-0x0000000006AD2000-memory.dmp

Download

memory/5644-485-0x000000000AE10000-0x000000000AE32000-memory.dmp

Download

memory/5644-415-0x0000000006480000-0x0000000006532000-memory.dmp

Download

memory/5644-407-0x0000000005DD0000-0x0000000005DD8000-memory.dmp

Download

memory/5644-466-0x000000000C7D0000-0x000000000C820000-memory.dmp

Download

memory/5644-403-0x0000000005FD0000-0x00000000060CE000-memory.dmp

Download

memory/5644-395-0x0000000005A10000-0x0000000005B82000-memory.dmp

Download

memory/5644-391-0x0000000000F00000-0x0000000000F68000-memory.dmp

Download