hxxps://gofile[.]io/d/B3tsF1eE

Analysis

user interaction
yes
max time kernel
160s
max time network
244s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/B3tsF1eE
Sample260831-ejyrfsvaqb

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
299	4740	setup.exe
300	4740	setup.exe
201	3824	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	VisualStudioSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
5276	VisualStudioSetup.exe
5572	vs_setup_bootstrapper.exe
232	setup.exe
3256	vs_installer.windows.exe
3408	VSInstallerElevationService.exe
4740	setup.exe
3264	BackgroundDownload.exe

Loads dropped DLL 24 IoCs

pid	Process
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5540	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5080	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
27	api.gofile.io
30	api.gofile.io
32	api.gofile.io
26	api.gofile.io

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\fr\Microsoft.ServiceHub.Framework.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\es\Microsoft.VisualStudio.Services.WebApi.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\ja\Microsoft.Internal.VisualStudio.UserNotifications.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\Microsoft.VisualStudio.Language.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\tr\Microsoft.VisualStudio.ExtensionEngine.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Setup.Download.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\zh-Hant\Microsoft.VisualStudio.Shell.15.0.resources.dll	vs_setup_bootstrapper.exe
File opened for modification	C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\Microsoft.Build.Tasks.Core.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\zh-Hans\StreamJsonRpc.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.Identity.Client.Broker.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\ja\Microsoft.VisualStudio.Extensibility.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\System.Diagnostics.DiagnosticSource.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\zh-Hans\Microsoft.VisualStudio.Shell.Framework.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\zh-Hans\Microsoft.VisualStudio.Composition.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\de\Microsoft.VisualStudio.Shell.15.0.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\tr\Microsoft.VisualStudio.ExtensionsExplorer.UI.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\fr\Microsoft.VisualStudio.Setup.Download.resources.dll	vs_setup_bootstrapper.exe
File opened for modification	C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\Remote Debugger\x86\Runtime\Microsoft.VisualStudio.Debugger.Runtime.Impl.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\layout\setup.exe	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\ja\Microsoft.VisualStudio.Setup.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\ja\VSIXInstaller.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\pl\Microsoft.ServiceHub.Framework.resources.dll	vs_setup_bootstrapper.exe
File opened for modification	C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\IntelliTrace\x64\Microsoft.IntelliTrace.Profiler.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\feedback.exe.config	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\de\Microsoft.Data.SqlClient.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\pl\Microsoft.VisualStudio.Extensibility.Framework.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\feedback.exe	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.Data.SqlClient.SNI.arm64.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\System.Security.Principal.Windows.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.Extensions.Caching.Memory.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\pl\Microsoft.VisualStudio.Services.WebApi.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\ru\Microsoft.VisualStudio.Services.WebApi.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\Microsoft.VisualStudio.ExtensionManager.dll	vs_setup_bootstrapper.exe
File opened for modification	C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\Remote Debugger\x64\Runtime\Microsoft.VisualStudio.Debugger.Runtime.Impl.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\pt-BR\Microsoft.TeamFoundation.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\cs\Microsoft.VisualStudio.Services.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\tr\Microsoft.VisualStudio.Utilities.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\zh-Hant\Microsoft.VisualStudio.ExtensionEngine.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\pt-BR\Microsoft.VisualStudio.Setup.InstallerResources.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\zh-Hans\Microsoft.VisualStudio.Extensibility.Framework.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.version.json	vs_setup_bootstrapper.exe
File opened for modification	C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.Debugger.Runtime.Impl.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\cs\Microsoft.VisualStudio.ExtensionsExplorer.UI.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\Microsoft.Internal.VisualStudio.Shell.Framework.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\pl\Microsoft.VisualStudio.Shell.15.0.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\ru\Microsoft.VisualStudio.Threading.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\ja\vs_layout.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\de\Microsoft.VisualStudio.Services.Gallery.WebApi.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\de\Microsoft.VisualStudio.Utilities.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\ru\Microsoft.VisualStudio.Services.Gallery.WebApi.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\System.Threading.AccessControl.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\de\Microsoft.VisualStudio.Setup.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\fr\Microsoft.Internal.VisualStudio.UserNotifications.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\zh-Hans\Microsoft.VisualStudio.Services.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\tr\Microsoft.ServiceHub.Framework.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\es\Microsoft.VisualStudio.ExtensionEngine.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\pt-BR\Microsoft.VisualStudio.ExtensionsExplorer.UI.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\tr\Microsoft.VisualStudio.Shell.Framework.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\zh-Hans\Microsoft.VisualStudio.Setup.Download.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\System.Composition.AttributedModel.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\MessagePack.Annotations.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\zh-Hant\Microsoft.VisualStudio.Services.Common.resources.dll	vs_setup_bootstrapper.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VsixInstaller\tr\Microsoft.VisualStudio.Validation.resources.dll	vs_setup_bootstrapper.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	ngen.exe
File created	C:\Windows\Installer\e59e13e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE248.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3E168EB5-DECE-498E-8B9B-7CBB1C658E2C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE314.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\e59e13e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	getmac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VisualStudioSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vs_setup_bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	vs_setup_bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3824	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vs_setup_bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vs_setup_bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vs_setup_bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326223524566296"	msedge.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{4E00B2DC-4E49-4AEA-B754-02367A75CA0D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\ProxyStub\\x86\\Microsoft.VisualStudio.Setup.ProxyStub.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\ProxyStub\\x64\\Microsoft.VisualStudio.Setup.ProxyStub.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\NumMethods	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\NumMethods\ = "4"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ = "IVsSetupShutdown"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ProxyStubClsid32\ = "{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\NumMethods\ = "4"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ = "IVsSetupShutdown"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ProxyStubClsid32\ = "{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32\ThreadingModel = "Both"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6377A4B2-F371-4E8D-B723-3BCD433C6EE5}\InprocServer32\ThreadingModel = "Both"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB81D09-E26A-4272-8B83-387BA64FE1C6}\NumMethods	setup.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D30F05F637E605239C0070D1EA9860D434AC2A94	vs_setup_bootstrapper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D30F05F637E605239C0070D1EA9860D434AC2A94\Blob = 030000000100000014000000d30f05f637e605239c0070d1ea9860d434ac2a941400000001000000140000001e82df0ed78cb3d70234830edaabad65b9afb8ec040000000100000010000000c36fa33c215586085991904a6602bc8a0f0000000100000030000000c64ce3455898f871d11c14da412aac58fa2022d4213d8ac05f8dd6909b2fb0fcc76c19a1913df5bc0cb1662229ad15d1190000000100000010000000928311586be0737592bb924f9fee51645c0000000100000004000000001000001800000001000000100000003c70faea25600ce3b2cc5f0b222ed6292000000001000000c1060000308206bd308204a5a0030201020213330000001c489f81dfa1b0b77700000000001c300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3234303830383231333632335a170d3335303632333232303430315a305f310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3130302e060355040313274d6963726f736f66742057696e646f777320436f6465205369676e696e6720504341203230323430820222300d06092a864886f70d01010105000382020f003082020a02820201009a7d6b7d27c1762a2eaee3d534ffcc2b6deefc54f820a3fbb06489f4bf07681728653b395f525d12463f5c85b39a7a8e9b188b8718cc5e7a015d001269848d5f304f696f3d4e4184ddf0577d07a983c86048f93f75977f49170fd7ef8d47f5180b5712b889f30ec02cd695126f51b3878f03466c6076826d4e640542500d7bfbea169f39c420745080dc8df362d7f35f6bcec31f3bb8339a0aec8a39166287d737cd37fe4cb0b94182f28553019c35c41c33abbdac3dd834b222aa5d8115a9b9fcea0c5cb57a05639285d985bfbda59f61794ccd5d35e13a85f37b187a63300be1f9415a6f81735850c8449e9c4bc12739d5fb6e6ede1efb8e380c518e38f965d0e2ef6a75d0defd4e5278068a46fbe26e68b8cfb411a4bbd9b256b408f88e506cf4d03a39b1f902d04c25b12cdf337fbc03daecc8554e8160d53f3b7df0e24fd84a1a10eabc184f460a83768bbff80b6142c1f7f505209325664ed5672bd8cb5e244e94c4657e8a103c9cde7560f283d9d606a1ec2b5ef4730bfd47a14792be565fd267fd18712dbef91b255451a3a3c17f499de6df3b55bd6633f7c8a757b2a726b1997920a5c070bb296c3aada4495389e7004fa1a12cb0991e31c2a712ebaefbe50a7431e54b40edb188cdd109ceb9cbd3752b1dbe1cca3928c91775d5aabf5fd82f78e4b5d3e6bc4a20750810305c35853a04a0c31faadfa4a38e0928a50203010001a382014630820142300e0603551d0f0101ff040403020186301006092b06010401823715010403020100301d0603551d0e041604141e82df0ed78cb3d70234830edaabad65b9afb8ec301906092b0601040182371402040c1e0a00530075006200430041300f0603551d130101ff040530030101ff301f0603551d23041830168014d5f656cb8fe8a25c6268d13d94905bd7ce9a18c430560603551d1f044f304d304ba049a0478645687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f4365724175745f323031302d30362d32332e63726c305a06082b06010505070101044e304c304a06082b06010505073002863e687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f4365724175745f323031302d30362d32332e637274300d06092a864886f70d01010c05000382020100435ff8df3fbbe9948c3b5cf5bb68039d9105cd1754348131004cab1bb9ea15c7070b9cb545acd5706a0c33081421eef5ce98fd417e4cdf042208e7ba30292989873f87f810cdc04529a5ceba45e68cce271d01039154bf58e6a5d7ffd996eaa6f0b1971bff1b54782a3ad29a6a8f1f3b3a8a0c376fb4536e3ec1c484bc7ce224c18590841d9f2e3960fb71d2ac318f1488692095956a630847b6bbd8e1a89e375fe39aeca70a881eeca7654e1abf2f6bb81fd18616f09be7cc6fc04c79c21a4e6928871fc4659e4635670dea84d85b71b604cdc1dd8ce75a497db78b213fad1f32e7beda4b1d1c659213c1154dd4a6194763d23ad4738ea5195149212177fccc5cc6794d78fd4a872afe6734f812db3f23b9ae7e968b9cb6a5ccc476cc8ba118e0165acc1eb1b8ed173915505803476496f74dc8d172a56cf100eaaf1ea47189f6ba3187ce67b0429c04d530e12729ebc282a92a4505a2a2c95d6c91dfa5f14e7458d78f31bf41cf3d0e7c049a97cbf9b101be0d6d3590df88f9129421b339239d30263887ca6405343b1ba1b171f48f799821043d4edf519dd54ff1ce5156e4997ee5b480bf79002ee463bc7eef9c7844ccc9bbdba3150ce1d60d0be3f3a285317e60b40ee291c01db56d7f7e69cb88064c489b811ddced7dc3554ba00ed434e52e27bcfa350d96ffeabb7277ce3e5d9054be2a96009b9544f6be6429965577	vs_setup_bootstrapper.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
5572	vs_setup_bootstrapper.exe
4740	setup.exe
4740	setup.exe
232	setup.exe
232	setup.exe
4740	setup.exe
4740	setup.exe
4740	setup.exe
4740	setup.exe
3188	msiexec.exe
3188	msiexec.exe
5080	powershell.exe
5080	powershell.exe
5080	powershell.exe
3264	msedge.exe
3264	msedge.exe
4740	setup.exe
232	setup.exe
232	setup.exe
4740	setup.exe
4740	setup.exe
4740	setup.exe
4740	setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	5572	vs_setup_bootstrapper.exe
Token: SeDebugPrivilege	232	setup.exe
Token: SeDebugPrivilege	4740	setup.exe
Token: SeShutdownPrivilege	4740	setup.exe
Token: SeIncreaseQuotaPrivilege	4740	setup.exe
Token: SeSecurityPrivilege	3188	msiexec.exe
Token: SeCreateTokenPrivilege	4740	setup.exe
Token: SeAssignPrimaryTokenPrivilege	4740	setup.exe
Token: SeLockMemoryPrivilege	4740	setup.exe
Token: SeIncreaseQuotaPrivilege	4740	setup.exe
Token: SeMachineAccountPrivilege	4740	setup.exe
Token: SeTcbPrivilege	4740	setup.exe
Token: SeSecurityPrivilege	4740	setup.exe
Token: SeTakeOwnershipPrivilege	4740	setup.exe
Token: SeLoadDriverPrivilege	4740	setup.exe
Token: SeSystemProfilePrivilege	4740	setup.exe
Token: SeSystemtimePrivilege	4740	setup.exe
Token: SeProfSingleProcessPrivilege	4740	setup.exe
Token: SeIncBasePriorityPrivilege	4740	setup.exe
Token: SeCreatePagefilePrivilege	4740	setup.exe
Token: SeCreatePermanentPrivilege	4740	setup.exe
Token: SeBackupPrivilege	4740	setup.exe
Token: SeRestorePrivilege	4740	setup.exe
Token: SeShutdownPrivilege	4740	setup.exe
Token: SeDebugPrivilege	4740	setup.exe
Token: SeAuditPrivilege	4740	setup.exe
Token: SeSystemEnvironmentPrivilege	4740	setup.exe
Token: SeChangeNotifyPrivilege	4740	setup.exe
Token: SeRemoteShutdownPrivilege	4740	setup.exe
Token: SeUndockPrivilege	4740	setup.exe
Token: SeSyncAgentPrivilege	4740	setup.exe
Token: SeEnableDelegationPrivilege	4740	setup.exe
Token: SeManageVolumePrivilege	4740	setup.exe
Token: SeImpersonatePrivilege	4740	setup.exe
Token: SeCreateGlobalPrivilege	4740	setup.exe
Token: SeRestorePrivilege	3188	msiexec.exe
Token: SeTakeOwnershipPrivilege	3188	msiexec.exe
Token: SeRestorePrivilege	3188	msiexec.exe
Token: SeTakeOwnershipPrivilege	3188	msiexec.exe
Token: SeRestorePrivilege	3188	msiexec.exe
Token: SeTakeOwnershipPrivilege	3188	msiexec.exe
Token: SeRestorePrivilege	3188	msiexec.exe
Token: SeTakeOwnershipPrivilege	3188	msiexec.exe
Token: SeRestorePrivilege	3188	msiexec.exe
Token: SeTakeOwnershipPrivilege	3188	msiexec.exe
Token: SeDebugPrivilege	5080	powershell.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
232	setup.exe
232	setup.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1172	1852	msedge.exe	85
PID 1852 wrote to memory of 3824	1852	msedge.exe	87
PID 1852 wrote to memory of 3552	1852	msedge.exe	88
PID 1852 wrote to memory of 2328	1852	msedge.exe	89
PID 1852 wrote to memory of 3552	1852	msedge.exe	88
PID 1852 wrote to memory of 3552	1852	msedge.exe	88
PID 1852 wrote to memory of 2328	1852	msedge.exe	89
PID 1852 wrote to memory of 2332	1852	msedge.exe	90
PID 1852 wrote to memory of 2332	1852	msedge.exe	90
PID 1852 wrote to memory of 2332	1852	msedge.exe	90
PID 1852 wrote to memory of 1212	1852	msedge.exe	91
PID 1852 wrote to memory of 1212	1852	msedge.exe	91
PID 1852 wrote to memory of 1212	1852	msedge.exe	91
PID 1852 wrote to memory of 3864	1852	msedge.exe	92
PID 1852 wrote to memory of 2676	1852	msedge.exe	93
PID 1852 wrote to memory of 3864	1852	msedge.exe	92
PID 1852 wrote to memory of 3864	1852	msedge.exe	92
PID 1852 wrote to memory of 2676	1852	msedge.exe	93
PID 1852 wrote to memory of 2676	1852	msedge.exe	93
PID 1852 wrote to memory of 4740	1852	msedge.exe	97
PID 1852 wrote to memory of 4172	1852	msedge.exe	98
PID 1852 wrote to memory of 4740	1852	msedge.exe	97
PID 1852 wrote to memory of 4172	1852	msedge.exe	98
PID 1852 wrote to memory of 2300	1852	msedge.exe	99
PID 1852 wrote to memory of 2300	1852	msedge.exe	99
PID 1852 wrote to memory of 2300	1852	msedge.exe	99
PID 1852 wrote to memory of 4032	1852	msedge.exe	101
PID 1852 wrote to memory of 4828	1852	msedge.exe	102
PID 1852 wrote to memory of 3888	1852	msedge.exe	103
PID 1852 wrote to memory of 4828	1852	msedge.exe	102
PID 1852 wrote to memory of 3888	1852	msedge.exe	103
PID 1852 wrote to memory of 3888	1852	msedge.exe	103
PID 1852 wrote to memory of 3620	1852	msedge.exe	104
PID 1852 wrote to memory of 2256	1852	msedge.exe	105
PID 1852 wrote to memory of 2256	1852	msedge.exe	105
PID 1852 wrote to memory of 2256	1852	msedge.exe	105
PID 1852 wrote to memory of 5016	1852	msedge.exe	106
PID 1852 wrote to memory of 5016	1852	msedge.exe	106
PID 1852 wrote to memory of 2152	1852	msedge.exe	108
PID 1852 wrote to memory of 2152	1852	msedge.exe	108
PID 1852 wrote to memory of 2152	1852	msedge.exe	108
PID 1852 wrote to memory of 4776	1852	msedge.exe	111
PID 1852 wrote to memory of 4776	1852	msedge.exe	111
PID 1852 wrote to memory of 4776	1852	msedge.exe	111
PID 1852 wrote to memory of 5032	1852	msedge.exe	114
PID 1852 wrote to memory of 5032	1852	msedge.exe	114
PID 1852 wrote to memory of 5032	1852	msedge.exe	114
PID 1852 wrote to memory of 3364	1852	msedge.exe	115
PID 1852 wrote to memory of 3364	1852	msedge.exe	115
PID 1852 wrote to memory of 3364	1852	msedge.exe	115
PID 1852 wrote to memory of 5700	1852	msedge.exe	120
PID 1852 wrote to memory of 5708	1852	msedge.exe	121
PID 1852 wrote to memory of 5716	1852	msedge.exe	122
PID 1852 wrote to memory of 5836	1852	msedge.exe	123
PID 1852 wrote to memory of 5836	1852	msedge.exe	123
PID 1852 wrote to memory of 5836	1852	msedge.exe	123
PID 1852 wrote to memory of 5940	1852	msedge.exe	124
PID 1852 wrote to memory of 5940	1852	msedge.exe	124
PID 1852 wrote to memory of 5940	1852	msedge.exe	124
PID 1852 wrote to memory of 6084	1852	msedge.exe	125
PID 1852 wrote to memory of 5276	1852	msedge.exe	126
PID 5276 wrote to memory of 5572	5276	VisualStudioSetup.exe	129
PID 5572 wrote to memory of 5700	5572	vs_setup_bootstrapper.exe	130
PID 1852 wrote to memory of 3364	1852	msedge.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/B3tsF1eE
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa5408c188,0x7ffa5408c194,0x7ffa5408c1a0
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,5359952144700318356,11530881544304964947,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,1454576598267555174,9805477776803646545,262144 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:2
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,13062577944898876518,7807488025287491730,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,3543581780182595169,18443007188385799970,2097152 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,12192490935047740100,12856496470585817973,2097152 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,4911984260886815917,98970546815558671,2097152 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,17633285753852589490,13896584606940238400,2097152 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,11507250268952097231,7878024157926745959,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,975806028581405473,17953949089906587834,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5672,i,9034473588462437387,12187905886976412616,2097152 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2126856469226281443,17189957557753956780,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2126856469226281443,17189957557753956780,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,2630932544062917835,12520823752431711322,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6488,i,1827377789314353530,7747985037419533423,2097152 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,10747216596370480182,8031402606419673937,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7148,i,6702322186323108627,16953199027597075865,2097152 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,11617839083093808543,2647991980503587695,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4224,i,13061106855530350270,1118200307779867863,2097152 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4212,i,13924434490818877901,3013936521343092506,2097152 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7376,i,2306728924558132121,8422539954201591201,2097152 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4188,i,17728492111423101381,14126041251710940974,2097152 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,5513181349726400271,2965456490417442014,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:8
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7636,i,9199032679784944469,8603579434363770714,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7616,i,10329762624250508378,15331214755213190331,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7616,i,15683291349068871808,7269260895507526012,2097152 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7396,i,9712977847617900812,102627284524584588,2097152 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,2953586119103447234,14760785833273248299,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:6084
- C:\Users\Admin\Downloads\VisualStudioSetup.exe
  "C:\Users\Admin\Downloads\VisualStudioSetup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5276
- - C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\Downloads\VisualStudioSetup.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\Downloads"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - C:\Windows\SysWOW64\getmac.exe
      "getmac"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5700
  - - C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" /finalizeInstall install --in "C:\ProgramData\Microsoft\VisualStudio\Packages\_bootstrapper\vs_setup_bootstrapper_202608310459459498.json" --locale en-US --activityId "90d924da-a889-4161-b7d2-913197e00bf7" --pipe "b58c9809-176e-4538-bdfe-5bfd2b906068"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:232
    - - C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe" /finalizeinstall 6F320B93-EE3C-4826-85E0-ADF79F8D4C61 "Visual Studio Installer" "Microsoft Visual Studio Installer" 4.9.50.62957 0 "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"
        5⤵
        Executes dropped EXE
        
        PID:3256
    - - C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" elevate --activityId 90d924da-a889-4161-b7d2-913197e00bf7 --handle 66440 --locale en-US --pid 232 --pipeName c55eabcd281d44ff97f5c8c9263f98cc --serializedSession "{\"TelemetryLevel\":null,\"IsOptedIn\":true,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":\"f144292e-e3b2-4011-ac90-20e5c03fbce5\",\"AsimovInstrumentationKey\":\"AIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\",\"CollectorApiKey\":\"f3e86b4023cc43f0be495508d51f588a-f70d0e59-0fb0-4473-9f19-b4024cc340be-7296\",\"AppId\":1000,\"UserId\":\"d551e439-a407-4eef-8027-faa3340c40b1\",\"Id\":\"70049cf7-b9e9-486d-b096-4e20874d7d11\",\"ProcessStartTime\":639237456107934281,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[{\"AdditionalProperties\":[],\"Id\":\"a02930d9-c607-41c3-8698-0fd9196735a5\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.setup.*\",null,null,null,null,null,null,null]},{\"AdditionalProperties\":[],\"Id\":\"64a13603-6d89-42e4-a299-13f77e5ad306\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.willow.*\",null,null,null,null,null,null,null]}],\"BucketFiltersToAddDumpsToFaults\":[]}"
        5⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4740
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoLogo -NoProfile -Noninteractive -File "C:\Program Files (x86)\Microsoft Visual Studio\Installer\PrecheckTools\Microsoft.VisualStudio.Setup.TestPowerShell.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5080
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" queue pause
        6⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4592
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" queue pause
        6⤵
        Drops file in Windows directory
        
        PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,2382746279950427904,3768321074464979967,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,635378030356024817,3128238848198429797,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,7828303219511305342,6623627299210215533,262144 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,15674677201202665740,9061577177744862222,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,14327345199677081738,7406214271021139809,524288 --field-trial-handle=2688,i,11182270899359336966,10484305599828339061,262144 --variations-seed-version --mojo-platform-channel-handle=1348 /prefetch:8
  2⤵
  PID:6068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:708

C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe
"C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe"
1⤵
- Executes dropped EXE
PID:3408

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3188
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4F2B5418D1EE7A0B4DD1C9C98AE4DF82
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5540

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c4 0x2fc
1⤵
PID:5396

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe
"C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe"
1⤵
- Executes dropped EXE
PID:3264

C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" resume --installPath "C:\Program Files\Microsoft Visual Studio\18\Community" --runOnce --installSessionId 4c66123a-861d-4c04-8c8b-b6e25b436273
1⤵
PID:5088
- C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" resume --installPath "C:\Program Files\Microsoft Visual Studio\18\Community" --installSessionId 4c66123a-861d-4c04-8c8b-b6e25b436273
  2⤵
  PID:180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59e141.rbs

Path C:\Config.Msi\e59e141.rbs
Size 889B
SHA256 da2cd2dae986900c10ba1434c0180fea59897ddd48aba64c9680b4cae0394bed
MD5 0c73c2f8260dacc93ce8475b7f2f2493
SHA1 e75894306c613d74068807870562e05924527e70
SHA512 0a8bafa498108a3537216c315c58b7d209052783a2d706310074005ec16d3784c79c6cca0205b96d945d0f1966a4a2a582a2806b77d589b518971a32b605b504
TLSH
T1E111664F8B4AAED2C18A8238DE131F01777B81B0C332078A184D92745E837D8CFED181
MD5 SHA1 SHA512 TLSH

Submit Download

msalruntime_x86.dll

Path C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\msalruntime_x86.dll
Size 2.4MB
SHA256 522a28a0f14ab13ca177957e4f4db0201879960d43cc6594e3f54dc60ca4ca2a
MD5 d5b31869fbb789651ca4b126654a7f8a
SHA1 820850aa9fa7cd70d7daabc9ba55ae5f6d8cdace
SHA512 8c458913b3697225d36d76fd4224d8112184afee2ee17cd0f7db52e901a1f533901c754f504297d25e771a006593d43c434250fa37b720b5b8ef175c0035a9d8
SSDEEP 49152:jzriYZlmIzijxFz17NBqFgUZwn//P2taZxeDkD3S2gL6jCV5LyDH3pt04Le:jcvRqFgUO//utaWDkD3o
TLSH
T149C54BA375054122F5FF1173595E8FA9C62C85320FA056C3A2D4EB29FA350C32A76BDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\79262659\state.json
Size 14KB
SHA256 a78036b2aaaa1780a9ef6ca8e63c70f7f3704125e7292b585514d843fb5e2b0a
MD5 c9b2a0f76c1e0a5b2c06280a198acf3a
SHA1 b258f264b3e16a53697a0ac98018e86c1970dead
SHA512 38e3933bd998dbec5cf115653cbab670326aaeb59f120e8507c9d90e436c2d63e6880b2931dad464060774044dcc4d89b225922828996a68d9a58c6c60918c19
SSDEEP 192:WOi1S0S6KOkvhOFG9VtFYBVu2Vl1Z+KSioOVsf:hT6H8OgjY623jxSXO2f
TLSH
T18562125581504E39E75452971EDB9CC4E5BC339EF1E97CF88489C82402B8BE4D22BEEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc3cbdc636712cd0ad246adb60e10a6c82511eff5067261c392024fae841e7a9
MD5 c1825e771385238aa2866582788cf8ff
SHA1 cdd34f1c740914ce98dfac6172ecd00fb2da9783
SHA512 33f14925d45545eb4c68af5b5b273b9724142601b0f5098ecd00afa7d2c73115a7bbfbde0f2118a5645868d8b32a69bd2a748d5d5a3d469656956f8af0313fdf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a612efa1a3f1d4ee262abb96d63f3b4a31c2ad6c544574be7246db0f52212e1d
MD5 e0045423d265fbb4204e2ccf9cf4e729
SHA1 5cd430c76a965b7d49eb6f686349a92180871674
SHA512 e0fe72d7795acfb0a22d0da2bf0fda4779e67429fc7f0868abc95950b557948a8b07360e9f45a7446cbe79ca28b10086e9e6f63cce1bc4e718efef8261f1e913
TLSH
T11BD09B55754D7415D31B01315411E360955A4462A172D2457120440DB97C81857E5257
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 ad78ac1d5ae45a9960e3b68492e3b87513b3dd8ea722832f6df2850ecc58b21f
MD5 71e46327d76538216678965cef399c9d
SHA1 ffd7d72b8837baa516575e02c4cbcae853e6d813
SHA512 54cb8c06b91e77586fa991a21bc1695b10db81b4789b7b616e928f59bf25828a85f78d24af50307462ba8eb8a5284b113f0e33285d47c826046ed8cf782065e9
SSDEEP 192:2jhoq6fbbbbbxxxxxAAAAA254TJhGllEEjjjMULO:2jGq6fbbbbbxxxxxAAAAA254TJhGllEF
TLSH
T101E1458783E4D2AA9F1510CB8AA4635D00743B0AEBDCD91C579CDDDD308E49FF5AE690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 33KB
SHA256 539628bdc4f3b107aeb78713c741ab9b5f4737532233506d8f1b1fdc4c81040c
MD5 a06c8f49a760752dc8b3ee4f217bf4fe
SHA1 2c159af5b7341c03cbce67afffafbbae2cbb7787
SHA512 af3b5c625bf4c83616c3ae1e2380df3bd35119998ca75cb96cd590c18b9227d18a03a50cf22880ddf41edd99ac7b8b9918c93a7be90d4dd3a8e6602c8e2b519c
SSDEEP 768:f+QHjwElyDV21n98SlMi1MEOV1IyItHdLqO:GOwKyD01n9RlfyTVJYRqO
TLSH
T1F7E2F15B2127014BED8CA143576EFB4FA9E374AC5609A24F547BE0AA7B8938754BD0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 96KB
SHA256 00b42308115826481315f6a815745f8d445a89d855fa587f627b7b4388810023
MD5 89341da90f4120b2461a9bafeef01775
SHA1 90e281f4ff94fc0eaee2e876234884e16f69894d
SHA512 bb3e8fd234ec764c6450622ff2d5f2e6e777cac6006fa23b9c3e986d79b89911b9a57ebca3bb3f3e15b8437d0b305634eea968e7d8808188efca4840bf4d5112
SSDEEP 3072:OFM4gnEp7667akyq8ez5pqVo0cvK4Dhq/8fQVT:8cIwdq87ouczQR
TLSH
T1F8A312DE415A5AD9711B87D540A18F2E140288FDAE3AC206E3C7493E1D7E1BED2392DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 68KB
SHA256 c81710cb7bada676efbed41d7ec45cd7e3ecc578fedc384681aff77698123163
MD5 c3f9ed32b256e81614c727b5256d8aad
SHA1 898d15f76fa5f2e9507ec3a22dcfb9c5166b4584
SHA512 179bb6ffb1300dabfff5051ba36d1c7739d75b809e0ff4d78a03240b039bae99b10c0a0279afa8b3f9f5d6b0ca5b1861307bd6312aaca1615861888b2c07979f
SSDEEP 1536:vEIXx9GU08p3n5i1ccGeWZeOwwxbGD8IYzCEOyxe:Tfd3n5i1cZPlwSbGD8IAC
TLSH
T1F163123C61EB51BA7AA5ACF9A4F36326DD3274A3720332DF4A0552574BA0261DB0F0CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 407KB
SHA256 ef4df5446b670dfce5034828c0677415674b70bce5dbb39a0fb02b5b12e84307
MD5 50bb4fdea5034803f159d1341412cc38
SHA1 da589f08b83e00701b26cf9050b049c5ea254f28
SHA512 469ac5f7501dabd47179abd4d666151fa4221c641d31a7c806e8045a5771bab1990490f6d297afe372f1dab3c859007c04461632907379fb7f70c5535a4f0264
SSDEEP 12288:C2fSwHiPpN/Cc9ckbT8cIAz9Kx5MAtTYBbGHF:C2qwCqcX8092MAtUBbGHF
TLSH
T11B9423CF50CDD7E0247C3A4BADD63878660B2A60FCE211A203DAE678D645E177E35E64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 19KB
SHA256 868ca9034e62a6169955ad39b1802f61f9e07d39f2b72e8754215ca5552cfdd5
MD5 ce3b26bb58e5691a1ee20767032a57da
SHA1 ca6151b90810c355bf74c3cb167022ffb95e4385
SHA512 9d8a1a56731fc8665a1d37eeec763f982fa75efe0013037f33bfb665d42347126abfaac83d9e1b7c903de5c736f9be3394934cd20422ac50af1a91772c48d222
SSDEEP 384:kH4rQVrFEpCQMqKJcLjfdDow1Mkm4rcKNgd9G4Nect7u42n/ZE:C4rQ3E9icLJDowC34rcKNo87n/ZE
TLSH
T12692E02B914BF92C43AC8DDF9234CD6074A6262C5782739F8CEF43476B98C1E086532A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5
Size 16KB
SHA256 fc3977d2d169c184516de314eb5c88d748396839ae43c5ac2db9afb618a0b059
MD5 37f3872114c77170d343b701cb02f410
SHA1 fe0e539c1ed0b83fd989b801d65eb3021ee52e34
SHA512 4e13707040aadd14415156d90c90c2846b776260d285ad38309af4bebedc34dda744d3df10ce38a2440a8eeea29b46d4bf1cc4349681090cb9f7376eb6cf7f18
SSDEEP 384:PmiD7L/vPiOI8bjwWIPACH+XsqCkdYiZfVa5Qrjbp+:PmiD7L/vNIqwWIFecKd1Z4mrHp+
TLSH
T16772D0CBD6BF53638F5C4600BE18D435A0A7A3DF036CC84409B9669B2A11398CAA3A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8
Size 37KB
SHA256 0599b3bd6d1ac018ffa1d098953b17ade5e646069f600b1f912ed258bc2df2de
MD5 4e40b232f5cd159d5091d195b84b8ad7
SHA1 807d131eaa64e9f87e9ca50b1468ab8427bba727
SHA512 0bfdfc0da0e6b6e4c7aeda519d23de58441009aacd03c39deb9bd5c5cade4e260cdc9e9dea33f1fab7bf3aa451ba8519ac269ad3ebb92c1162cbe5f7cee76157
SSDEEP 768:uBiCJkonC2BO57tjkUJIrp7ANUziw24haiSqV0ewfBAwkkRPb5Pgr3OtSc:q3konC2BYpjbJQCUzi6aalwZgcPtIWF
TLSH
T17003F1A1CDC27A712D8D593884DAF4D04578FAD998162731A25F0F34A3B1297774EFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6
Size 16KB
SHA256 9a4447bafffa7f28d381ad5718f011c7f0271654f6f4627c73339e11bb441de3
MD5 97e613d78061090d61cbcf90372f1ac5
SHA1 86900236e94f716a7c3adc08e362329b60829221
SHA512 7b8c594c17bcf2d708ce7f94a34c231b4003a1b176d47a991f67cfaf35f304b63089796e1d5e834e3ba9327fd2b336a69887e64929a8baec60ffc1bee8029146
SSDEEP 384:WIdbkdz44nsteqRGtoxSbDunQ+32pFdSLgk:WIdbkdz44sTRkJGnQk2c0k
TLSH
T13772E0FF23517938987BD9913E7E39C2E5B43EA3C0112EB8F225C95B4338BD9615A510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000101

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000101
Size 5.4MB
SHA256 a4f21c6b14bb02350c09affa9479464c82bd9e050a5573ba4eb1c1fe531d1f51
MD5 3615a121050b8714c42743a1b3f4e52f
SHA1 800261c4cf250442b120c365a979db26a4c1f48e
SHA512 5aeef5e80d44561a276b95618ab04d3b6db6027294878ff345b9134e5fb506e59042047e2927a5ef4bbb8226a7f6a4c773ea0ebd717bc0d2e7e48bf4cc0232ef
SSDEEP 98304:nn+n1mg2MCJ4Gw6eqtuYqZkb+tENHx8mzGrkZ/y36vVWqZAc4rH0:nn4DCY6XPmkpNRykF6UQ2
TLSH
T1D5463332BB95823BD5A30873263885B7733E6A112F11B5CBA3C85D9E8DB42D14E74793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 1a5770902c7629ba2735672b05b80f223a9b2c7aafa61d47e85ca6534170d87d
MD5 7e2bfd45878e871639a95d57d9658756
SHA1 d4de4b5d3be25c97c5151117eea22b65e547f986
SHA512 dfbd067e0b78ece9cf05862fefc0b9f90794476bf78a6fde54e639c01f19703395311df0d61a2a24c8165bf2a44b51309b444d3848788a975bb5cf54d766af3f
SSDEEP 192:Q/C/5/V5k/TRs0M/J/sSSb/i/+OJH/0/w/QIc/aX/v/CQ/A/N/gL/Xq/0J/S/N/Q:Q6xrk78hqqxHso41+HKQYlWfqMJ6lf/o
TLSH
T19A22C6A605AF3C44CB1C0D71DDC39BEB3F72ED998717BE868480597C0A8A7C643DA816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f7e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f7e8.TMP
Size 3KB
SHA256 17387f15a2a6dcfe72c0d081a7c9753997f6e6f3f8f6678db5f71becdcbcbab2
MD5 ae0953dc71c506d5e24558b6adb4503a
SHA1 5cf7beac5b09b95a002d81d776e3244eba219ec7
SHA512 dfd29e57a007d8bde59bea0bcb78b479c375185cb1870eb46eb7e8b6dd7468e306c0af6c105dfb1d84d1bd2c8106c61518d5492e6ac42f45ef51478100177a90
TLSH
T174714DF912AB34A1D7248230E4D306FDB47B4095DB237E51C1009DBCAAC6BD993EEC18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 d4974b311ff44147a9f92a3dc161b1371654c323f4444d3b6a199b1a182989ea
MD5 dd745a878bc0d0fb158dc5c3bfcf2d6a
SHA1 ddac611ac2d19440ecfc532b0c6cb7518c0924c1
SHA512 96b425ef77aa35649601dc937815c7c82ecd329f2dd7936bf319d9001b608e0000ebaf51d3f1bbdbd50139e70ea2cc535ecf04ce2a4fbd81afe162c9e42a3249
SSDEEP 192:De2c2meVXmJ1SPhMz8Lytfigc7xzrvmOtmCeGmGm6GtkmzmH:De2c2meVXmJ1SPhMz8LyBigc7xzrvmOH
TLSH
T16BD19CF3C3E9826DDA1155F0AA14AE1BCE1C0551836C7D6A85E4AF0BA3F3871E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 b33aedd37b6d5076f131a59ee8a018830131ec524555163277a995ff487abd39
MD5 a0297d66109ae3505fde09b925036a2d
SHA1 cfd4ba6417d014c41207d5091b3ce8ddb5c4ea37
SHA512 1008e25af7cb61fab4e117a3d60a6d3b75b1f0d41b49cbe176a38d32da5789b4cd1a614b7e4ca76edc3a71eb19b8c793722b68a134d65c978f1f5e2806c0690e
TLSH
T133D02273520031B5A67D3F85447AEC8FC33B30208AC3DDDA50D49CAD053A46D9A0B34A
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58c261.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58c261.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b4d87a151a79b72c66657e59869ce7081f01cf67a5eaf7390e4c726d8b41b9c9
MD5 24a6aed38a950c95e0a561c81b349d74
SHA1 610d386f58ad67aa509253571beb0217be38239c
SHA512 f3ff7bfb93504f3235c8d30b8a0eaf6b52badf3bebd42f51a302e79df8f2bddcef02382eb2cee0f2ac5aed8021450545990dbd1dc26f4e5f004c0d9831a69ffd
SSDEEP 192:sxZaRByM/jK1Ml8MWPN/fesIL7a2dpm5PlIHW6+WNeooFqZP/YHU1W+uIgrJ:sxZaXuPN/fesS7Ra+HbfIc/C/9
TLSH
T13E52F9116A346E77CDDBD209FA51BF53E6F54472A2900E48A9FCDA1C04E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 31d7f6615f1a788ef7d3479e3b49203c3a50e810154d540bf22e6992f5371113
MD5 7595e28e4eb6efd46d9e3f17f237bdbe
SHA1 080cf57c343d2593ef17757ffaef8365212fc741
SHA512 4472d76b04c3c214a0cbc831631a5f5a4c6beec51db765fd48feb293f6ede3b3313a045491d0889d544cfd0bd4c489d70b0af392457bcc98eeeba07d8cac16f5
SSDEEP 384:sxZDXqsmWN/feslygbMFHbYIcM/f/Shet9TheO:sb6smWN/f3ygsHbzf6hyNhj
TLSH
T1BE92C5526920C977CDD6C609FD317F62E7F904639E914E4C69FCC90C04EA6FD261A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 b782e9f493ea9eb3bd5932360245d8b1335906738da9187f5b0a9b198ab19bc1
MD5 6d4757b0a0fbe1ccdda3c4bb51f0a1c4
SHA1 f7349d6590d567fa7e95e0ddb18440c29ce607ef
SHA512 75f9cf947d76f28f287aa6e2116ddaa291851948614a5f08bbfa721f5e59ecd1aeb2b03ef0e16d26f695ce166e8c27cd63b33ebb0f2e256401ef59e489cdd40f
SSDEEP 384:sxZDXsmWN/fesl7LbMoHbYIcM/E/khet9TheO:sbcmWN/f37LzHbzE8hyNhj
TLSH
T1E892B6526A20C977CDD6C609FD317F62EBF50462DE914E4C69FCC90C04EA6FD261682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8e2c37c6bf5de5b524658983fafbc1c5bf71fb46c3215a17fda3fb999f45a088
MD5 6d1a6d6b2041c224bf1bff55d64b887b
SHA1 7c795b5e9d9bc5021bf8ce2e603987e839e62ea8
SHA512 6857f6aafb5ef155ccf6e79238f29bcd427526c7532e1f6f9ceee1f4a4f88368d8853bd764511249281f43a635d33829f4c7a6ca73ae9dcd38caaab6c181032a
SSDEEP 768:9IUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R6roVk04:9IUZYTMWvg0Pou1ja7eLZmRxB4
TLSH
T175D20B3B280CCB7E4F844E9DEC266F967ED801CB5A584D5447EA884C03CB6EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 c2d474824e182bd6fc2f8b1ea06ea9a6895d79b13d77e84d53303e39e06fc5ed
MD5 96b14d409561c9bc8d7c1cd47fc838a4
SHA1 75a8046a306c146a56cd33e362d86ffdafd63338
SHA512 923f16ff427f286f7c91f9b64b04ce706e4060da27b96ff09ed22328cc752ab2865d2f24a5716b313186c21f1e3984bab96d6a9cdc83a7658d28ae28765c0b99
TLSH
T1C1A0022B02801549C02F9AF336A602627397ED520612135B41982444CCA25859F6141C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 3e6d5eb8f94b4a817b3acd7c06c2cf1e8f011e5f7acf99bc222110d74079fe43
MD5 831bf6a25d28d56423f7729e0ece1ae2
SHA1 1d05690f6b9616e4167e8e273ffdbbfd5effa846
SHA512 9a091c350106dfa445616e9d553efbd2e61d2baf388b13154362fd7d880b5e4e4df04b38abfaab0a705f27fc7fc273c79dd7dd67ab913634630cf6e1867f7847
TLSH
T144A0021007914015C89211B11AD202411301DA201304D70740919549DC9A4F14E8260C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 1a3b5c17fda43541cff22ad0fe7a928754c5440babd675c088049221bc3704df
MD5 b7b2a0c43289b23f5b2c35c862c3a236
SHA1 2fc70d685fc8d23eff889992fc91006ec6093d6d
SHA512 e4a3c0c5049b7fe60a6abc19b4225a2b61b75200c8aba71143c3f55985788953da40623111770cb813db70fc538f5c3c53b1a450f00f6609d6acaaadf102055e
TLSH
T10B21EF4D9EA0898FF96441B61576B5E0B37098CD4F12A2139C3C31326E263593A575DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 3KB
SHA256 3fb8f32b27429b4d14b66e1f9fcf06b02d083024d6bd501072b82ade8e084fe6
MD5 b263de5e41a7b2ff7f8c545555dff21d
SHA1 b34a9bb843594a9aa65453ae9ebcc14c4dd3e8f6
SHA512 1f7b0747a30fe3b4690eb10f40409aea8f689f991b5a49a2f7359047be752501422bb3503649d2b128085950d630a2e6c7466783cd6f69000399c4ed442a8981
TLSH
T10E51D80F4D091E6DE8AC55711CFA2882737869DF1B489C0753EED331A8E33741E4D189
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586230.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe586230.TMP
Size 1KB
SHA256 70120764079a77e5cff6cbfe30f7bd271527bec91749f1c839ed0139ee1802e0
MD5 988cd2d12ef2fe4befae02b699505497
SHA1 0fbfb94ec6a2b6e04052ae8ef94c57f9d21a2644
SHA512 e77fffebb870cd416a9bd9f4ca505e784f12f2a2181d5928b23ba235514e759ab9bf29726ec1a6647430aad691c52d16ca220937749dc619fdac4aa53d9baf43
TLSH
T1A321148A4AD18A0BF984507B1967B8F8737488009721F3D3A97C66795D25B8D1B4F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 79d281aaa0f4a7192580eb8e53216a398101cd5c6fec7565f58c304a9764e4f1
MD5 8a909a8e86023f435ed47cc6897df5f3
SHA1 b949392bfb28000d68c78880152dd53179fb5dd7
SHA512 f3a8ccd0d9893333d1f34682e5053c0e7753ceffe05a4a4ad059108072adc3b49eb78ab789758db28e8b54c650934bd5d51b647bbbafad494123d29717e776b7
TLSH
T1D2E0C0F33DFF1810ACBFC3D74471E4A405023CB8C64CAD8E10ABA2A320B23002806C32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 aca467dcf7badeaabca1afc692784f2578cf2c5668a291abbf2fa81a51347c64
MD5 f77a22481407a2efb42b5d9463f2c5c1
SHA1 d605ee43fcb7b2f2b5e00a394677c143350c630c
SHA512 4667254f766baa525dacf99481782328a8071eb9c27410917e93d5bfe1ba9796fca6e56a2695d84301bf1d25a5593f9102a90c7a57594f0de08b41a601da76d8
TLSH
T151A00221CF549545C08803F1E0A20388A311CFB84A16271344AE01D98A686514792744
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b89d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b89d.TMP
Size 48B
SHA256 b847567957cfb683aec6fc5dc850cc0cad00b0b73438d69f7085803e23e71fb4
MD5 48f5686423f033502822a1b3cd71f738
SHA1 2ed35aba65691e7028575df7ca74f25ab70b5128
SHA512 5914147bc927f7767d4a57fd3d2544907a0245f8d94b659eae16e28bae7839609b3f458331d9105cf09dec521cb39987813bee1ccac5c3b2d1155857d3aec2a7
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 521b57b5e483b023e5cdf4d65d7498631990dc582f0419a3e4dacb58ceebf29e
MD5 25d35f350703d403b484615c8a6c7f09
SHA1 d872961971446eb1fb8778204b10bf3af0a1a10c
SHA512 381c74af84886e491f0c4e8aeb9577f38c254b1100d8b95075a7115ff679815521d4025c085f7f76c5bc8b74c31142f64d63a9c3974258fe39fba0cabe6ea460
SSDEEP 96:KA1eK2Aoz2Ksom9WB9v3Hm1XoNX+TKvKX4Tz8UDS6wqUti+sOSb1iTqXmbKviXQQ:E0BFlt
TLSH
T1B6B1360372B712433C3D2908A2A9973B4B46F1937424A86B7FA904B25D67E741DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592689.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592689.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4e39914e68378a8406806365606c968ca3f44ea754b7573e158504d02c691aed
MD5 e952a725cdba7285e1e7c91d0fb03aa5
SHA1 311d5001997166ca88132b1ac1d564a82c733daf
SHA512 03df260e860ab0208756a0a643bd4a25cc7726b5bd2a313fdc59b0b890647cd21c2a3d6999ebbc7de2384146d9b3091c1001bd1ac81a4196adb229a1c19425e2
SSDEEP 384:aZcIhsNlUsTgJp+2zX5od+KOrsy0X1puLzAoZ:Yhp+qOzOrsysyLc6
TLSH
T119826D726DA8AC7759F2E184F54B36039FB89073D7C86E84D1ED6B1C01EA6AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 aa447ae5c35aeeae0ba7193c13e5f7787af98ca2f59ce68eba6b68b5ae7ba75f
MD5 d534ae3473ff6046361cbf6f6333661f
SHA1 d4ff8994fa7f41b9ad450a4d5a2b0a1168eefce9
SHA512 6c19380eb7de59360afd26cbca88e708a691e080160d912cef814ca66587106c69bfa2b1717a1140b77fac0264a9f8957135b3268b3ba9bb1ebee3bd4d440c06
SSDEEP 384:ZiFCZcIisNW8TUNTUlIldTgAfpzX5od+KOrdy0X1puLzAoZ:wFwiTwgJROzOrdysyLc6
TLSH
T1A2C21AF249D79836D9AE9747E77E2D034EBCD063F5846980B3985A1CCC961BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c779e69eefe6e8f046a68ef6414db02a9577229fb7a42404d3978691f8fa4f11
MD5 4161328da3fb60bb55b3d0b54f749259
SHA1 86bedc7b640a27c722613210b36521a5a6d6215f
SHA512 13de705258fd172c897e2cc8a36c8e0f0bc209f63ad7578539039a2d5c818c30402fd8b49130e22fea1f36fde1dfa7733359c64aa5b45aa2e323b309031b5605
SSDEEP 384:BZcIcsNlUdTgA2pzX5od+KOr3y0X1puLzAoZ:JcYROzOr3ysyLc6
TLSH
T117927D726DA8AC7759F2E184F54B36079FB89063D7C86E84D1EC6B1C01DA69C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3f0e9613dc21fd632fec6a3da9433aca42a6992e5381ee9cf28ae7b0a0077d80
MD5 115236de2c9ad0e375a2f56eec9d0fd3
SHA1 f136f99990f64d3e9a141696a00340e4e6400f46
SHA512 ace58fb68b66712690f6d7ebfd3374cba05229add38e3c2b6c7726ee2c6793fb764ec2cf43674d83ea6c5a52d76b1ed51ee593ddaf56edbfc5ca8402a286e1ee
SSDEEP 384:3ZcIfsNlUdTgh2pzX5od+KOrWy0X1puLzAoZ:/fRROzOrWysyLc6
TLSH
T147927D726DA8AC7759F2E184F54B36079FB89063D7C86EC491EC6B1C01DA69C130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ac480c8cf59c75566521efb5ba01cad8076cdc6eacb14f3354483379134b994c
MD5 b7ec9c61a95c0cd73d2576d58ec66e03
SHA1 07a6bc15f202e3ff54f5cac6eb410a403636962a
SHA512 ff2991602eb22c99acf67d15cdd4c44d6a1851fd8dafad6debcb122e5b98e95e3b8454f7532f47f72536692a1e97b24545e89b68465b95d5d277cbd57cb5be9a
SSDEEP 384:nZcIhsNlUhTgY2pzX5od+KOrsy0X1puLzAoZ:PhEROzOrsysyLc6
TLSH
T145827D726DA8AC7759F2E184F54B36039FB89077D7C86E8491EC6B1C01EA6AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b6bf773e1f19c9642016c71f0801b04657cddb1e0f8b52b9cea0230c9ca23fec
MD5 e0169b7de021f9595d94e36375b5a39f
SHA1 a89e76c21185ecd20a3fb421919ce95f691d680c
SHA512 573d1f3beb8ff1915db0ddcc50ad48e16dea68728efe41dcd9a4bfe3de6f4d8082d2bf61db10041a3e88ff2dfb9402ded921f7095f9653aa681e65ff47cdc42f
SSDEEP 192:yONc61VWQmiUywhgGX5Obd+juOFmI/aC3s5U6:yONc6WfgGX5od+KO655U6
TLSH
T1B602E83568687C6B8EF2BE49F58737135FA8207BEA506F84D6E81B1C00D769C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 029861e6a463b2a86f553d99c3f7e51172356cdffad4145ab52dadd4353c4d0d
MD5 3829d73903770b1e58b066f06cabb455
SHA1 6abb9ac883384e44889a2b763b877898888487d9
SHA512 fe8b15c29e31fdb5db4a353dccb916ce89f7b88224421ffa24217b89fd44d68eb25493a6c28ae0c281c53a1f5943d6a71773d4c184232251973503764365b544
SSDEEP 192:CONX61jWQmiUyAhnGX5Obd+juOFm0bepjJaqiXU6:CONX68hnGX5od+KOryyU6
TLSH
T15E12E9326868BC679EE3A544F44732139FA55177DA857FC4D6EC2B2C01EB6AC230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a934d6bcb371a03b2023b93ca639bbc68161191fa834530d5fd16fd17fef4c93
MD5 e91e8ec87d2e49dc2e146793f0768a98
SHA1 543add66569430d03292fac6bb04c97b207a530d
SHA512 fd71934e64b4f6609fd6f0c1f024c2772eea0e1aed03ad4284709bc0f490e39dcb024ceef387c05ae1ece4be0f11934ae6359acb99ba707b80b985149aae8ca4
TLSH
T160E002035B1500FDC57C23300063127016D3D03041F103865C1506541D673001FB0FC5
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe588ebe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe588ebe.TMP
Size 392B
SHA256 60abc2077b6aec092584f8ab521462190d9612eeb0cbaefcd2e7cdb13c1f5d09
MD5 439feb5cca842181fcd775bd7b7e56d8
SHA1 4f87ae962eb0880a6c41ad60a3277eca1e3e52fb
SHA512 ecbf6bd16525205fb1ecc2b74d426fc274245b31a9488be28ecb477690c4e3348863f88ffb1af537c2ae03e597943f750ec492984ca5ba17e3a7aab38de04b9e
TLSH
T1A9E004015F1500F5C4540130007113501351D01041410347540407501D543000DD04C5
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0d0ffd5272b50a1c0315a48ffdda91e43163ec150bbcee27a4e3e178431f2178
MD5 7a70b50544a3d092b0ac67ec760beb49
SHA1 4588571fdc5f906d1dd4aab406f96a022d814e2f
SHA512 34129dab390ec6d2f631a49a7882581c8c05ce5717eb8a5751a76e6d6e3d6f23b9af165369e82f4466994c43bcec21a1072b543b85e4c996b3ee195ec78e74bd
TLSH
T194411888B6E91148B3B77F5A9BF2A86D48BE7D772E4691AD00110E4F0A67B40C871733
MD5 SHA1 SHA512 TLSH

Submit Download

20260831040018_bce012a320264ed09528aa17dc716193.trn

Path C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20260831040018_bce012a320264ed09528aa17dc716193.trn
Size 10KB
SHA256 d1bc3989ee91dcea3ee89f902b01fbcceccb8cfee21fb938d466bf26cbb2cb4b
MD5 29e108368b532bb6b016ed77145b6b19
SHA1 9fe1e7fba4bfa16e9b0e55073397be2885b19719
SHA512 0d08d8257337d8a01e80f841b4339849b22a977b25ffa40ace8feb03b82c244f2bd4e10bf275e83dc432aa44afb176a0e4c46128ae841879abaeb5452828ad3d
SSDEEP 192:NrrCQSjQ8iBJUkZveSdyFUOTkebu9te3CwEiQhF:prCrBiBJJ0UPeaeywoF
TLSH
T1C922B09D7649706DE7796E7D4CECAC924B29018E283DB5CE806588A770C6093B50295F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20260831040030_7b5600336c2f4ce98a0149dff4077ef7.trn

Path C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20260831040030_7b5600336c2f4ce98a0149dff4077ef7.trn
Size 2KB
SHA256 4d6e5fffe5b45861024f077c735af34d4b5fdffa038d66616d1573f578477a57
MD5 1083eaf086155c2b14a968dbef4e8ab3
SHA1 99f85b71cf7187f267b8c5ce04b5691d23357732
SHA512 80a673b2d543931a23857dbb8229fa86372d8302e29010d2a3d5c8478cf9c918cd9683e63b61b6038068c1c4eebc5dac5b005c4c45bd537c59fdc8801314a513
TLSH
T1B4514DA490780578727A2F3D9C08B7CB088E8DD64E4DAA095F1A7557566134F2F0AB81
MD5 SHA1 SHA512 TLSH

Submit Download

20260831040049_60f0817bca43479fbb620c220b997914.trn

Path C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20260831040049_60f0817bca43479fbb620c220b997914.trn
Size 20KB
SHA256 556d82c6dda9523bf561aee89c44964c006174079c9c3c7fa53c18f71eb4c4d4
MD5 663adfcd017ac0e17ee9890e9c0fe7af
SHA1 ba2f45e4bc02ba83a589fafb8050551f9c1556b1
SHA512 ba8b93d9960be0591677ac7324e962e6a0830add960c0ea549dbbe2618316bd8c8559517d7a3fd3738d7ea266868aa0b93d02233c6c19204c7838b34db1286d9
SSDEEP 384:xNwALAR3ip787CgycAsMnyrwzMqArr4q2jzLajY+enz7Dw:fwA8w18WgkoqAgqu2Ebnzg
TLSH
T1A692D0A8C9F1627F18EC503360DE389904A38F3A61DCAC9E128977719F5F15AA44D582
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20260831040119_efe9ded536964fae901d07b098fd90ea.trn

Path C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20260831040119_efe9ded536964fae901d07b098fd90ea.trn
Size 4KB
SHA256 29646ad06f0f4fc66c73a3213e75027dfdcd52968051150c0b578730968c815f
MD5 e0f8ba4c6141a16d36500af5d938c33a
SHA1 397d2eb7e04808e4c651d020ab2f94373ff7c38d
SHA512 9aad6d2819dd851bce8395906993ca957b26cfacc11cbaf05114f8f68e4f66e7b6f3777bdd3e75636c9b6f003aa675cdb5986ea0bdb9c46b15ddea8f6c050d9f
SSDEEP 96:iPNomL3bHh8w0WFECpdIea7XYvrrmrKkyUrrSW79QAVWEMth7Cmyf:+P3bHx/Ega7yrS9RPSKj8Amyf
TLSH
T192918FA55C70E0D8176F80EB0D3CD279BD9A131B98D72C0D8153752A0CBF85B89B713A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20260831040150_799ee092d059412a8dce0befc40050ce.trn

Path C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20260831040150_799ee092d059412a8dce0befc40050ce.trn
Size 2KB
SHA256 44577016ea3662d523759b853af37015d9e310008d22d40ce4891c272d2b20da
MD5 d7195110abbbf62eafdb8514b681de40
SHA1 d117b28a953e21e7011b9624a6b8e5441c2fb0db
SHA512 f4b8e9300e2cc9e6d71fed096d7286d171ee1f46afc14661beefcbf589c0f2ed620793a4f1d0ade852f18fe39fe8828a53089999dca3a8cd3af01f9e8dc813f7
TLSH
T109413BB134A478966E65B314D893E217683614E74C47F09D5042D9103E093DA8E2677F
MD5 SHA1 SHA512 TLSH

Submit Download

.updateUri

Path C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\Packages\_ChannelFeeds\F4D08EA8\.updateUri
Size 26B
SHA256 f4d08ea820b816e2822bdd3351613ed185e4e36503ccc348f4a8a7957fadfd6f
MD5 e3c9f3c009c49e91b372ce3be05da610
SHA1 df98879fb7402b9b08bdc18fc2f3d4d5ccec12cc
SHA512 444aa325d744a7fbcdc5a48cd7b51814e3cca5caf58b0e16316e015f898773a5d3476059399a704a9b4dc6350d06430ba42a78058f2cd8c03669147b346f22ca
MD5 SHA1 SHA512

Submit Download

channels.json

Path C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\Packages\_ChannelFeeds\F4D08EA8\channels.json
Size 48KB
SHA256 a68edfa3b285099beef6f6943926ca1dde2b5b9de91a26c0a35cf34a1d2ece10
MD5 75503f3933e3b38d137e200004b91bba
SHA1 13c10903e18ace355f06322360bb9b61a713c98d
SHA512 5e30ab8e2e8129b41633918283da2a814d867b6acefa2e9748774859629dbe352b81523395168c0e9dbd534d1f0773fa5c776a8b3951f47abce0ecc5b710e91f
SSDEEP 1536:OUgQCcq48YYbAx3X2sgwH0UPuEWya8+EN3fEqHVZ2RxAQAzUcR1GgKoiHAtvU6lF:WYYb6n2sgwH0UPuafEqHVZ2RxAQAzUk9
TLSH
T1BC23F77BD5641C2F4271A252E8549A89F424431F53D09CAF79BC980C8F73AB6D093EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

channelManifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\Packages\_Channels\cfdc9640\channelManifest.json
Size 115KB
SHA256 67a786dd7e8f334be8b3a71b67532e9a7332b8bfcd6bd41c9a8aafb20e73b270
MD5 279a8b0e8f1608cd20f1ab66b3a05316
SHA1 d289e0c8077e4b7a04762609fe6e56ddaccd89b3
SHA512 bcc96920a876822ea5f3afc69f0f6c00496d1b53390bc8123b906f29c1e0e6f5f5754bd02a263c73ec0e070c81fa14127e36256dcef72d664d9bcf3e830d0a69
SSDEEP 3072:7JV4DJJVUnJVUIJVIJVzJVC7JVC/JVNbQ6fP+I:7JVOJVCJVNJVIJVzJVC7JVC/JV0I
TLSH
T12FC32A7BCAC5093D6B04A2E3999FA98AF02C874E09F16DFCC5C5E62441B57E2C4474EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\Packages\_Instances\79262659\state.json
Size 69B
SHA256 9f2e24b603ced52a82e807e61dc9f6f2503c2b769d9a0a55b893260bb3f4f7ff
MD5 a8513e43cbca48dd1fb271d764a73e8c
SHA1 544fed400db10e268849a8bb56f1346f621d87eb
SHA512 6dfdf15932269340b5f5850a2ab69f8e02f08e324da4d9a26277461de5ec2b0aec9e3d66537dce0351ccdeecb114b8d1d45c8a03d81f0c5317b190a040161cb2
TLSH
T140A012006242AE32284111649130AA448011000828D016004504519426846053676052
MD5 SHA1 SHA512 TLSH

Submit Download

channelManifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\Packages\_RemoteChannels\6c84a57c\channelManifest.json
Size 122KB
SHA256 4872204ad2e67c20f83db2b90aafe5f952b9e3dc1b9fdbdc9709711f44c64ad3
MD5 df7f399fe5bbceb59b3c7eb204211743
SHA1 24d5128537e68ed46c6b89f4765c55f66883d015
SHA512 d952a35d273e663f04614e16cb42b7d355330ed579c2c830c25736acd7c52f45fda38ada85f02923a70ff868e9089e623f633b7df583b045b45362007a5a060e
SSDEEP 3072:pJoYqWJoCPJoCGJoYJoxJo4PJo4nJoEbJppGK:pJo6Jo+Jo/JoYJoxJo4PJo4nJozK
TLSH
T120C32B6BCE890A3D6700B6F3A99F744AF02C478E09F16DECD5C9E62441B57E2C4464EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShippedFlights[1].cache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2JGNS5QE\ShippedFlights[1].cache
Size 205B
SHA256 c4d74f90d4c39536c6b003d7340121350c8190320c6c455984b8170d2d041711
MD5 bd644dcc993d4c0946837f66cbc0189c
SHA1 6cbc48e805986374145c5a1972a5fd05f2802f69
SHA512 61479d42f20edbc61c00d8ff4c63a637b82b7c88ddfb443c2596bb6aef7df831673250ce146e16e770e7050fe978da46662bfe9ea3f03a1444c4e55dcb9c92b7
TLSH
T174D02325A1538C7937D0C6C702908D96412905D87F15C85C54C305F05E465D4591F578
MD5 SHA1 SHA512 TLSH

Submit Download

DisabledFlights[1].cache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S9SIAAA3\DisabledFlights[1].cache
Size 78B
SHA256 619374db8a2521ef5adddf7f763c135d1772366b222a4e11f1d69334bc1cbf69
MD5 3786de4b37bb410ed52bc580689bdb9a
SHA1 4c21a9c9f84e16a2b969873c343c801bad22201e
SHA512 c2163e5693ea5ec7babd29af72320950dbe1af1ea0da2a298ca622937c36c73467773115cde8a8a664fcf3aba578b11f8882b5099b25dbab5ad8b47ddd3df808
TLSH
T10BA0222800A3282CAA00CF83B00C880A833F0AECF30C082322C30030820F0EC802EA28
MD5 SHA1 SHA512 TLSH

Submit Download

dyntelconfig[1].cache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S9SIAAA3\dyntelconfig[1].cache
Size 27KB
SHA256 661a2c8f4461ea50e4fbceaf1b83652525f20bcbc07a3418c7c13ed82c941231
MD5 27207c2e9fe216900d5844f5ac09be55
SHA1 2cb1e742f9a4e6a73b8cf58862e7a22cb21e3613
SHA512 38e796c37026f931feb2c76203e216611f8c87d4bd6cd9d785ac195266366fec5690aee530a3ef8167eb01c0bada868dca0c071632097e973057d94330c7299a
SSDEEP 384:fM7fOC2qP6CmTFZ9tg0DI1x8mi+DZPL7awst:U7fOC2qPxyW0DI1x8mi+hL7awo
TLSH
T10ED21495F13DCCB9425F3E1BFD2B640671E0A18160E4F859EFF0AE0993C8B9C915627A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoteSettings_Installer[1].cache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VJ7S99NZ\RemoteSettings_Installer[1].cache
Size 876B
SHA256 40d9c8cbce568fc20c94194f4e3ff0c2f43cced06e94e29e283b8de4b31e9ced
MD5 36bee3c9a29a9b752a6761a703b1a65c
SHA1 7f6219109cbca0d2ee7cfac638cf7032b73c7e2f
SHA512 cc4db85c765c9a5fae07dc17a2d8d0f80af9ff021c33478e17e0b0fa18c2d2dd4532eedcb9b84b678354f476fd4e0ad4b12a8e52fa13a4a50f4d776c66494029
TLSH
T139111E8514521434DAC2EB5B662E2F156FFE2BF68208210E743E302C93B336D9130E33
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2zc1e0n2.qr0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2zc1e0n2.qr0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bg50itsf.dev

Path C:\Users\Admin\AppData\Local\Temp\bg50itsf.dev
Size 412KB
SHA256 f1cb095715625a399901ad62a8e269277a692b2d0ab50be51f88d13cd635ac0a
MD5 e5a7b0a3d168980d9f1085a8da5dcd51
SHA1 6dca4cb056e4ee7ea67fe715ee4db7f43994045f
SHA512 1201e0ffa5352c1daa18cd4a0560f2eb95902cdd8e31f8a61181458df63fccdb7538256b46ded7ae4d6f5f08858c9abebade33964812cf9b34f10c170e5c2cec
SSDEEP 6144:g+XvsdiUJOpAZIpzezU+TfJ/igT5wdbEBQaXhuYhvpN8:pIZJOp0Id27RBdX4Yq
TLSH
T180945A21A556703BE6FA0972F528CB706D3DBD1823D8849B83D0B84E38745E36BB7716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.C2RSignatureReader.Interop.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Interop.dll
Size 28KB
SHA256 0eede17765a0028e3d4840a3196807fde1b0bb109130d37e7107c5dd37d9f4e9
MD5 36d57a1f63a99d9322ed0e709e6b082f
SHA1 73c1340609f1082b305be01b60aa33417eeabccc
SHA512 55a8342eec046fa9ce1c3f9ad1aa6df2b90bce1ecd29b9533d8544620af038a71ab874fad7a6200c7fef470aa42c39857d92ca2a125052150061dc3ac6ab4610
SSDEEP 384:MOIEmJ6RN1/sZPT4OZMSETSbv+cokuc/VKPZlhDSWNNacaGAh0q4ki+R9z3DW:MgTRNOFUOZMVTdwueu1rmbh0U9z
TLSH
T170D25C27475C5337CE464AB0A8F1E9432E34A3C73643DB3F5698F2460E5B79897A027A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.C2RSignatureReader.Native.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Native.dll
Size 133KB
SHA256 df468811f547b66779dbc885a384f7e3fd3c6aaeb8abd3a2a5e714e1638210cb
MD5 42863fe1cf3d93e5fa092f42db2313e4
SHA1 b67f613ff6c17427665f373a76b5dd3387147093
SHA512 58c932b667d7d7533a8421c325f502194f0aa71de683cb84d3c39c237e6288b176bd062109343a308927eb0f1efb3596829d1680232ab724fe4b042a438edfcd
SSDEEP 3072:NQLjUBulBKJhxTYc/92ExlWQ+9E3mEuR9ywKqSY2sqEgU:NNiKmcF2MllMQM1hz
TLSH
T1F1D35C11B9A1C033E6AE0D788824CA56DF3E6D91CFE0ADDB63941DEA0D346D09F39917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.IdentityModel.Abstractions.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\Microsoft.IdentityModel.Abstractions.dll
Size 19KB
SHA256 de168bcbc53946ddcc19f466cc40e685c56b5461859667033cf83553cebe4ad8
MD5 9196dbae4300ba943d0f5f71e0606ac4
SHA1 87fa1f6230415e5bce91a587df7130c0694a76b5
SHA512 fc6c2034f50dbcd189ef7f1557a4c43886b6fa5e740a76c28336c788605abece0d0bc1590f2959c12ea5f2418c9413004a533a19d631cfcf4c5622e45da04831
SSDEEP 384:Ruw+9Em2OXyQ1VIumJzWdloW31+aHRN7E+YMTR9zfZ0:Rull7QC7+28g9zx0
TLSH
T10E923A56C76C9212ED5B2B31716AEE432E3DA7C69921D23A074CF9091C537CA9B3133E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.RemoteControl.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\Microsoft.VisualStudio.RemoteControl.dll
Size 46KB
SHA256 cc52e19735d6152702672feb5911c8ba77f60fdc73df5ed0d601b37415f3a7ed
MD5 355c1a112bc0f859b374a4b1c811c1e7
SHA1 b9a58bb26f334d517ab777b6226fef86a67eb4dd
SHA512 f1e858f97dabeb8e9648d1eb753d6fcd9e2bab378259c02b3e031652e87c29fbabfc48d209983f7074dfc256afd42fa1d8184805534037771a71db517fe16c8b
SSDEEP 768:E3DOuy2r9MhdS0+Mg/n+FbK/lCxkQZ2XJP8MbLVSav7C9zAH:ETOK9MhdStMYn4dtcXJPzbLVSaDez0
TLSH
T1DD235C05937C8B23EADB5E7D69B1D6624A36F7036812E75F4C8CA0D92D93780CD107AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Services.Common.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\Microsoft.VisualStudio.Services.Common.dll
Size 558KB
SHA256 d5e2301598be15b8fa91bbfb0510478c3c9453a7434974fb823e3cb86c19a383
MD5 783424b5a70ec55fff15ca174b3f84d1
SHA1 41d2d8ded0a710f4c4d35af0328761d9899dd20e
SHA512 3fa72329db7333af9dd2a331b1265aaa31a736301683bc3d7f0cdaea9ecfd7c145c77845c0e361448c94dd0854a38c8b9c24992816c33ce536be7c1107d3ddc2
SSDEEP 6144:/rJ0rFyWGbl6hSgbdORJsFQgGz40J5zQKI+ISCAyBttXhrmSqF9MK7kZ1V3bbRy8:/cFYeKdMKI+ISCAo/r0F9TQpfEu
TLSH
T1ECC49E01B7DC4B2BD5EF0B74B4746A5843F2F70A6A96DB4F1904E2AD1D923448E21BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Setup.Common.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Common.dll
Size 627KB
SHA256 3ff33a0ceb7e0615fc405bbf4f065ac2f87351f83e2fa2de52498206962a46f3
MD5 af202510cbc655fa780f2c1561ce5d8b
SHA1 10b540e7c4433076c73b9ee931fd7d858010782f
SHA512 65a482377fcd293a5c9e3e650417627ce1e16462af4687c5c0a5f42301c8a7574457691fafa7befc8db0acd11aab4f8f37a7e230bfbc6849c299a745e9fb3914
SSDEEP 12288:MBVnKg49BheYUpaYZAjd95zYTz91tORREI0QQsvwEQJN1V9hvpgtlrfnPXg3Ta3O:O5ar7fYOjd95zYTz91tORREI0QQsvwEx
TLSH
T1F6D44912AB6DCBBEC95A4A39B831001665FCE50AB301B57ED70CED1D2D63F928D506E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Setup.Download.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Download.dll
Size 319KB
SHA256 d1511f387de0e5072d80c509dcc8b5d4d18f4f5c71d67691e3ef635483e239a0
MD5 485e7f928f5d85159c75c83da31fc6dd
SHA1 dba1a7ebbb7b6fa93de2d748f2fc2856022ce014
SHA512 2e441c4db75e0aa09668e737b78ad2d614cb2301ab6c3bf0f1e8fa9619fc4e4028dd3178fdde6615c71b2b93efd21b81fca86a5406d7e6a7906e7bcc006d6a28
SSDEEP 6144:43RU8k2pGRArl581Rl1yO2OuiRmiRyGucgMEhw9BSuEHpby0:D204l5i1DgMEh3p
TLSH
T167641816F6670B3BC649C639783107020DB97A096219F63DB5DCA88D2DE7FB11E206E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Setup.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.dll
Size 1.5MB
SHA256 a18036b773e74f9c565aef95705d73ec6844e64bc0eedd12c708d4eb46cb41c8
MD5 c81e4b9dc479581647e2440c5ac7d9d9
SHA1 7aa7fa56c36b5263b798d092a26bcdc7a02ee5de
SHA512 cee8a4ff1e94b26a2b187c1fd70a61402a919044ca561df7a05712a85256e3b2c1756205a1adfea8686a9ef874cb6f928b7d69dfcfd9b4060658c66509cdebb6
SSDEEP 24576:kpplUeQxLKgImFK/JwBIgxGktUMzqRI/aRsa3:IlUTLKglKhZ+tUMzqRI/a
TLSH
T14D755980BBE88B15E5FFAB79E47015210BB9FD426772E35E3554A6AD2C32B008D543B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Telemetry.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\Microsoft.VisualStudio.Telemetry.dll
Size 1.0MB
SHA256 305d0c0e832fdfb6f457a7cb92af7b0187b1115cb38649c05afa06d1293a8c60
MD5 8d1a680ac1190669a14cf7869b9f1e1e
SHA1 99b0d507ba75a1b5b4c33c8dc334b2c50a70ea4f
SHA512 e728afa188df5794adf9260643be2f5f39a7559affb0875bb9f63bdc8678d20bb50e3a1066e8a36610001df50128c694aaaf156e1192135dd07a668ae0fd0681
SSDEEP 24576:7+clYMc+ZwghVCgCFFCgnvN5ZigFCLsTBm6S+c5w:ATZbc5w
TLSH
T16B355A0233EC872AD1EF1A3AECB4052507B2FF176B66E75E2214A66D3C633549D507A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Utilities.Internal.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\Microsoft.VisualStudio.Utilities.Internal.dll
Size 61KB
SHA256 4d1d5efd28d72c332ba87e1993cb35e46404753543c5563700b98a97aa3c42a6
MD5 370769c79ea79463adbf0c6476225935
SHA1 2d340026691f83e069c4a87125ca096b9f26c97e
SHA512 5d3af80c54fda6d4d0de06f7b22722d400857743203a745bfcd1667e5e48ea8c2ef7b0c6ffede84b2ea2bd4b74a2ddc766c17392ed07f366d1f0a9b34eb5c63c
SSDEEP 768:3xzXLTPDE2gLJHKjhmpYWPEK/yPmjBkbxfm9OQbcj3gvA9zgH:ZPdIJHKjhMY42bxO9WL6IzgH
TLSH
T164536C00979C8327CAAE0B78A5F4819B1F71D2877942EF67188DE2B81C637C69D117B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\Newtonsoft.Json.dll
Size 714KB
SHA256 c93678ede5bf3c28b88acc564683cc40bda8348be83b38af686417278d84d0ae
MD5 4e44a14d03f9628ce60efba001e4ff55
SHA1 aed1fa363e1673807519cd562455e06b7df205db
SHA512 5e00a72488631a298522113cf140098d74b48f6365ad13cc281b8d314828d37f43f3d9bb5eb9e7575dd14ed38cc15f80cf6579d8bea04537ebaf8938eb5e0314
SSDEEP 12288:D5RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qU:Nm2VuaOKdKSUNz0IpBXyov8fC
TLSH
T1ADF45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\System.Buffers.dll
Size 23KB
SHA256 2d78d770c9cb997199154ae8c018b9f1d1efbc86729f7264dde6dbad2a12cac3
MD5 902760412abffbd10be14842e83f0c09
SHA1 d87680e1a96549cf45506d17566ec08c27a770d8
SHA512 016a283723e32eedaa3b3c6d92bbd0d4c4d2663ab0f0b74bda56d6d2d742632ea0005b3c0c982ca77dd152b839deed0af07228172f059c9e0840e31b530bd0f2
SSDEEP 384:7RJyzxhqFAB5n55560IZplFuA6ccxReXWd2WkRnfLXmztvGHRN7LgFA9bFs0R9zJ:FJyYkx60InTuP0njQtaUFQZs49zUS
TLSH
T187B27C11D79C422ADE7F1A716AF9DA862E3983C16102E66F144CF5040EE37C9DB31BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.DiagnosticSource.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\System.Diagnostics.DiagnosticSource.dll
Size 195KB
SHA256 6eec678b2197c4b77fb93a59140ac843be93c5e459757f96bffd69de451df8b8
MD5 f4e26aecd027254ea1f5de100f71304e
SHA1 150d06f83d09287bce445f125d0b3aba3841632e
SHA512 4d2d777b3e8a4bcba7cc6d16c977067c73e858846ceabbf57fb8eb6bd0955dc6595a789bb4d973b154fe2307de03acade21d72988ea53ca178b86abd2e2a736f
SSDEEP 6144:lHMA/vWlQoXkWgCfFzhzSY5zhzSYCzhzSYSRJgXRFK:qAHW2BoRuK
TLSH
T11E147D50B3DC42AEEFDF2771F0609C024BB6E95BA106D7AD3A49B5ED2813742C60176B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.FileSystem.AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\System.IO.FileSystem.AccessControl.dll
Size 27KB
SHA256 e6026501ad4056ff2f1655b0afdfe8923bc6e8fbad67e1e9ef56e3002f49fbb9
MD5 3409c581f0c5083f0c2a93a7a5ac9790
SHA1 18ea7bd41d31247148abf184527c9368a26f39e7
SHA512 ae877c6fddad0e4133274e6372d783eaa4dd6bdcbbf40ab66302fb89bd2f76b215130001186b5c9a135abd16336c5bfd4d414177704d7d359539da91918e82ed
SSDEEP 384:nmjoB5y+MLi9VYp/OiRc715ZkSAcE1l2Yd5zqNz8TWgVbWqdHRN7NfVlGsa9x:yCN9VYp/OiRcnZIfk8PpET
TLSH
T174D24A01A7FC436AEE7B0B316A76D5122F35F2D93913D11E1940E18E1E93BD89A32B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\System.Memory.dll
Size 141KB
SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
MD5 bd7f42207f4fdb9c7eafb0013abd7334
SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
TLSH
T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Http.Formatting.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\System.Net.Http.Formatting.dll
Size 174KB
SHA256 7b58adc6e23b24cd6615b35e848a002bda053a26d48f9ddafacfc8098e97c49c
MD5 b676d5e9828d6010339743f236f54ec4
SHA1 0dff461be2e04ebf6da5f4f2d3eb639cc2e0a8b5
SHA512 cca0ed47b391b12f44716db1921314e7dcbf2a9f6b0916c78642b4aa814825c570569b103a7f5e298e9c02dbae22e7cb905f08f80f94ad6dcb69fe09085cd8a8
SSDEEP 3072:BXWun8Jw8fCk/Dvf5eso7DpGbG8pwp2xuRLYs8ZS:BXWu8Jw4L/D3UVVGbGbMS
TLSH
T112044A2967FC4B1BE7FF59B8F430A454CE7AF2066416EB4D2C49A0EE1493340E521BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Numerics.Vectors.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\System.Numerics.Vectors.dll
Size 107KB
SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
MD5 a57f205ce75d4e4a19020e8b627469c4
SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
TLSH
T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\System.Runtime.CompilerServices.Unsafe.dll
Size 18KB
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.ProtectedData.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\System.Security.Cryptography.ProtectedData.dll
Size 21KB
SHA256 37fa9beebb4f6613a635378a7e145f9187e093471ba2aed5cdf9ae14874a5f7b
MD5 a318ebf2f27758e54c0ea57b15378f74
SHA1 12ccb75acaa049b5c3ff159f1150409fd88749b1
SHA512 1ba08929f6922240d99d5f5b21ad5ab662560e33b71ff2647511a574466f298bff3d38eed443ab4cedacd63a79b171d1907c86d11e32054273ac4b92eaacffc8
SSDEEP 384:9LQU2P9kG10HWAf6jDWPTb2HRN7Xvm1nR9zZiaN:Bv2FkkJU/iXvm1R9zZLN
TLSH
T1D3A25A31676C837BDE6709B0A171E5422E3EC3963512DD6E6788F2061CA738DD734B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\System.Security.Principal.Windows.dll
Size 17KB
SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
MD5 be2962225b441cc23575456f32a9cf6a
SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
TLSH
T153824A61D7AC8323CDB71A31997AE0533E3DD3C66822862A5689E1061D677C6D731738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.Extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\System.Threading.Tasks.Extensions.dll
Size 27KB
SHA256 af4e13ef418fd89b432de20cd1dfb7fa10a7179c8dd049c9856316e50c5949ca
MD5 0fff41795a1107691ec1e5054211c04a
SHA1 3439da9b7918fa0c17836acbe1fa4e05c40119ec
SHA512 1333847b76025af23a4a4dd421707732078673c96dcdb726a38b477c51606395002574fbcdbf224fd0ae5b80e8da8b2f02dd4972d88f31c36c3dcbf595510e90
SSDEEP 384:F7PVBSE/ug12sib05JCw0p8CUQefpnQKwU3RymGWuXWJwnHRN7rpGR9z04RI:9PV0iug12TY+bUKmGfXrY9z1
TLSH
T15FC28D6183B85113CF6F8E77D2A9CC175F74A3466A02E7391AECF2D40C5338A8A31275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msalruntime_arm64.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\runtimes\win-arm64\native\msalruntime_arm64.dll
Size 3.0MB
SHA256 b8b2515790b693af8a0c92bcca12572023a31673972860971cbb752d96b603ea
MD5 7d1fef4da46c483734fe70812f0fcb66
SHA1 f7174068da3d342c402c91e29cd6a1ddcc4575e9
SHA512 23f55ef8cd48a206e03f34e8c0dffcdf1bb3fb37f1bd58f22b0f1946046daea747567f31f1c70d78bda25f86316c2a600f8815c3944a244037f63f87dd3a574a
SSDEEP 24576:WIYmr9UBqQHCHxqi8hpVKddlf0fPyHUQFg1e1K0QDiPiWBADGxVN98uhL2EQIcoI:Wy96nCHxqiWKPK1edQDUkGJ2EQvo
TLSH
T13FE55D65EF4E6861D5D6D238EF6B87A8713BF5609534C2CB740B030CF9A6BE285D7022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msalruntime.dll

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\runtimes\win-x64\native\msalruntime.dll
Size 2.8MB
SHA256 bcd4776cf7b0320e413836b8023edc684a26ced6929da4e08b26e079b772fddc
MD5 152736d13555f16433f49ca1fe976a92
SHA1 df1df5e816c7acd01a6516366fbc379a5bf799aa
SHA512 a29e0c6ecabf3f7066e9ac75582f6a65634ebbc52907be5b7906ae60563079477edc4671650f01977b4521de0ca89514ea6d45ea92480c34ddb8ec9a136ea1a9
SSDEEP 49152:/gmW8Kwy8RQKOwlMCAorW7+hC2zA3t/xUPHBB4Or92rU6mGB:L+KfAoLw2GvUZBM4WB
TLSH
T1E8D5285AB35417A2C4F6D37C8A0B9183D2F1B68B037273D70A665665CFF76D0873AA02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vs_setup_bootstrapper.config

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\vs_setup_bootstrapper.config
Size 617B
SHA256 080fd8f1c4f7ae4c0c9de54007fe232722b1b649dbccb51cc789f06100bac1c8
MD5 b90b397a5ec0a9553d54f7ae7d088fea
SHA1 ee760f97ac827fdfdc160ce95ff074e7ecdd2965
SHA512 eff38dc01b75ecbf6d0b79159b3d5df5f26c0c5708b0943fa4b34b6346d3966cc3c2b40ef65499c56abae0e01615b335b377c1508feea9b0edc1b598e8c6b889
TLSH
T1B5F0C2B7C44851A79FE2B2C39460F465F767338F2DA28D8CE0E984040B51A5BD58B6FA
MD5 SHA1 SHA512 TLSH

Submit Download

vs_setup_bootstrapper.exe

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
Size 325KB
SHA256 36a9031acd109b0e69351a97556b02a3ecd5b066be191b814677a728a932fff1
MD5 9de84850113232b54adab43381e993a0
SHA1 c09a48b8fc496b857df2587fe8043a27192271dc
SHA512 32c8f0a61b19841469df4ea50225ae7897c72d47881fd18ee29c8a839062daabb22a0b9c88fa1e17a5843b03fc2113439371f15e494144d4ef4fabda88b2428d
SSDEEP 6144:rLiVRfrPuTwtnrBp0XPMpHkRG/aNnx/fdGquvsAn:niV1u0ERG/anx/fdTcsw
TLSH
T1C9649D5467FC8665E9BB1F34643416108EB1FA877B26EB9E6D8520CE1D32782DB20373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vs_setup_bootstrapper.exe.config

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\vs_setup_bootstrapper.exe.config
Size 6KB
SHA256 0946e735be14174e0e5ff0b0917e7b206907756c712fd736e282335052eb505b
MD5 7a732e1a3dfe159c727aa4e8829aabd4
SHA1 179e78bc71fb7b6e6cd0fb6e736c9069e26392ce
SHA512 b5795394309ee3191d5db1b5ef44255bb3a32a9283f4541fb1c2418198311de12e9366d14eadad1984ff185f8d6bf9e279a0dc69640bed1fc0d216f1b89cad93
SSDEEP 96:hr24644hj4U4ae4ve4pdomG5Ehqf6m7kKGjRjpjrbD:hrA+5Es0dff
TLSH
T194E16E20D1C8ABA98F7255F23D6B6428CB6D03B7288D059D70EE6E4B8F35D96520B077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vs_setup_bootstrapper.json

Path C:\Users\Admin\AppData\Local\Temp\c47b0a46ce84c1c90b8ef93669\vs_bootstrapper_d15\vs_setup_bootstrapper.json
Size 161B
SHA256 f6ca4d89c697c1c5383b8a1c8b00068b75e21d02223a2fc50c21d903ebbb044c
MD5 e32e025f75552ec7ed1dd19e25c6f880
SHA1 b1c5270f006f606144891706d362b4dd233fc1bb
SHA512 94ebee8fc8dcde0dd8961f0c28a120c7931735686c5faac270dea098bad016822e57c03def86d64af242503079426c7daaf79de748b422ec77eee991c0d6ca16
TLSH
T1D6C08CDEC328C02342B0B09B60871984693DAB43A3B925A481861430D2309E2A539C8E
MD5 SHA1 SHA512 TLSH

Submit Download

zy3embo0.json

Path C:\Users\Admin\AppData\Local\Temp\fh3amfq0.tpb\zy3embo0.json
Size 17.5MB
SHA256 c0b069003b64604d6d74632f10fa192e75ec5f1a37f5bed58de2bac49d263505
MD5 a9d357d9fe8d26bb614e5d362fcece87
SHA1 ccbb2229e2c153c34d350f90f4355a33ff615d63
SHA512 cc54b04da140ae52a686f52446478ec3712cd40736df69d7b9a3e7d5159385a4bef16c20309fc05a59cf1983550f52c7aa5ab965835ce5a517670a69e762726b
SSDEEP 49152:XO2kOpqm3HsiVUvwUIDkChcznBtfhtaaD0yQq:E
TLSH
T1EE07C81EF05C8C75EFF0134966439D92BA6F239B96F4EE88C5C18D24C26A3B8551B0E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p1sgepqs.json

Path C:\Users\Admin\AppData\Local\Temp\lkgcfzwi.ev5\p1sgepqs.json
Size 115KB
SHA256 d3aa7336680097d007876ffb85c9d2b5c32c21796e0125407c4e3b88ebe4fc31
MD5 45b4ef05ad2eb9021dce6573a46a287f
SHA1 57fa9340085455ce47b7f6a7568ae10e922eb15e
SHA512 8ef296c59499351581a2ac28ae266a675a4bcb1824ca22755c729446e4c4e321354cf6f285a742ede67da38ca2e2e99b57e4858084b12e2a9e23688e3af2eee7
SSDEEP 3072:BJV4DJJVUnJVUIJVIJVzJVC7JVC/JVheU1fP+s:BJVOJVCJVNJVIJVzJVC7JVC/JV0s
TLSH
T1D8C32A7BCAC9093D6704A2E3999FA98AF02C874E09F16DFCD5C5E62441B57E2C4470EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mnnlm0js.json

Path C:\Users\Admin\AppData\Local\Temp\mnnlm0js.json
Size 22KB
SHA256 b513eab2ca269686153292d3f2a766852aff3c374b032ec7c7cec72cb6ed59f3
MD5 584c1aab659621280dcf5b385796f0aa
SHA1 062e437ea7a86b6cb9d1e49fee7da9dce6b49ecb
SHA512 b2c2f4fe3b177d49c134eb9c5000952f7a4cc6d53e9184df7e27c2906708e0b59ff7edbfec4fa5291b617177e7176112fcd1c4fdc1b6cdbe6fcfc92a442885df
SSDEEP 384:GaBLFIcY3BgfTDugHQmAwAAQ9drYBW8L9Sb2YRaAQ2NpAZEfnRMXWYxRO5wkjn2/:5fM3OewXQ9d0xSbR7ginR2WYxk2kjn2/
TLSH
T14DA29DB35B70300C0D9BD940E9AD9BEA3C1CD7624DD264AA7D947C0BCD28B3621939DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab1.cab

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\CoreEditorFonts.310177BC7B20B281443E\cab1.cab
Size 161KB
SHA256 e9b2db94e5fba6f8a555587aaf616b6fa56cb9d3bdbca8c0fea4946ddba6b20f
MD5 1133c003a0a900b882e6ed7df10e5386
SHA1 33e7ec51161b9e814d6e3a5dfd58627114dfb0fd
SHA512 c0b71dd377e12537587fdd42960b40c51f8af2b6b9cf3a4dc472a7d0080022d4988eb3c01990921c87516600bcf270513a591fb779ad8ee4a32b3e20c7089c93
SSDEEP 3072:pCKjxr+Zh2f6c1PtHxA77tA4dT8obXADXjjy3vxoTcTY0Xn3Jv:pFiT2TPtHaVdT8gADT2/eATYGZv
TLSH
T11CF312B087AC541BEECF95387D95FB973C3183CF4DA07D6B1992FE412462AC28A191E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.Build.Dependencies.A3E92B9BA75332DC4CD1\payload.vsix
Size 832KB
SHA256 7783ae99a9645bf0139a6de80f85ecd12c5e3af4b74845574caa46c19a627c20
MD5 98ddc11584336d14351960a12c373059
SHA1 537a84e97ded90ef51c229a0bb362057588eb9a6
SHA512 efbaf627b5ea5b8ed619059855537d7ee0e9157e35c5c328e01fba82bb7d8eb0386863894975e2f370a67c3cfe14f2b97d9c6f937b5172434eee7a621836c7b5
SSDEEP 12288:meTowc8MGIys4cxShMJOTS/EtmLb5QxHe7Mw4zR5YxZZNgcmuURZcwzNIrV+Xv:mzwl1s8MJOTuUHeo57epUQwOrV+Xv
TLSH
T1BB05232FE4C4A8B8D672857A4B3763A3D50997D4D4969AF912CC84C40DACB9303B1CEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab1.cab

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.Build.FileTracker.Msi.C0D03ED78750444DE241\cab1.cab
Size 417KB
SHA256 5c577176eecd5dd175cfccbee00354ae4ed4af5a0dee8eae301098550c8ac818
MD5 d8ecbfb4239dbcabdc7d2f874908fc28
SHA1 fbd83dc0fd26accf0764f959c48bb3d663dfbc98
SHA512 f5b955fde943e64c31f2e3ebb15b9052b7ea1b83a2cf500ffd752371d864db6fad71e6e426449f8760ab9dfda8f6eceb8b05815f4ad960db5feac2b2abef99df
SSDEEP 12288:eSnfef/YllgB+xoKY/FeLKFsatVKoMQeX5zoc:RfefwllgYxZarFNtViQY1oc
TLSH
T13B9423D302DC968CF8993D7DADF38262B419FE8510A55063ECA8F01433377C1EB569A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Build.UnGAC.exe

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.Build.UnGAC.A31F89A730946A9352AB\Microsoft.Build.UnGAC.exe
Size 17KB
SHA256 83997a419ac1fe03702bfc64b34b9da59b12d8e36104f7331c80542189ac7c1c
MD5 66f91b546276553cb3cce44d75196d20
SHA1 f6a9d259c591e01263c28d03cfa611ea45fd6125
SHA512 9b97f123fdbdd4aeea0f7076e84bcd79526327af4fe4c45beabeecdfb48ac1d3d781552c9a47960f5653f1779c889db3b6ab8b2be835de02627203c0930df125
SSDEEP 192:lcCSJFu4ylxMCei6WyqmWWwwWCWKie1BzBWsea1W1K4dATNceKyX01k9z3AU/Z3m:GC94w96WyqmW0ZlNcKaAUyR9zVRFRb2
TLSH
T14B822A8287B84312EEF72EB0AAB4DD533D39A7D6CC6197AD1049E04D1D22781DA31B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpressionEvaluatorPackage.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.CodeAnalysis.ExpressionEvaluator.0D6EB06C431B3BFD54C0\ExpressionEvaluatorPackage.vsix
Size 661KB
SHA256 9c1dfbeffa86f349ed0d32cc54a7f1c1d1029327f9aa9f9758e6cf1f1783c5a2
MD5 8e2d4a21673875d3108488fbeba00f4e
SHA1 bed3ffc10d6e1410174d13be87fed6252424c26a
SHA512 2d4bd3965b7f4db52e9b52ad6fd19fb17a48e59aab32a68716ba6e28685085a9d3a66673de84e74b4d3f265e678c7c1dc2cf1f0a87e1dbac0cd0592f7dafa63f
SSDEEP 12288:ESds0a0pfKiHRmx9AAkvPSjrkxDe4K89zrl3YUGz6at7Q9xznpgJGl/LecSLjE4A:UvoKisWv6jrDBkYUGz6apMWElicSvE4A
TLSH
T144E4237B5A2A684ED883F0740B52A3CB4F2125D3A26E46EA0FF55F106693DC40F6787D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roslyn.VisualStudio.Setup.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.CodeAnalysis.VisualStudio.Setup.87ACEA890883B38AA62D\Roslyn.VisualStudio.Setup.vsix
Size 1.4MB
SHA256 f8447289cad65e4bd6e85afaa075eade82087cad7983fb805ac6a23aa132c918
MD5 e75ca50f0c58c375d67f2b19c866dff0
SHA1 7b89f8adadcf27b56053d00e2199d88af189a748
SHA512 49cefa336ad695e874a4a23aaa06ed3810e9fc1b6b98758ad5dc8071fc0dee4536a6e67d2ac11ee2dd5d991223929d191e7313ca700904ce80fd01395c13183b
SSDEEP 24576:xiEas3m9v8+BG8K+/IWmWGGc+o2pd55xDfu7d4SFqar7ISDec+Me2HR+MZV:x5Q9lBHK++hQz55xDfZQ71XHR+MZV
TLSH
T16065331AAA71306AE7DC73F040592C95676863ED8167CEBDFB4F03AAA44D7B81C87181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.DataAI.NuGetRecommender.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.DataAI.NuGetRecommender.0CF7656F7D5DD9A2501B\Microsoft.DataAI.NuGetRecommender.vsix
Size 1.6MB
SHA256 233059bf80865a5aa33ac1137cf7da966d39b904782e16620037c774c4e9369c
MD5 c36380c3a85c40b99d32d91e034ff776
SHA1 ef3e77ac72e3063f1f83d5fc728594f3d2a55551
SHA512 2155dd3c63eefb430b57b854cff98d3a0c6b98047d14c2c73d5a86723975ae475a7f3b7a5e37c218a50fbbea19d5cdf921a8d6e08dee86df74bd015e62289d44
SSDEEP 49152:WxmVZQoZE9uy6IW4pbY5UP/25SoFN3dlmxO6xW:emj8APe+5SoFJLNN
TLSH
T19175333F5C91DDD2F9FF75BD7634BCE2E0A8A352A94513A48CD6020AC6CFF680924691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Developer.IdentityServiceGS.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.Developer.IdentityServiceGS.3D407ED0AB4F22B66529\Microsoft.Developer.IdentityServiceGS.vsix
Size 31KB
SHA256 047918ec67472fced4f920a22845d66c200055538ce53e4c567b855b6b6f743c
MD5 bc78497cabb5f296ff394ce99a48c024
SHA1 736d31e15a23735df9d761e2607c71b3e90caef7
SHA512 3f152f4a3bb564452daf45fe5055f143d2ee213d5a88794119868d3885da150b07c9c53bf935ae49c4fe2efd536ae746abb88ce2e28114e3c482c36c5519f8a5
SSDEEP 384:zLbJ/4z0UkLU7WSg8rp8xqPpH1eVrjVN+xSVXvwIJL4oR0Q3cdbQ7Mn9MYh1SgQL:zLbJg+cWSXrp4IHsVvRvwIS+0WMP1m3
TLSH
T18BE2CF2A59DCA431C43AD83846467067C208B64A6C05791FC6D68F3D0E9AB9B3377DDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.DiaSymReader.8DEA700B893F85625263\payload.vsix
Size 47KB
SHA256 8a7cdebd4349d32b3d3aa08c362da30a21b67fb66a14b44b1c30cb14238a874c
MD5 93375a7a073079f5c0ad4d24def29345
SHA1 958c317e6cf5067c0e4284803aa1992b00d65edb
SHA512 6ea9954efe41b696d5a39b23d75119213cd5faf5f61be480a936b7a05070bb35a430972ad48b1e6a42c77602a9c7b9947f5517be7e4357f7787edb22f704c445
SSDEEP 768:fuQdT+/rWIuRht2ychy/tw7PnwRNAm9zTxwVYGer1+dEUX4lNnJ0YzQqzxe8i6wE:fLV+/rW9tht4PMAEnxBZAP4lNmYzHuVS
TLSH
T18523F1D3CFFB9196C947D43C04B8550EEA4CCA87BAC3078212649914FD8AF617627EB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.DiaSymReader.PortablePdb.62194A4B7E1F00768D0F\payload.vsix
Size 57KB
SHA256 c34b974caf329dea54580c0db53265157306131f7bec51c5df457d522aa7f72e
MD5 b1bed94d23839318db5b9283c87aca81
SHA1 9f51f66a846d49db0f9c100e5159fa055aeec095
SHA512 41177d7a6bdd96413bb35791d5adc4558f466263f3ba94eed35696a710a341419dd3363b2f0896216f6794ae4d83557ecee84b2df5a24f9e1b65ec68177c2138
SSDEEP 1536:EYgUTaJZMY0QrUKJYq2WszXGM451Jjg0al:nbnQrUWGWmh4RjT+
TLSH
T1BE43020A8EC64080D446ADFE17636D6AC4CB2BCE6B147FF12594D34D645C7D44FA827B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.DiagnosticsHub.Collection.x64.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.DiagnosticsHub.Collection.E17313DB670E9B8B5042\Microsoft.DiagnosticsHub.Collection.x64.vsix
Size 256KB
SHA256 2324cad7a2298b4a163c8bbf1c37e66ba40f7cd0d33d390cc2e39e724f2879c0
MD5 993f31391a28dc662f5db3dc646f3f55
SHA1 f5e815ac7889c7830ce205a2457233fdb4d0d97c
SHA512 4fadf42bc9b3bc3ed7c09f670d3fefce6b6dd832453c7de5b5cd651d407f25f27e0dd6fe64c94587546832675b5394cee193ae0a5fd3a272313e7527486f0a0a
SSDEEP 6144:yVjBFyULOhCvuVhuMk5C7KOPn1hBlsh25H93WR:yVjBFyqOhDV0F5mKOP1hBle25o
TLSH
T190442310A60C2178829E95FABC56479BBFCC385BB5F662535006DDF0D2F21ED921CA2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cabx64_1.cab

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.DiagnosticsHub.Collection.Service.C72618768485C45D5591\cabx64_1.cab
Size 128KB
SHA256 5ef0bc64a12169219ed7218568aac07f20c9010e521de8e754ff07e487d60771
MD5 aa895aa348237fb158ee366c5738a7ac
SHA1 3bda7362117131e556e5ff3f4a38d2ea1c9ee291
SHA512 7e344ff4855243e39300e3acc6675fefc0534eae08b1bf5496909be5b11d84a47d3e7383d5c96e6b775b6b4ecdac2ba2b108690bc0ed3891ccca6726db889230
SSDEEP 3072:aMKASWuVfSCxkostfHkyY8CzCqP+u+knw3f7CCBUqhdkQbHLEZ36Ih:Fh10KafkZsPB+cw3oqdkQ7LS
TLSH
T14CD312693DE26C3B9F69581D63C2647472B751D93762BBDCF008E8F219794A02F10BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.DiagnosticsHub.Runtime.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.DiagnosticsHub.Runtime.51C02C7E6C432613FA4C\Microsoft.DiagnosticsHub.Runtime.vsix
Size 64KB
SHA256 20d528acee8cc4ab3e9b2a90ebd2be4afb39a71d19eb1e660ea546e74e753929
MD5 3c26bfeaf79b04f3ea2bf18da5a2109d
SHA1 aa9c1b77dc7e17820ed680b0534e04828a458c98
SHA512 eb2fdb57c6e6f2b7a796a99f6fc5dcdcb649844c3bfaff25f0bd73a02ea8e91eda501448529aaddc911c30284b25f080294dfbf7cdfbb51524856b9f93f0b139
SSDEEP 1536:1w6I364XqFt3cmZeuWC0T+Em2bbILJ1P/uqVYJ:W3Ul7AuWL6D2bbI6gYJ
TLSH
T1245302BE70EFF059EB7D0931895C1A82C2E108D427419D784F4C61C9A5CE8FED93295E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.IntelliTrace.CollectorCab.BCFFEC7CDA9979E679BB\payload.vsix
Size 2.7MB
SHA256 68ceed4cf61def508fc8f0a6101af2dc8a35e90692ad64ecbf4a72cac2446c30
MD5 35f9d02649851b6d1b312ad342a70db6
SHA1 0172d70bea209696f5741504f9d045424773d1b1
SHA512 b6b5421c3e79657e5542cb0efb96998a4ef857e383fe6bc0777eda821ff11d058b675f575734edec2eda9ff08a0f09a6a14935be394c4c7daf849dc3596c6fea
SSDEEP 49152:B+ioNVlj7YqTfqBTkMyrzi5uActDz5qXL9mtVXQvHjkorfJvbQErbchDvNlSBQCf:BJgljlTfqBoMyv9JJML9IVA4oV1clCQE
TLSH
T1B8D533B1D8021F45D5AA167EE7BEBBF23EF1BA9A60D1354E53A42EC8201138115B3D4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.IntelliTrace.DiagnosticsHub.A6CE76A066E59075FF86\payload.vsix
Size 178KB
SHA256 7844e70f274e9b56ec17331c4e68e92aa34bcc955172d5c1f386a0333075e3c2
MD5 92c4fb273f14658a2ae4823f023d62a5
SHA1 b10e0f70775b572e85422f8f231a1cec8309178a
SHA512 ee2ba7e17efc7454a587db605c182fc190eca461295943b255e37f0938c94c32b6db3a19a04da76655e13f8dbbd126c50844636b9f35a55a3463f80e6f75063c
SSDEEP 3072:x4N7yEo88t9cTUnbt8doMI9ONIed/kJuzohd+it2kyl+HIZGhaZltx3TyU:xWOyTUnbyds9Kd/kJuMOit2kylfZGgaU
TLSH
T179041212E76A0890CA8CA4BAD8DB308602CD576F7E71FDFB1DC3E04995AFB149D25217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.MSHtml.50D05AF5EE448DE04862\payload.vsix
Size 1.6MB
SHA256 4c7cbd4e9b35be6cbfd0cf1f57fea4e6bdf41eaf664eabf2e2957b210c52461c
MD5 5be782285bd91a2257735f1c433be9fa
SHA1 d83c288f33b07cd6c93eb99b1ff4859de4cb6feb
SHA512 4d869cef97ef6d01a36e13bf2b4bb186e52ef9015bf0a9a627e63cfc13a08ec13fe853788a6f0d8564e034abb5b37474620f13d79e8fcea79de39aad471dbb7b
SSDEEP 24576:IGCV4GlXycZW4t5IdHTjY3St7czACjByJvwIk6892dnhB4Ir/G51rAh8got+Z:ILPyuUHY3St7rNwIk68ShOIrjeU
TLSH
T188751235A6D3FB531918D5D4992D5FD2C7B3906102E44A2AE24E8BF2D063A7FC1FD8A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aspnetcore-runtime-x64.zip

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.Net.10.0.Runtime.8078B0957D42F8A721EA\aspnetcore-runtime-x64.zip
Size 12.5MB
SHA256 5175137285b8b0ed54d0c8f6fc0df74a33a592771011d57ccfae6ff905027fd5
MD5 12a1a8b79907ac1ed90ba42241ed0846
SHA1 9bc575cc5aba15ffadcfc3bd7ea47ef14d0f7117
SHA512 32f2bdaaa52aea645d3ba2eac739526dc172292b6697f9e68b4abc9f99e2229bafa46ee62bfa5d038f852891db2983547c04c55e5f22d1d7c21e08ea6ef2f43f
SSDEEP 393216:5qhZds8ChIhh6gNk7W5/wERI8HlazGH7uEnV8:e7/CO6gNkGhRI8H0aH7HV8
TLSH
T1D2D6337E0D1B2869E974C662777122DFEE1E555B32F9EC3810A3C8DC0A17AF127B4681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-x64.zip

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.Net.10.0.WindowsDesktop.Runtime.1DD3F82C6D8DF6F5946B\windowsdesktop-runtime-x64.zip
Size 10.3MB
SHA256 88b0911ef605d3485d2bc6744672c4709a3cb32821bbeb6032601ac455b48feb
MD5 57351be4327246acf936cfbd0b03e970
SHA1 a34a4d88f3c3e82d950f63b55adf7fbcf2df8b48
SHA512 112ec472fef40447caa3a1c602808a4201753b1c71a607f4333bcb58eabc057b3a5821eaf18667196ec7f02c93f6c836839f974b9e59ebc98e99e036cc87215e
SSDEEP 196608:PIl05lhZ3aj5ju1ujDSVmYzt7UHaf+meO+nnncFmOwSo/9woypUApiQ8lfTbvpcb:PIq5XZ3c1ihQ1FO+nncFySo/PypUAojO
TLSH
T1E6B6339D23CDE51C9908CD50F49A679467C3EE0FC321EEED6D640909A089E81B77B4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aspnetcore-runtime-x64.zip

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.Net.8.0.Runtime.23919300CE920BB79C71\aspnetcore-runtime-x64.zip
Size 9.5MB
SHA256 a96d19bdcce533abf59571cfaa1fe6426f5aaba0af62ee61b403b8d40baf7a9f
MD5 ef6200eaacde239ef880c1985bd6a3ab
SHA1 375b93617be0793e405f172f24535b27c3087a69
SHA512 6969d79458e05d69cb15073aa38ebc8889e24b786d009467d05c655dc435b8cc57c3e4336947bee0010c2db53ffb4024259fcbf48250620a821dee2af9dfa77f
SSDEEP 196608:O9dQRq885mYirrDqcupR3QPswAuh2yG6jOPhJ2X4tK9NW62Vw8R5W7Tryflob:OsRq8CizqVPREhaGIjVhR5W7Gly
TLSH
T132A63395A8D2CF9FAB5E03916A737F45796A334FD6EB50AA05BA8140438F7F0CD8C805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-x64.zip

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.Net.8.0.WindowsDesktop.Runtime.4CCDF70FA2266E825A4F\windowsdesktop-runtime-x64.zip
Size 14.0MB
SHA256 5b5af3f27a9ede5d283926422501ba0c126f6449c647c6bc096e305f804dc8d5
MD5 d922d11989b970ea66c10d42ace95e14
SHA1 eec9101189b5459043993d53114c006579c0e3ed
SHA512 6126d820cc2c8250d6974a192d571fa22b0b93ffb6eae41b88785799525aa87e357e326824a142dc3010dd3d35ecffd62fd017f851ff6ff94bc50eaaf91ebdea
SSDEEP 393216:eEo1w1bj/6sD9/2AjYHJQq3hISi/YIK7T6stAhmMNHuQm:z5j/9JpYHJQoI7KEhRNHuQm
TLSH
T1DAE633016836C9CA0BBF6E82A70B5FC91D84BD6D9A874CF1F78A56C1D734EE70636484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.ServiceHub.Node.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.ServiceHub.Node.88DE75BD31A3C08FF5AA\Microsoft.ServiceHub.Node.vsix
Size 177KB
SHA256 403f54e6ff50eb2765487f0116a813e223e8bc2b744d0e0ccbcc28c947c5ee1b
MD5 638797157a670bcc64972d6d0d9def69
SHA1 2918f4ef7e7cfa9bc5e2001ddd1716f3235f9d53
SHA512 7c52d70509b22ef4816d3e0d34728a9e5e081bb894672714f4fa10febd1f8bc1bd9bf1e06aee26f7b70676e939768273cbcd8b4eb1542d12b2a459a67d0ac005
SSDEEP 3072:DM6v2/pOGS+mtmAFLQTW5hHHWUvovgC2DzNHfK08nam/fk9guXou1zmsBv7:A6vXGSVtmAFLYKhnWEovcfNHfK08naiY
TLSH
T122041236E63D1A74D691A03C3A217043EEDF9708C79EA35667DA320870CAE5693E6713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualCpp.Tools.Common.Utils.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualCpp.Tools.Common.Utils.A083C2931CBC62DA8C21\Microsoft.VisualCpp.Tools.Common.Utils.vsix
Size 75KB
SHA256 42265bc4245f216f87787b8066aa002b15f64b621d393a796f6fb82d3cb5e2e7
MD5 c973f3d4aa2c581cd750b015c1edecbe
SHA1 407e8ff5d6365ee31ae926c82fc5cbe77f24aff2
SHA512 de8c4216d503b85692307fff598c3309ab9980e7d44badf395833d6f097072823a58c1874291c45ddec2c6f65f1b208f3fae64fc275a015a2fdace1ffe24bdea
SSDEEP 1536:OYp+AwL2v7AjBkEChlKj/q6hXwCrgDcr8Ofi1nQc7AJ9mWRoKe5YUPn:nAAwL2v7AFCh0jHwIjYnl7ARRovKUf
TLSH
T1B373021AC353EAA5E1279C3586553136B7F936E180C24D983F8850F1E2F3A94B5168FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualCpp.Tools.Common.Utils.Resources.enu.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualCpp.Tools.Common.Utils.Resources.D14009CD4AB6E4BD0FF8\Microsoft.VisualCpp.Tools.Common.Utils.Resources.enu.vsix
Size 30KB
SHA256 fec1857a151da92c5daa2bddb105edb42691631fdbdfb25f53775b6117cc71ef
MD5 a8edbcdd405cb0a241d9eaecd86e2d67
SHA1 8284df39195493c7b26810d2a37efe628246431f
SHA512 9e84e96027ba2792df35e20ca509bb29cca0cf8afb26111281fa8745e9805b0fa6d6455e2a69bbee12d06f08e6ad73ac7fe616fc80647b92cb6070fd97ad1c1b
SSDEEP 768:fSmrqX8pyweDTAC3D7m1D4+aP8eknmp4cW:fSSqspyLDNSE4mpnW
TLSH
T198E2E1455D24E221E62A867DA2E3F97FFD0163C21B10EA431164C5AC06DD7B26F3B1AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualCpp.Tools.Common.UtilsPrereq.0E4E54A04ABA21082DCB\payload.vsix
Size 256KB
SHA256 90427052d5b7c7a4ce3bea38a0e0cc41a0d331a12d0bb461611827b787922034
MD5 894cbc5599fd69f400e158587173447f
SHA1 2016848a4d987173d35a7fd06984861b130628ce
SHA512 474b9b114a9fee8ea17e6f251f98b54b1b028b3fb4fe3ddcf717d3d0987fde06bcad427b6a61eb95a18ba6580b0d7a2247a84f19a48ea13fd7bc2f8decb91d7a
SSDEEP 6144:qJRhBPyiRfWzlMRquihBTdT2RUmZ7/VnF7yEOzc5t9:qJLVdfWWRquihFdT2RlZWU
TLSH
T1E5442293FE01BDB9D30A3C7940A8BCEEBE54470A661EE30A6DB1505482CC5E619E5D8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.AzureSDK.4B94CDFA32E7126105B5\payload.vsix
Size 1.6MB
SHA256 4d125892daae191b12a03e1720422ca640b031b3a219c88a6e86f54090ad9d9a
MD5 d0059ac9fd2143d5829341afa7b12455
SHA1 e1d88d8cadf5e5339c875156f338d269e47c88f7
SHA512 dd8fab31566f6b5e5b22bfd6785eea3c6d63bb79ba56459f34b9a3e1531f0de5e5f12282461fb3bc3c3a1ce64e7def303e9a919ed0d147ff60f0a01477dde9b5
SSDEEP 24576:yg1oEpNmyihxRFiF4/eGrjFwL/6bNM8JlL3/xUBzvx20QBpNrE86848tHuwSgz23:yUcXF5/1rBwL/6j73/woHj4v8tHuwr8
TLSH
T1DB75333DB424AA3DF38541FAD57E72E253FA5273248DF6C9F42D0901644EEA202897F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Branding.Community.FEEE04E4094F4B4D12A9\payload.vsix
Size 3.0MB
SHA256 5f8898bb78c228c3ff8345c54bb2f61c9a5325cbdc97b0af1e74391e16f21aa8
MD5 d07dca6c034614b4df805daaf86e8d3e
SHA1 5cc09e87ac94e34035a212711b883a181fe80830
SHA512 e0298c390dde071e7bfa6b976bb912a3bd4b82959d7ad18e196c5216e704d65c5ed2708ba70d94cfa8c4ced94625dbc763ab22dc89e38485938cb11d8db5200b
SSDEEP 49152:YbP2WWCXeRPbSk27tSZ8mNUgQEVl3m4MwbAxgVrEROMnEbZoQTMSspL6q4iazw2/:YbQAs5c48oMibH/rERO0UU14iwgeAe
TLSH
T153E533D891DFC74AF722CAA317DA0C4E645E45A7E12F0ED4AD6AFEED4005B163F004A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Cache.Service.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Cache.Service.884372EECE10639A0A94\Microsoft.VisualStudio.Cache.Service.vsix
Size 8.6MB
SHA256 99bb6546033e31b5bac25b6c9c99fef1d4a57be0ffab9b41a8b02c8b715af31f
MD5 5e6bdf31120cc148da6f7112820f2881
SHA1 71ebe11b9fbc2dcb311ceba4f3875cd0791c2571
SHA512 2fc179d80e61141de15730e13b1757d029f24f03d3f5821ca8da2619f3aad3061199c0ba323f797ed45822c0a70463528ff22cf37dbddb1435c579e56f6df8bf
SSDEEP 196608:aA6C4r50S+/XGjLuLl4oEu/fHYBI4abjbc3DECO3AaH5nwePK:aHrFQ/2svTfWIZjsnkZRK
TLSH
T1799633A1A0F82260BFEB41D59858CA9F273D5BD64243D67B7DA0DA0B0753D83ACFC944
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.CSharp.Neutral.74F2FA0D36226287A5E0\payload.vsix
Size 24KB
SHA256 72e65ceb699904fdb5a444ab144396e840d2681d72ed9451e38faf58150f5c3b
MD5 1b894bf8cd2dfcc489a7632458f15b69
SHA1 1b1971192e1442ee5822b556243c2565de48e060
SHA512 bc1053f5c2c4d9b259392e9ec67569a43bf9c17d29859936f63c4b4e420cba2e34186ff4c5ea78d81c26a3b4e889195d1283318777a4c30c07f3b1ab6feac3bd
SSDEEP 768:mTHYl9/ih6m7oRAdF6UXNS7WZ8ytU0sgIdeO:mMlxio2v/Agk
TLSH
T1FAB26CB0E9155971C34F9E3961C13063C3C4A3084ACCDA661EE97299D8EA7912F36BCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.CSharp.Resources.Neutral.8D01BA89225B71B193F9\payload.vsix
Size 93KB
SHA256 41d8f87f4d8c7c711ddac7c13a9d9b67c139ac26750a4aa39e752263caf26dae
MD5 cfbf67c44a6481ba279a8bd394843445
SHA1 72c5b5f6da8f71366e890068edbda378c08efac5
SHA512 7ecc353b87465e5f3faf50d3b39013fe446fd57383caa4489aa492f0e7825bd575c1ccb2594ba567850867d6425152dc6119249cf1fcdc1f22119a0220943a86
SSDEEP 1536:Zw53SPBTUwsun18Zq2BU8teeE/jeGJ3MFEnnBr60pgK6fOtRuj:ZC3cTUnun17h/jeyMunBmGZSOtRG
TLSH
T179938E9CF4489874F31BCD3804D635528EE0161297A4D8B981E3D79EFDCA78C8B2D5AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.CSharp.Resources.Targeted.77895C8D5C77403E012B\payload.vsix
Size 53KB
SHA256 9da5404303c16629a4147361b974419fae3edb379bbb45309ef11d5d39ec536f
MD5 12f9cbfac96659064de48a9cd3b6bf4b
SHA1 1c298ed7ec1b60a29ba60fca3abb0c73afacdf64
SHA512 ae820baf1ab274147a65d79ef02a7f68adea48ce60a62696bba5f74bb56116b27fbc2c2a4f7692f661d2d1303c13d2183b6c2ee9ae1c5c66ed71222c9fbf2d52
SSDEEP 1536:iqDtjAwd9ghCyaEsHV8eL/bk/Jd+Tlk865s:ibR0vHbbkj+ZOy
TLSH
T1D1330101E335C0A7E119EB707DAB2643FB8FDA5B54028D02695297DBB90756F071EE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.CSharp.Targeted.C81DD088143CEA966AB9\payload.vsix
Size 1.5MB
SHA256 00b91693bec40bfb2851d8801788ae9acf89aaedf4585d2ff5517631c693f926
MD5 ab202c6549f2402bcf25663d6701f1d3
SHA1 dc6a076b99c99220cb9cff29e617260426132ec4
SHA512 fa5ab0079b4705b6b7978d6abe7abb773858b6c0d09872c7e30164d318e05e29ac34f7f70b2c003540ac12b2b1c1bc6788edf4a9b4373e60667140b7a9291647
SSDEEP 49152:PBN3zMsIudvsaZQSlleGuE8znqXNNyFv23iL0tTgO:PBN3QQdvsaySTUVIyE3iu
TLSH
T15075338DDABC3F6EE5C6D3759D090DB901C2986A5C7AA2B0E463711BDF051C0AD2B83D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.ProductArch.Neutral.8365767BBAF13220BDA5\payload.vsix
Size 4.5MB
SHA256 2b72424470ac093343ab727aa126f05376be1764d17ca9ad13baf9a9ad59708d
MD5 3304dcc79d1a476fb1385b160ad08d3c
SHA1 04231f7ec2e296557a0af62d919502717860a0a9
SHA512 fbfb4403409cb07905b61b18a7b5916615b679b0cd6dd65752f171e78574ab87782c656fe25151c7f53b5afa7a6a8b8267672818be8d06f7e41db9cb5c094404
SSDEEP 98304:ckbC3b2ROoIp3YIoJOFoMymLxxEdP7SZ1tRf5GnMT+jwuUhR3q:tbmabIyY2vmL4P7AtXGMysugRq
TLSH
T10426336CD6678E17CA7FCBF8C7C724660A72435E90297D8C4ED9072CC9D17E5236A209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.ProductArch.NeutralExtra.4A1F00FE40E03562F31C\payload.vsix
Size 18KB
SHA256 6c737df26d89b271bedd5b09098eb8f2ef2b7f44848b5bd03945fa4d549d80cb
MD5 1608820ef1c7dd8aaa8cc7b167688116
SHA1 233b378759bf7e3f5063ca643062a8053f30983f
SHA512 dd234cc9996bb7fe22c0d7c41b09ba1978c1afa3d3642f460bc2fb1f7f9cdd9b345fe05d42e22373568c166822433c43fa0b423a40dd00d75368d7823448a687
SSDEEP 384:Hd0vMAsAe/i1UbxsMzCI8u3xhO/6xVd8q:mvMAumUF5f3xhO/6xHp
TLSH
T1CA829015EF741042EB998A3490D5342BD3EFBD89E0C2DE4515F6324C8AD67812E1BBDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.ProductArch.Resources.Neutral.7CFB9FD4B82D944BBCEA\payload.vsix
Size 328KB
SHA256 3cb8503be73d29b72fe93769cc13b8d8bff19eca5a32137735e4f06541de4877
MD5 15ae69cbbe11218639cf392c13eb5ea8
SHA1 ae1b64416425dba7f42d73bc82256ca538e76b94
SHA512 7d1d38603478bed8f1db7a645a19a8ba20c4bd0c768cab4f6f2dcb7c585a562c94ddd404a665ba6fecf704b925afffff93b16f8c748a395048e95fa7722029ff
SSDEEP 6144:bR/rrD6y2jHBd0z4JvmIcEZQNxwthSKxIRBADOPAkdspPibsWn17CI:FrrD6jC401EZanB+H3p6QWnB
TLSH
T1D6641219E019484AE212DE3A44E3325B4B1812C1DDEDD8CD16C58A88D8DFBED1FFDBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.ProductArch.Resources.NeutralExtra.9A2E5004AFBBBFE8A3E0\payload.vsix
Size 48KB
SHA256 e083f2b3bd5a62fe6283aaba7096d41cf15dfd50cad235e0f68e2b88b2393253
MD5 10577fd6cb587428928fb8f3c0e8d94c
SHA1 4db6036444accfe5cf543938a70e655e536a927f
SHA512 16e158d7cff647d4b7b7da2b9b3a9238d17f4066c6b8fbe82a63ba7e15e2df27b565d7630a720a5cd5d8be302ce6d33c5f08849650ea11fc661784a07a65ea35
SSDEEP 768:LqjbQzibtJgNevQFFTi80ePXLIkoFvRsv4ITOUWaRlYqIDWNVQO6:Tzibz9ooFsrlwWNeO6
TLSH
T17E23F13C5D6E974CC10B39B08DE9BB3A5253629F20C7509232E43B90A045F658975FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.ProductArch.Resources.Targeted.9ED731FDC08BC2F8324F\payload.vsix
Size 320KB
SHA256 c60d1b91741a6f42e6d6ebbd69b05e5ca2d3055d5ea6bec88904696709d0c69e
MD5 f320587ec7caf0734d18f19c7999c2c3
SHA1 7f4ec09e46e520129106728aec12145657ae2e68
SHA512 7799dd962581bde24bac097e3778541a484ed4ca02607266345684fac2ce9370a51e017260b79e5150a920445a1326951e4bb5f4b09258de11fcd783dbc9eb6d
SSDEEP 6144:QRdGbjWogOY7hWDuVIcrezOYOsHhHxeojJuHDMVwmOmZ/nFXbreLHToQWbUYC:QLJV7hWDKsrHhdj0jMxhnFXbreDs7rC
TLSH
T10764232C8E030708D7982A7520BC3D63764DAE85658BD9D3E6AC8BED6E1174C7D0DBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.ProductArch.Targeted.B2DD0E5943F6354EB212\payload.vsix
Size 8.1MB
SHA256 cafad7b1bbab3b004796d04db3b39d44c0777ee6f0165a5d68cf6ebeb1412e0e
MD5 f50c9cd217346317cd5204cff3bf7134
SHA1 7ac2aa7065805dbdeeb7b4e2e033a5fcd34674cd
SHA512 1069b6d87d34bd31148a2af6f48055cf0f5d026582e1ee26946945fb4e23901d7f0c886d736730b26ec46ff226e9dc65ba8f142b2834d513c97549592b803d83
SSDEEP 196608:Cxa4JbXvOYx/WOqCC1Hib9wtFzCxywOUAIh5Joe:Cx/JbfvxODC19uGjASoe
TLSH
T11A863373C6678720E81DD43912168C6DBF1B1AFF89A2BDF60D1409605DB3662FD2ED22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.ProductArch.TargetedExtra.BA1D02301992DD426BB1\payload.vsix
Size 480KB
SHA256 3939b7a55573573a8375b49121857cd2d4da9a8370307a4c06153a8a20ef282a
MD5 86be6b2869ff646bef08ee8d10c7407a
SHA1 0ea00b75bf10752085e68a697b8de6e8f67e69ba
SHA512 1d6f1f5b743ea73fd2ed20dcbaa3f5ccfc9c6c5546cb1b791e191077e492ba3929f0bfd19f30fc4d9479aed7d75239523c3f094c9236a35b81625c9f665e482f
SSDEEP 12288:5yGGAoxK59OUEHbzTcTb497Ggt7lsgIqIK2ta4FHybk:gG7o0UUEH34q7XrIqota4FS4
TLSH
T161A423A0934F8D646A0F3F379F3CF4050606E2F2326976587E25BA922CD1D8F6876D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.VB.Neutral.6D5E6B33197CD153EA08\payload.vsix
Size 18KB
SHA256 3c9c3bac3186b27ba2daf922a60d99255af471bee22a16c2b3efbd150fe38add
MD5 6bb0f1678a773c6553de62ce89d88bc9
SHA1 bff0422912cf7bd0dd12dccbd76a00037ad673a2
SHA512 355a2afc83d890bbcc58bf489de76da51b6b1657dbf58ea60d106297d5a34311841735239569193a962f9177b0a2db9dbb9f0521e23b1eaa3ab609f3ab5ad484
SSDEEP 384:2q/FYd5B2a9/KXdmGzL6vrRxp587YFIivj8U1/sU:2qta5U6SdH6vrc7QIL0d
TLSH
T125828D24CFF58544E753D7391292B43643EB6DA4B282A8415AE9730EC6E8B003A7B56F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.VB.Resources.Neutral.F718C4253AD9A8507CB2\payload.vsix
Size 449KB
SHA256 0d2a2b80901a2df4f82f5764a7a5b41f5daa98314b14f27ef30806dbcd2da64e
MD5 6602ca9c1030058e63ce2803ddd51333
SHA1 d7c810ce6b65156bf28df1d24b4454cfdb01ff7f
SHA512 6806f92d84ee437c080268a53881a700bc2ab9a9953e5b957b952f1872ba8981b8815fb7353778db3b77f0b40739c6fb73eda680d90d5d93677bd24e1f106517
SSDEEP 12288:N9CrHGa49LSI7AiMKYud0PJ7jpH9RQOn4Mh2z5:N9QHGxSI7xUJ75bP4Mkz5
TLSH
T1E6A49E65D90028A0EBB7C47901D370535EB2B94227A1D86A06E6C79EE8CD78D0F377DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.VB.Resources.Targeted.094527CCED546E1E2550\payload.vsix
Size 146KB
SHA256 0f302a7c9a7543e19ecbaacaa7e0e6120d4d93d665adcc9191b88ddd95794da4
MD5 0bb61d5305edd16ea5a9561ef1464542
SHA1 611669a87481606c12152e61a84d8348f6704b52
SHA512 19d71ea58b1df57f6647fe82f0ba2c3db63b9cd6615f24521f34951c39f15d0582529c8fa6178d25e80d6f3a1c044ed757e366325c0f72f8b8dde6664be92fc1
SSDEEP 3072:Gk+j7NK12Vk6n8CK6fXffZjJxuFae7oLgxZePDzM9u54T3WHE53Db0rlP:GDNPk68CTfXJ9xuIXWePfM9IlHSDb0r9
TLSH
T1D8E312C1150B6656E4C40E70BC553B5D1A8B5B480E7CD33F0ACBAE5F8386AAA3117DAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Community.VB.Targeted.BDF0059A86000C53975E\payload.vsix
Size 5.7MB
SHA256 15177850696c1af863dd80c0fa947e95f12c27c209e4c5982f26e998361c3a28
MD5 bb1f46f99654ee2143b965dfa957661a
SHA1 810b7e52fe59fb4dda077a058efbdd94b84a8464
SHA512 5aad6e8c4e7ffae71f82e17b366fd2838932fa9d5492b46e1faffa427f102a87361c3b44d462c25af28183715b9c8b0195f6a53b6977f72f048e3027d5384e8e
SSDEEP 98304:deWCOPwSy8NH4Gf1cKSNjKWg1h3fkVK2scYzuU5VWB4nhvhtlFlJXh7Cj87DZl:4CwqdxfKZjpMzu8schflDJx7CQ7DZl
TLSH
T149563393A4C324234A0BFC2B8DFE18B4776265445D6B06BE54BDC0A816F7727B12A19F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Connected.08C1B49DF9626B377BD5\payload.vsix
Size 2.9MB
SHA256 c2d22e72cf3bc1ec8a773bc1dcb307baa59ec6adf95f11194e66a33d249267e0
MD5 8fed9c539ab0e45ff9114b788cdf9a33
SHA1 da5748b493f71747085262ba6d65ac2a2ac65b73
SHA512 fd193220995158d97f2b3a26923ea9c83d25f6af1d192e0cc243ac9d2e0cc03ee2c84f4bc6c1b387ccb12c809ad3daa341ba068654e92f4fb546e52db1db0cba
SSDEEP 49152:vQCTnRiwP4wzbsaQzyfO28/PIQ1CJwJLEYHOT47RiFSku3gR44DlURm02rj1MmnL:4onRdgwXQG22yi6EPu3wBDWRm1rjvdeg
TLSH
T1BDD5331D4DA575C1909CA53DCE2B0AB7022EE4C98E3BDC6734D0279196BA1B3CF679C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Connected.Auto.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Connected.Auto.E2C1155143C9A8B99CDF\Microsoft.VisualStudio.Connected.Auto.vsix
Size 1.3MB
SHA256 bc82dde524db5e795a0abc0d3a021cfc94be09035769f41d2f7e6dd314b52286
MD5 7a4b954e90b668363682d030b46287ef
SHA1 a391e983de1b530d8c87f1d254dc029b30d01792
SHA512 e3e261130e6f59b0352364918bdd47b206a93d83efa3ddcc34541e6dcaa0eee73f0a9e969f6d9d87928a6485a0777c27350aced5f35f39c2be1c1b9aa4c873e4
SSDEEP 24576:SKL8mBpJy/5vpfEkUVyYwiBYYYUqhlMP91Yx0jSZWQOEnnWgO3lMpCetZsoGbRP:3NpJy/5vlEZWXcPDuuyOEn5O3+PsoGbp
TLSH
T1855533836AAADC80D324D1692D95BC1C13A9541F8181EDB36D34F46E7C4B18E495AFCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Connected.Resources.686EA4D72944632E7331\payload.vsix
Size 9KB
SHA256 e146d9bcd20a715d88d8357930ac0c1aa35e4b2ae215b3e60a1d236fed48bd7f
MD5 a99287f341f7330391f41a934d901a4f
SHA1 783bc519729242485edfae7c396ef9e478ebe21b
SHA512 5cd86db5b4992482b286e9cbbf13444052272bc37106a0484ce4b21d487524ebe14342215efbf8dc2eaab4f20341559a0ec08d4d4209fcaf50501e098f91a227
SSDEEP 192:0aGLEnE0oUmrM5ifu1d7Bxyt1Ir5LY96wZbiUfG5pPke28cu+OiHc:uUIMPzYIr50s2nKgvuM8
TLSH
T10E12BF2ADA0C1A43EC027FB8168BC904EC6FA2245EC5B89637F335A66D41C615F070AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Copilot.Contracts.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Copilot.Contracts.22167D7842F55815841E\Microsoft.VisualStudio.Copilot.Contracts.vsix
Size 2.6MB
SHA256 1f203ce12eb4f739ba5eddb46b98c343a1cc30b4306084ab0d6b691423efd1d8
MD5 8e9afb2b2e5c3f618f4e7853668c3ca7
SHA1 bf3862194c9fb62d912fbeafd1ee41a6313b4228
SHA512 1802bb2f1a7600f67a864efa816829b0506737073b036e214b69f1d7c23ec9b5c2cda1cf42734d8c4f19d789ffec26fb1b2c5ac3609bb2c0de0b9e60292e28cb
SSDEEP 49152:PwF4hnwVfwnPuPnKwp0pOm20+mSXxxxlDeTXpEnqjVywSOL7+:QMnwVbnpuWmSBNeLynWrDy
TLSH
T17CC533CFB4AFC9AEE2061836939E296B017F0793BC50D976B5C99B1F4D867050B3089D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.CoreDotNet.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.CoreDotNet.95322DDF79C8A1F32FA3\Microsoft.VisualStudio.CoreDotNet.vsix
Size 3.7MB
SHA256 75ff282c2fd4da3a0ae3dca66dde028ca6b557ee54f135acee7ddff119e52c81
MD5 1ce6454ad9a8ef57fd8e061cd6d6a71c
SHA1 795a5073ac2ec012d435947bf595f242dac460cc
SHA512 d3b843cc36474dc04fd8f2d196c953783e4ff0633a2879be16bb171adbf1bf35e366582d71fcf7bfec4fa1416c468f90c5e613e1410ecab466d79252e0e69b01
SSDEEP 98304:iRzzQRqDBf7gqaoSQj0tbCsEd5yyvjR/4oQ:ksRq1gxI2bCXb3rR1Q
TLSH
T1620633EBC01CCFAED933D0399B543943D75891810597A843E0902ACE66DE797BF7A4A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.CoreEditor.B37FA9AF6240FA0A8295\payload.vsix
Size 1.3MB
SHA256 f39ab6cd4500134abe499b48bfdd070c8d14f1f20ab9af4703e2ab09af9a5fb3
MD5 b38550ae8c63e37ed52d01226c3bbb45
SHA1 8f91d007a321d729d1885e4962898b0276f257e9
SHA512 6f1f5eb1678b0bd8af0e30ec3d3feb3713a0cc572bce55c18d0721b70138ba298ff9ae58933df4dea9f14bd392b92202b0fc1aee9962ac2a2dc45b8fac9a8419
SSDEEP 24576:Khh/5uQ/8NLOMBRNjqx478M4smISR0VSmykbXDNAid/iAbmKSDBrTijxXR:ohIQ/YKMBHE68M4smISMSmykbXZAiZlp
TLSH
T1A5653318C3F145AAC555FB3F5326791E83E7F30E682AE89D3754331698EF904A740AAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserProfiles.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.CoreEditor.UserProfiles.A5B621114266735DC40F\UserProfiles.vsix
Size 231KB
SHA256 bf84450a34ea6f47d8544983cae3105beec107bb505051e0eb3eea71e0012c7f
MD5 f2c93aaa7d681ff13c98e50e92117a86
SHA1 c1f7f8b929532f8434c3e62a415f8ae20e2b4df6
SHA512 004926da757ab6dbeb5464b69ec461f451a5576973da37d0a4412a5ba677565c8dd59c528aded2923540eaa80e3354674c21dcb1d3a1520b4f306d64174f3434
SSDEEP 6144:vylxbdVN+M6NY6kNafffGOblgIYefKtsgAB6ITjdB:v4bH362NcffGObPYmUAT5B
TLSH
T1AB3423B4A8147F2DD1E2E878C44D7613B6221A36817B7CD0FBA63316121B97C237BD99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.DIA.781E0FBE01654A6AD794\payload.vsix
Size 1.1MB
SHA256 fcb2ec8cd470cfc0a45f3d5ba0daa2bd3c6daffba38a0188d8f480d1de8c27cc
MD5 5ae5755df3820fed0eadb711b6188663
SHA1 32f0e9091f871e6992d35a63a86670fe1ca503e1
SHA512 f57a00e1af8d34b2e9f6303b6c2c6327c20c7758d85e090b09b003749443a2dd7c09789b185066544b812c83864c6466b77eaefaacf3f44ba35f490fc711214b
SSDEEP 24576:WaXMD3vYcw3WyG/TlLfY38HQPYGZh6VPIdME1ieCQI5mvHcH68OwA:WwI3vYWLfC4tGZUVPIdMy5JQWhwA
TLSH
T1E345337D81DC09E8C86C5A3C8646785D8C0F07E56255B673FA2C69F84DE32A9EE81D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.AzureAttach.D97CC1A80C500A503932\payload.vsix
Size 58KB
SHA256 526b4a2454b2001918ec76291d36921927842b85040df35ae7c0fed5182c820d
MD5 3eb3651f01d3fb0a70900d490b0c99bb
SHA1 030d8cc122dde2ecd41cea2cf404635f0f5c1eaa
SHA512 29964897f648ec1f1ad1edb19852f294b8e023a761ac4ddc300b164d3fd1fcce4de0c2c689b99deac9d0eee607b03e4585987d8009b2399e7a3ba1a04a0b3efe
SSDEEP 1536:K/sNkF3GEPZjCNBYnK/4Nin7ZNOeMCJoDLXh0UYNMPZDh:exF3TZOLENm/SLXh0UZRDh
TLSH
T16D430105A1A6A347C9A2343FEC6BBD103C2EE27666F166D21FC0266C434DDD086999F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Debugger.BrokeredServices.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.BrokeredServices.AE92BD8468B276C71574\Microsoft.VisualStudio.Debugger.BrokeredServices.vsix
Size 176KB
SHA256 328c5a2a3f2be6f082400a9dfcd18b7ac82a624347764587ec2abf2b6bc5458e
MD5 3eb2af585d68a6f6be34a1e609fa96d5
SHA1 fecded6b725522a55f517b22c85bb2cd8e2e591a
SHA512 88b35f2da4f245d67501539e769ec3962bda1d203497e4d45a1ecd2ba79d8676028fed9de2f26425578e9bc33257856dd903ca14060b3c76a4002c10ab21acf2
SSDEEP 3072:QVhoz/1MjxDedG7r8T0oar2abjUQUlf1e9WVJEYf3v4TNQwpze12WztNFgcxurRt:+Q/1MVBQ4/2afMlNWWQrQwpTCycxuz
TLSH
T19804121ED187AAB3C36C613E5083A4457628C523947367EE258363092E29DD6EF0EDDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.CollectionAgents.F8CD037C13A20F209BEA\payload.vsix
Size 112KB
SHA256 f87954cc7416f3232398af7c7befc886947c6ef35cd22a536476521339f543f5
MD5 b4584cb314ef0d23cc49a1fd1eade379
SHA1 8c28490a2a339812a2fb57a342b6238583020f9e
SHA512 a188bafb7c1993f716d0e5c05a9756de4f5259ae1b3b066969d6f3017c1d7ac2c05accc37ac9f47cc44c060b8c436c91fcd82982324c093543dab6f3472f6b6e
SSDEEP 3072:M9j/V44diem3XXceVM7L7auobUElRm8spb5mQe0fy0b:M9j/2eAHceO7L7aVQnyu
TLSH
T1C9B31226F69B65FCC0B51D3975B24C42C7DC8AA8406B16110FD8824AEC95F43E3EE67D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Concord.404C6BCBC1DD7175EE10\payload.vsix
Size 4.6MB
SHA256 911fa623d2229e5d6c0b105144d4e3c6a2e3baad1880e1edaa0b00b7d660af9f
MD5 c0cce0ef743420b998656a375d91d7c1
SHA1 9cfaaee7db53b60eafe6ff3c574445c20bd8a377
SHA512 c34386a26d8e6f03d37a6b9ec0de1fd67808b691b8fa6df94c5e9fb48eafcea51c2f6f09b5fbcbbc08908f66e8a17f97d8d973ea571bb6d7a8611dff629b2ce5
SSDEEP 98304:cBYmg4ftXzaJ9g8fA2vd3cB86JZgoJsUbhxRcEslj/FRhwmkZuMW:cvRXza06otfgoGUb2EsljDb3MW
TLSH
T1942633967AF59522DD342BBA7149F8E7FA387F531C5085DEAF002E5C54ECB80623708A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Concord.Managed.624A60F0340CB31F5766\payload.vsix
Size 848KB
SHA256 baf2367d8bace6a516176db9964dc3d8aa7826704fce470ead8354c95a5aee32
MD5 efb797aa2d1fcbb02637894309d38b2e
SHA1 2563576deebf0521895066845c78304c2a3ccf8c
SHA512 ef93ccd8b7d9e0e1fc61502832391135a4af33c3b7e17319b1f21caec0280878221f8795561c11fab9a34083277b08db1e838ac3c602d843659ac64f2bc94ad4
SSDEEP 24576:KUrUl3dMoXHVkhmzg/62xac7sDtm4RYrUZJyEi8nHXcz:hqdMgKhmzw6esx9RYoZJueXcz
TLSH
T1D6052387E78682C9C02D7C76C8A618D71BEE9947137CE15C2AC44262B93C5E3619FC7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Concord.Managed.Resources.CD52A9A94508CD561B79\payload.vsix
Size 9KB
SHA256 4ae3c7687b84f612e0aa386f17947f8489162c2067482ece0516860afb0e30b1
MD5 e67d0a0691dd1935eb3af1fcdfcf2bae
SHA1 4edd17993c9dc3cc1ae451415de23be254024a63
SHA512 198568c1b9901d6094b1f131b12f14639be0fc44dd4741880b0d7dcae19748f66ecac93e39d9f4ca3cdac8cafbdafef2f384a16178407d6145176d42d849a550
SSDEEP 192:R8qCnb2IAWPpijo4rxx09VNo0KjKiTo3hy4b7TNu+OOW:xwb2IRPpic4r05/Z17pu1
TLSH
T1A7129F445A7CC67FE10285BCAC7A01C55505C15BB0C65C97BC98F9E8CA41CC987B76F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Concord.Remote.133056DEEF340A28033C\payload.vsix
Size 3.7MB
SHA256 afb4fb8c13a5722cfc3f49fdad336ca886244a7687bf08a08d1a121e0c253f3b
MD5 05048bfb41b7d82203a9c9751ea8c484
SHA1 9cf4b9be4daf84ee15509e764cd9b3eaa785072c
SHA512 85f1adc739585c6e0aee1015100752cfb2c7ab354e7aeac366cc2da08be527e54dd22edf09c4c5a4511f63841b633b99966d946202fd118a1deda4b27429fae7
SSDEEP 98304:DqSgK3AmBgYyhRYYlXLPKQOnDaOwihsmlF0S2w4xmxRcFqH5D8MaJ0mITic:PARnRTFNEnQrFq1+hC
TLSH
T17D063350AB140896C92C9C36C6D9FD858EA6970686BCFF9451FA53D0073FBA390ED93C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Concord.Remote.E78BADEC49C64BFD34F3\payload.vsix
Size 4.2MB
SHA256 e4d237c908b1d41e80f91efe56e67ae68039790e0615cfa988c3d5e88502987d
MD5 639c2cdd9d2629aaae746aaf80ce9715
SHA1 766c7f51642a8c1ce4b94151ce1b63d625ab48d6
SHA512 efd0b8ac37dffeadf1eb6b5cf01e4eb0faf642e9ceb44473df429955c647743af8051a25a28684733b0e93339f27a92e75311cfff422ca464a1dfc228c720863
SSDEEP 98304:CAmBgYyqT5y/UfpfsrpGRYYlXARdKnQOzdKIwqsncj8vsxRcYKqSgKd:CARkT5+UfIGRTCfOUqsncj8vpY8
TLSH
T1E51633C283A360CAD03A6436E5E4F4D68EF9A75814B6E7E819C6A7210E0D7D7558CF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Concord.Remote.Resources.5BD0718287BF48E0C223\payload.vsix
Size 35KB
SHA256 23423e3165ac0d2e160d02c917dcf1d7eef80cf8d8a6280292b58f2879911d17
MD5 5858e547040e8d71443d9e492a4bab9a
SHA1 d37dbcc6dabdc3d991721d66765b80baef0723d9
SHA512 f7fab55185291139fbf4a4fa813f629b24cdf9f0e672f01026210754a22f258c0761cc482f231f264d0cb3e071bfac2c4b6fb754228718afdaacb66882ecc508
SSDEEP 768:kpwL3P5xytlq6deVDTiMiIWBdZR48zFiq/Se4GYdAj3:kpwFe1eVDTNwzzFd/vAdAb
TLSH
T1D8F2F138779E2521C2F1FD78339007F6B988EEE236556CD6B6948D5A08C148A8371A4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Concord.Remote.Resources.FAE8D58492DE5F3BA69E\payload.vsix
Size 35KB
SHA256 21deaa9d5892da721d6be77267cbbfd5abdc267034d8481ddcf37416f0e9e35c
MD5 193ff4c6c7a8d5f8b2ab3dd408e6ce3c
SHA1 a6534de4c160a72649a17012b6cccfaa69777b03
SHA512 c4f848c6210373f209a3362def1ab04c0baa05cc2c2c8e6498023a0adcb91465e808ebb8c8815077b987b39fba044c0cdbc1eaacb981cf2a077e5ab8461e07b2
SSDEEP 768:L1fLV5kun/7tDxtvsairSLs5kk86du3R32A6rQ9AKX3AHa9XngxxSTFgLRkblE9z:LZku/2am5kk86dqN2vrdKX32KDBkA8yu
TLSH
T17CF2E060D7AC2111C41FB63D51DB5A4A25C64F276290FC8825BC6F4B094EE0B971FBFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Concord.Resources.A7B3E4C603D5CD952652\payload.vsix
Size 44KB
SHA256 069855da1bb00eb49a5989fa72d36cf03049d3959c8117effcd53249a5808de7
MD5 d6122347cdb88c12f437bac82c687b7a
SHA1 18faebfd40c927e4c81936605f6174ad19ea98c5
SHA512 5d0132f98a38d6323bc937bde3bac5ceab6389301d87a04e5e2e8248440d1f84b6907375f0b6f68eea63898e699079c2ee86e8195f7184de5be2cc4aeab01f38
SSDEEP 768:9/BKR5two1fLV5kun/7tDxtvsairSLs5kk86du3R32A6rQ9AKX3AHr52KdNHuSrQ:bKXtwoZku/2am5kk86dqN2vrdKX32rhY
TLSH
T1EA23F120D76C9127C90F697EA0D61E072200876369D4F45466ECAEDF4685B0A472BEBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.D5232D0B2208A8280F2E\payload.vsix
Size 6.9MB
SHA256 d7f96c8948f3a1ee3d2e43216d3e2fd0c78420e85572ebc86b84529a2b4b784d
MD5 a607c3856aa0e42b09b3cd4ee9b70170
SHA1 819f8e8b9ba42c98806d32ac380f3094f1c99d5c
SHA512 6a267175b740b3ee99ffce16f09fe3963d8923b70c996b4b26f4ec458279787f1df63f77e4093eab11dd3b904cb2f4f3fb3faf757721108c1547880f80f1a2f4
SSDEEP 196608:MToFPgjxciSHFFGd4J1S+4C5sDtrGofgBS+4C5sQ:MU5gjxFiFFJ1XyDVloBXyQ
TLSH
T19E763315D9EFDC36C1369D5F23A42C01DF6AAD9B72DA4F9B01C825E32BC569F2860D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Managed.A57E5195DB9A7DC5BEF6\payload.vsix
Size 3.7MB
SHA256 b55f18379b31863585df68573f1ce1b796ff48156cd838ce89665aca3ee5e070
MD5 4348cd077974841a45d72b46ede3a999
SHA1 be4de972d57e361cc73b491835b6fb1c07ba6712
SHA512 2cb4a37560094e88168c2011029599dbc486f42afa6f6ffb8335f4a2d30478f43e1e4ba15572abecc94e6f336ce4406c328f76f505479007c224ebdbe4846fe5
SSDEEP 98304:Or02bylZGC1cohtnQKajb72D4ndM5Q/3PQNBPB30:Or9mDGC+mtn7a6SM5QQp30
TLSH
T1FF0633FD4F9765E9C40C2831E7B02D67BE639BE4A41AF56DF1722F2208873316E5A106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Managed.Resources.146C4AE38EE460B9C2C0\payload.vsix
Size 52KB
SHA256 e08dda98f4264618b68e81019f1cf1c370891d4f83f7a316e4e74e78ca2be295
MD5 1fc9204852a36717f473a3d4477feeab
SHA1 d6fb49ea42fce921f0528708eac99469bb979738
SHA512 b4b487aa37b072a554b77555cd3bee5e1001bd5a99a8b4871963285184a4960bb9a25d3a4c7b81604e2a74e6763c8f0b1076393922f79bbf50e2b9154f4e0316
SSDEEP 1536:JBX3m+VaoR8rh760L+sVbHLNsm0E9BPlgRRVkPG+O/Qp5KsXXYutrRixmVj:zkoR8rT1brUOBPlgRRq2mK+x
TLSH
T14C33F19A85630E10DE420C3D0C5DBB835F9CA0D512CAB1AF65C0F65DEE81B5D2B278EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Package.DiagHub.Client.019B7FFC94DC71E0385D\payload.vsix
Size 33KB
SHA256 d624c0673f720fbcdfcdca93a1810d2d8d6f33ad020e629a72d3c60f7e22e3f9
MD5 ad8699a1c6e34cc7d33498cb54935b38
SHA1 0e6cdee14ca66aeae6ab6d2daef1c48e4a5bce3a
SHA512 a579a2335580119870354240ca059348e207ef98ea6ea95a254504277d0dc032e523c126baac1191c1ea527c640f8ff3ca4c4a0d5641c39409db5b5572db2034
SSDEEP 768:ik0nXVoFUHTEBM4B/9Msnk9lplWLRhMsdaj7ojf/WenpSJiW55Dcf:hM66L4B/9MCk1QUS+enpOFCf
TLSH
T12AF2E115874C16BACAFE397D925B8C2B602AC5981B85414B53F903BA07FC3639B271DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Parallel.15D4357738F6D344F9F6\payload.vsix
Size 517KB
SHA256 e2fbc3bb0484e9912b4ac1ccdf6d1dbcfbde655a23fdddbe7c6911e68e49a8d3
MD5 029a58101edc4dcef84074d6ab19a4a7
SHA1 f30fa98867e09e9775fef4e64f31728c4c8e263a
SHA512 1b6f0c76f9d9cc2469c2724b9137087d5c7ffa533ed2ec574c5d593f2b07aff38f80cb3e4fd63704ba4d24d2024750db9465ba1a0e86104ba6f77b861061b1fa
SSDEEP 12288:qBwaETyO26lLdATWYtfnLpZtCk6Yz0WMO2otmDmA0/Fcr13Gs:pTbqXtDR6CL24mD8t+19
TLSH
T19BB423B801FEBF81CC075EB080EA80656AC1D15C62259AB3E178719896EDF706D5BDF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Parallel.Resources.7F407EFBD7B9902DA7E8\payload.vsix
Size 9KB
SHA256 876b2b21ce4cb07ab8d85aa62a041c7df0ac1ebed880f5cce6b3d67f9afb8ca6
MD5 cd6cc076482c3c89c88ea3690cad30af
SHA1 96efff7166a6e632251848970bd62dd6f1ef4ab0
SHA512 14c1ed079d538272ce815c7c35924f22b45fadd982de5191a28c2f497689381e98e7bd8812b8562e6f6015310cb58e6d8f49478e9d0383d74be5635ade17a58f
SSDEEP 192:5yMXB7bUOlNocT9iPdQ8GkJQWfyjBW2qKadRD2dXgOtu+ODrS:B9bxoFKFk+WqjYrqCOtuBO
TLSH
T19912AF18BB476AB1D3435E7A1C51C5279A1EF5962CE07A4354B8FF7208C9DB1131282D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.PublicDebuggerVisualizers.D973021337DFC309FF0A\payload.vsix
Size 79KB
SHA256 ba3c4120cf18f7c0afe25b2284933d5f4e43d27fac3e52631e0ac3948fd2d633
MD5 e7b58f25f869d68b79afa86b8ff4c648
SHA1 b2591da56c5bb2f9e9e1e035ffda8759e308f993
SHA512 e91abbef2dc36597149357d5eac062dd2d3ccbc35715363c032df3dac6124b6a18027d448d12f491797d78e2cc9613ee3a9fa7773ccda26782f1eefbf8efbf73
SSDEEP 1536:+u28wuHcERZrlCkE6h2R3mhu03s2J+xELT5pPJySrm12:+u28wucOZrYflR2oAde0Q2
TLSH
T1B6830234EEB6423ED2CA64317F41251F66856FC3C473E6D865382E8D414A235964B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Remote.071D68FCB745382A73A5\payload.vsix
Size 5.4MB
SHA256 c211b842af0245c7375d161cd2f4cfe163d6ba849afc49eaba6ec96495be89b2
MD5 c91e27333a35bfd686b4b097fb714474
SHA1 af9ab2e7827f5ef4cab43b66d76bc90766cfe849
SHA512 3b7737bbbc68a6f9502e36e7464102ad1794677318eecc0687857d914be5fd4647ba65b5760469490247346daebff63f25420886935a5dc2b25279d53202e264
SSDEEP 98304:QXQp2pUJ4zzZzSUNqdKOHgMe5TBs6tylwGCgba8j6uNNOS8Smykjw4dLlU+PIh5h:QXM2pu4zzdSqqIjMeTBs6sqGCj8j6c8M
TLSH
T17F4633AC93E549D5C81C623E63712F49CAC706DC740EADBFB97CA96748C70195F2491C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Remote.B1A71BE65818580F292C\payload.vsix
Size 5.3MB
SHA256 eb17fe76b68065f91e24f6b3b9763cf8d43a6aee0c94c77dd911264e2f7cc125
MD5 c3b05ce8ffe57815e0b6ac8308108035
SHA1 8a73312f6bc09fe377f692a4801cbbf47e743ab4
SHA512 d2b7781d921786091878a5032c30552da52ae528daf9ffad05dbc3bfe6543865a8b67f123510b2156f400928aefc27cc159d37434995182b89f0d00968bf3e52
SSDEEP 98304:AhMhWHqHiqjlFiSW9FuWTN/HCPIjqniY6Eim/b32hzzNBsvzqSRdvL6e5H:xWHqvFK9F1vdjoiY6E9owWPe5H
TLSH
T189463305FE616DC4F4FD9FBCE3DA2492C2A3262A93225CECD1E6268E5D5F3800E79511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Remote.DiagnosticsHub.Client.92BBBBF2B8A32456D435\payload.vsix
Size 33KB
SHA256 6e4c02fdcfedd491543b6e647319a4f266c1a1c1b6a957caa511a1e562cfd48f
MD5 ffea3d25bebc899be79d42d3193d6318
SHA1 516db6c1932effaf4b301d1365bec07a80c26390
SHA512 72e34240a26a527ec729aeb3e610d87e8c064f7be9d3e8f084581f5c59ee9ef7efccd8bd3fb502e01b18fb019326ee5930141a9ad55a2355da532e328eb3bc1b
SSDEEP 768:fbk0nXVoFUHTEBM4B/9Msnk9lplWLRhMsdaj77J7pw47l:IM66L4B/9MCk1QU/J7pf
TLSH
T10AF2E039464D26A2EAB578B9D22F4836652844CC4AC957CB02FE4B6D46B83331B174FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Remote.DiagnosticsHub.Client.D71778D5E68092548B6E\payload.vsix
Size 32KB
SHA256 4439f2b8c55f06fe31e0e622107fc25346955cc4dc3429ee26b66b89a1e476b6
MD5 eebfba5e3a163dc53a5c1176b913c338
SHA1 88559df7ac4f9672ea9d3b6b7a0f84aef8148c3c
SHA512 5a9758cf717045889e58edaef0dbc398944dd031dd36d307bbb733967c99c42723f99e64e74d9b395b34169c84a5dd815d303e3cc5814c7d706d9c614045de53
SSDEEP 768:N7vngawqsI5HhVCFnsYi0wHYu10bdeTVPD7QN3AmufcAR:tvuSBwFnJqdWEx4NwUG
TLSH
T113E2E130CB561CC0C89B7B7CB814B4D6A835D28072892763BD672B4F388CA47171697F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Remote.Resources.22EA5F85F73F51F07004\payload.vsix
Size 76KB
SHA256 c355598c1b06eaa4e97a1936eadfadbc5d543b740bf944f00375647f09736821
MD5 41028d9af64b9523869916ac1a6e3959
SHA1 8f6dafd34eebd360ef7ce99b7196f53eedac381c
SHA512 4cbca90e333af52af0d8dc08226329fec0f1932d6b875c0ba63aedd84304250112ab6143877ba3c5b36ad8d4caf091439a38c134e6b0df95f6aed71e96731c10
SSDEEP 1536:J/TyF1ErmMmXMUXyohbKtahgIa9/7YBOXJNK+OkMgQDPL1X+tNwnmdpyszKpdxP6:I1Er+MUZ4ahgIaNYM5k+hjQ9OVRRh
TLSH
T1E97302FADF361494EC12E3F3608414E1E2AE279C55E2EB38A0D91058D4CDA1EBF5B5C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Remote.Resources.F26620055AF591E7E2AB\payload.vsix
Size 77KB
SHA256 6cc1ba2254920cccb5112ef4b40537ec543bd18a936d47832eee2a0ffa21fbdd
MD5 704df94ddb52ef721b6b825bbd5914f9
SHA1 4aca857fcd7fe16ade2a65772a4fd367675611ba
SHA512 2e21438ba5d1d5715e8c1a1e2dd5f9a5eeca0bb7c23cc71c99c5d8efe0baca6c63150be6374c2fb44c3be6ed2e398c23d39f8bf8efc45a29a64bff6d1c6a4c92
SSDEEP 1536:+64B6Wy2bUkTO4Kq8ioTLQps8ucLmtHezb2LxrWAdzPrj63qqguQDPL1X+tNTl:+64bHd3Kq8iVEHeW8AZu3+uQ9O1
TLSH
T12B7301BCF97C9425E591AA3721F960F91192B60E04E029E970CCFC8C1CDE9235F976E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.Resources.7B6B43C824F661011C13\payload.vsix
Size 172KB
SHA256 db6eb0fb17819c27430d614b43d1eb954e10535369cd4e53c54f89583e4172d9
MD5 5f9ba30bd90b536340b3294bfd9d6ced
SHA1 0584fe690b7b34ae595a234695b8e46f61cdbdb2
SHA512 6095753541080c944a4cb3161cc37870d082190aa6267566fdb55d5e931c3fdbe5e4d6f0790f94465539bbba9546f047b32b6c624672077ae8c5cd1b3b8ff6d2
SSDEEP 3072:NGfOjtHkEq44sNinMmEorIC7MEYc96NNNwSR3BNOQ/zCmLagxnXK1xMIu4/LTqZP:Nuytr1o0C7M7c96NNNp3Xey3x6WIu+Lu
TLSH
T1540412D621A5CCD5FC341D380185244913563EBBBA91BCF57A8C644C8EEE9A12DBFE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.TargetComposition.9A931B38B17540DAF16C\payload.vsix
Size 1.1MB
SHA256 4cd7db7e8b0739d9e23b663ff475b72327fbb0181d82933eba6e958ea058983d
MD5 ea289d3519887bf94bbc1f23208b5e2c
SHA1 c4e74f435a2c7eac6c5e7cc50ecebcb36b6e76fb
SHA512 30cf7bfaea12f79c0a5edbc5df43fc8e7f66963f6136440f20445a1f76cba8267213c276fa57aba460c44b26fd496cfafeb410ac2d78ed8cb842c877cbc77049
SSDEEP 24576:04TSJLlJMSnLahegzf8EaDyHTr/+Fg7viYF/bYcHW35QElvkU:1ELoSn0vf8EaDiTj+8l/l23nlsU
TLSH
T1404533C2DAF72857FECA978ADC32AE34013E934E6448B110A45F26F161FAF12E54DE45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.TargetComposition.Remote.1B5542F654A028F9903F\payload.vsix
Size 1.1MB
SHA256 a27be9805e753362e329e9058629420422b42545569464ef463888a15764d46c
MD5 2ec3c35bfd2d6c14c62369de0bbdc5cc
SHA1 0e3d87014cd750c99eb76352786499c56a4aaf10
SHA512 714ac9b74f008d53a9457101f47f5fbc3a82ceb4a90a5e24cdc0302e4e411a71e95144f77f154c77c1657cdbe717e6afd6706dd3f255cdd1ab96faffb27ecd9d
SSDEEP 24576:Bahegzf8EaDyHTr/+Fg7viYF/bYc1W35QElvkn4TSJLlJMSn/:mvf8EaDiTj+8l/lA3nlsGELoSn/
TLSH
T1804533C2DAF7286BFECE538ADC22AD34016F534E2548B100A54F36F162EAE16E54DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.TargetComposition.Remote.8607FB87749F8240740E\payload.vsix
Size 987KB
SHA256 44e98893fc5c94b45a21bcf421947c512e62c6525b6563ba98da72d8fa7f37ae
MD5 e263873a289c8840f07028200a24ffaa
SHA1 1e89d5a4bbf8a4bc8cc6b5cada80ca16d26422c5
SHA512 c8c953295d2aaccc8438361154f8f92de49be20e5516bb35bb267ff49c4cbe12625efb75552d550221072441bf70b4f87a8aae9fae25476b523a4b865335eeb4
SSDEEP 24576:lWZ6XF5kLvj4TpK84eaC7bsFWcJ98hHjSpcTU:nXFYEI85L7bsFWcJU2f
TLSH
T1C525330DA27813D9E78D1070F7A6BEF608DFE323C457AE80791C625CA6D9426F90D539
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Debugger.VSCodeDebuggerHost.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.VSCodeDebuggerHost.703BABCF9E7F75035129\Microsoft.VisualStudio.Debugger.VSCodeDebuggerHost.vsix
Size 1.2MB
SHA256 4d6aa77085223824d98d814b56f90373632364ec93f829024eb5a5b0ef139858
MD5 34fe627506debaf295958848043bf80e
SHA1 e58d2684d5cc05743cf698e21f9083292b6a68e2
SHA512 7c20fc4da2b16311c846ab1dc8d7e47fb7bd1e16fa23a9362e0ce92fa8b7ad2bea2de331bc07c000602c69219a0ba4140e864d0013f09e7807643b91882f2f70
SSDEEP 24576:1ybROCbyQ7w4otvqO1v7Ev6Eqr/uJqWcfRoeOcZA17kHocgbw9RSv8NNLU6Vgpn:0jbi4Wvpx7EilbSqXfRwcZAtkIcgbqNK
TLSH
T19645331BE454765BC12E943FC644D64E8AB27B85CB3AFB084904478AC8CBEA131D5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.VsDbgExe.Concord.58EB7551BB3938AFAD7F\payload.vsix
Size 3.2MB
SHA256 96bb06c3855bd069b693c2f144a2ce725a032fb55b5dbf6c64430ed366bb4c6f
MD5 ea4c81bbc56d91152c3290213eeb0f8f
SHA1 87246f7d8fcd6270fa464404ddd7f0bee8ca03a1
SHA512 17f9b352b7a758931878f0c0dbbefb783e26772a3dfbf4cb058b64dc9bc30ed6f475eed36a5ea9b12aa468329147e6fe80fad5767bc9514f911db73ce7cd0da6
SSDEEP 98304:CB86JZgoJOsoef5Paslj/FRhwmkZKYmg4ftXzaJ9g8l:CtfgoMsoexPasljDblRXza0M
TLSH
T14AF5336579E0A422ED34376E23E9FCDEF9583FE30DA045EAAD012D24589DED4B4360C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.VsDbgExe.Concord.Resources.C627CA1BCA25FE874807\payload.vsix
Size 54KB
SHA256 4677ade4d943b45646a8486d8f087b85815e7c092e00f7c1668cab3695b3dc5d
MD5 a4c4ae6f1e3db4a4b9a948398bbc085b
SHA1 c0d10eb395faa89a79885f53ea9790c1eb721273
SHA512 aa5e0aea65208661385ed1db9866935b06e5c1c835140921aa9bc7241980a99dd262abb117a667d6135bb5cf6e5472f58dd08cde2da1b05f7d211b8e3cdf5ad0
SSDEEP 1536:pZku/2am5kk86dqN2vrdKX32dyC/Q/YLb/07ruXVVg:3ku/2kkucDdkGdNQAk7uVW
TLSH
T1D4430218D7CC4061C80AA17A64CE9A5C31C18F67AB54A84483FCBF4F5ECB6065B673EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.VsDbgExe.VS.EA2E807EA42B30ECA3FE\payload.vsix
Size 3.3MB
SHA256 e3d18b000498cb673b27ad17caa2e1e90b9fb14738ab17795189162a98cc0c2f
MD5 3d45e5de4f5e1359922ac3a961b6251f
SHA1 323d7428f237150e4ea16f902c3d74c42ab414e0
SHA512 7262268aa09bfe6909619438016aa086315b9ab8898210ba50bd07b8ffd68894ccb38fabdbb518fdbf030150bb2f0313808eb6d331b0ae0810c78ab2c8166cc1
SSDEEP 98304:/Smyk9f95ew4dLlU+PIh5JN4ZRgiPqWYTBut31NF2ZzSUNqb:/SVMewOUAIh5JxToFNF2dSqqb
TLSH
T10FF533FC99E806E0C82C9A391351A159CA1F4EE620367EFFF5D86DAD0AD716F2D1481C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Debugger.VsDbgExe.VS.Resources.2E19339534374DD5D6B7\payload.vsix
Size 113KB
SHA256 dd63fea150819f4103e1111d62e448d6d217ae38546d5b05fb44ded14aa151e2
MD5 88aaebbf38ebb54f8c7dcc12ad096990
SHA1 d81d439f1edbe8092739ab73fa2a774e6e6edcd0
SHA512 80a4fb857edaf30a685ea337c6a64c9ea84943c7b4da98e6b4ff75ba968f23a0f2b1d429375eeda3dfdbd170e24ec0450a2883b13f42ba5319026abac847bdc0
SSDEEP 3072:qGx8WIUQvqPxHGKB77FuVQ14lmj1HpDwehSJ+:2UQvoHL7oQeA1pxwQ
TLSH
T1A6B312302E05BB77F740C5B02722D98BE661F25BA832B5DFA88B3C1B51325F85E025D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Devenv.1689A513CE7E2651FD6E\payload.vsix
Size 493KB
SHA256 ef95d1e11ff7f43b2151ffea5a4414e9b495b92da390b0d2179400d222a9ff4e
MD5 3c919bf01ffa20ae763375a4e2699141
SHA1 0b4b7c195c64f4cfd5c23aa1673637b9a792b977
SHA512 15303bc890159d7f17e89abb37414a34d13f6d0d0e8083dd16165ee2e6987307ffcf35e2abad8a82c870a4520d07b436aa860ae1e0b54fd739adf2de8e200ff0
SSDEEP 12288:KzUIT3Yk2nzaRCLY64ojcL++Mp+fTr7yZXCfrWX:zUqaR764ooL+PS/IXCfU
TLSH
T13BB42317E9825E55C0774737B2A6B04F011FB2E63950BF4888713ADDBAF2C1693A14FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Devenv.Config.14F7E7F4B44B854ECE94\payload.vsix
Size 10KB
SHA256 867af8cc139da42d504db1c85be775adc6fa7dd133dacf359ea7ddd9dffe3e31
MD5 eed6730fa30c0e5ab1de7d7a0ad22428
SHA1 f72db19389262ed3d2cfde458969442e1fe43ed7
SHA512 d984df9149e491d0e6ffa51272e1ffe51797d099471f159e78c5893875b3fc70a68bb783f6821d1bc07b7268f8ec64ade550cc5020b352a14642cf4df26374d2
SSDEEP 192:WkGFgIpjyqF1QbSMqlBqwEdK2p5I/DijEq3GixKJ8LXuUzT2PUPm1O6td:2uiWglBqwEdXIbA7jKJhm6UPmsW
TLSH
T111229E385F6A4369D9181A3A5209BE67F988C04970D1F46616FC5CB80408EFFEB970FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Devenv.Resources.4621CDFE2502BB3F42EF\payload.vsix
Size 82KB
SHA256 1657111467d4b41539d9d7c704593f1a7d5eec502439085fd42cfd42126f5152
MD5 2ba8065cf1627b56ed37212eed9de09c
SHA1 1c23c80e370b886155f7a11d6e112c1a32eeb759
SHA512 f6c4e0916934f9404a4d50c0aea386b2387a4e25e9f666f5633538878e47e1696f4f567e8fae215707164b9819d484cfb3d5e7aa65d2525f931ff3660b14db14
SSDEEP 1536:+oh5Ue1MXhJDD5yveJsE/764e1GAwNrHmgyc81PKyY88IeNLX5xqq3AEI:+U5sJDD5yiOhR6rGgyzPw8U5I
TLSH
T1E383026699A7EB91C14B0C792D2778874CEBA59610CE60815FECF8C6A01EC75335C5CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Diagnostics.AspNetHelper.E873986D0278B835A17A\payload.vsix
Size 9KB
SHA256 3b3e8e3612b17c8b6a7052d74346176344f6c94fa05f0f4449b64b9c4fd6054c
MD5 e158d646614740951cce5455965b02bb
SHA1 166ab14a2eedc94a8ff8f9e63fde23d29c9689e2
SHA512 80c4ae11a791cb4b0585d26b682d0970643935e92b603ffd9f5067a61f55bb9bf0d3bba349ee038c8cb26701ef48cadab369cbf7ab637943af206a77478af15f
SSDEEP 192:udVFAdMbjRKV688aC8TMjvp5yNPgTRVrBe7xudZ1LAu+OfWt:ulAERKY8ojBEPFYiuu
TLSH
T16D129F765F664B31C4829130892A9AEE0506C8C319F2974A9BC83AB8D6C4DDE37255FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Diagnostics.AspNetHelper.Standard.AC7E754ACB43231D5A09\payload.vsix
Size 58KB
SHA256 cc3e4044eb7c93763f267e3d743535c513a4da75aa324f64a166da3c4e630ea5
MD5 0e36e5aeb1ee23f1fa1fd42013588f1d
SHA1 c93f65e4f9fcaa8be93b0791578c25e2356cddff
SHA512 3a00df572187f0c8da293267413dda07f8ab18f17b30dbdfc6d1378aaeea3522fca8c2e3c4b0c325e0684cfc547ceb3f807036752b08fb82c29a9d00e039956f
SSDEEP 1536:szTDsmlz26CFS+DlNbQrGPGnmFLDLkSlptH:aT26sdlw0wSlpl
TLSH
T1D543025D115F9744E066E833FEB89E785D05C208D8B916BE3A00C68B4EDC39E09A98FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Dsl.Core.8600EEA749BAE0CB86EA\payload.vsix
Size 816KB
SHA256 97aa05ef5cee8726dc71e8d1a06ab5201f3ed5d65d9f546804b50b70c48a1207
MD5 3b0a42034f84f24f51a1ebacbfa248b4
SHA1 492775ff97a74ff2aa59b86e905fcc561e410e9e
SHA512 d954742ffd4a3ba5b277b097581bf08c96c7d8e30c6671289bfc40be6fe938dfbda96c22521a38568fdb8721862b30c5a3156f8dc00579a8cb8148f17415fa5d
SSDEEP 12288:sB8gquLFIkURCODvFazbUoJ8401FjJI1iQS49Md2ci9wT/y31owTh7aMIV8+MXOf:s3IdoODo4z4q5JyHceiy3+BiY
TLSH
T1C1052381B014F80AC358F5392345800DF7AC7F18E0E85E55ABE82EFB52BA71A6E55D6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Dsl.Core.Resources.B6E88BF4DAC63124296E\payload.vsix
Size 25KB
SHA256 2443fa9004ebfb33e29dd820aaf99bb0f955098d6f6f71bb0463f0fa40ecced7
MD5 796b54c3f32e978de176ae6a9fbc9348
SHA1 9443f576313d4eb3d56fbb7951d12416194b7eef
SHA512 6ea343b701dc4501b1a3a3db6679f9eced47b60117cad9c66d9166b1ba7e9994114f9d356f63774215646f90c1ce626b89709eebbf88440715374387baf378c2
SSDEEP 768:gYuT1fyjlUKqambb/d7r1g7yF/xDmw+dkACEhI:s1uRQxK7yF/5l+GA9I
TLSH
T164C2E11A4A208AE1C7C144BC15E3681FE57C8CDA8C77C60179C329955706F9A0E7DEBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Dsl.GraphObject.176F32D4FE47AB527649\payload.vsix
Size 208KB
SHA256 ef02b7799ca56696539e284df522d594996a5be0a50bf2ee370ab4602867ad0c
MD5 35730835e46e9f21a72cb0766828b274
SHA1 f42e39103eaa0ec2af77ad658a601c433d7581e2
SHA512 769d8d14af4ea5f7f9c29cf587e80d8a6f5413c5e4285442bb90dc85f2ba0bfcbfeab6960068a198375d0214d50162e05127022ca6994382c3adebddeaffc5df
SSDEEP 6144:d3N8izIwMvN5WIFHk2Mw14nU4L6j9JKX0oIp/QVO3ozr5o:Aiz9u4d+Jy0oIp/YJz6
TLSH
T101241378AC5C36ACE75382E6028EB513A8C790511092B15F8CB178F466DF5C1A3FD6EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VisualStudioEditorsSetup.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Editors.B25802127542C88D0F46\VisualStudioEditorsSetup.vsix
Size 2.7MB
SHA256 4f5788bb5c476b97ad189412de5144885259447a208c1d07dc8df49e62eb1185
MD5 a0fe961e95f5800151707f9d99c69436
SHA1 f92295542373a75e0875fb8be6833d1829617e26
SHA512 5f7b6dde1b95db27c72a0a0bc7ddff4f903a8e388253edd39f7a32feb06529cd0d8fe038a4fa0abdd7c36d728377fc892c0832e056852014ecd2393033c4f711
SSDEEP 49152:GXkLIDRBWWjCMbErOgkwOv0gIkzDvkV8eC0gUMw302R8eUvlkJlqTEAOVyLfAhbg:2btBWWCtr1kXcCzwV8eUS0GqTXdDUg
TLSH
T157D53313A63F505CC4245B3CFE2EEA012D67A9BB563FCB1088A6A4E170B3AF5951F4C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.ErrorList.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.ErrorList.3CB7B10D88379D695389\Microsoft.VisualStudio.ErrorList.vsix
Size 478KB
SHA256 112a078fc3d7c8cb5a22a8da797f8bfa4bd1577624c16386e9286973ca60f375
MD5 dc79176b8f7fc4a6bf0d9c343f43aa82
SHA1 c660dbc6cab8a57881859b103bb75f262c9149bc
SHA512 021152ace9eeeee58565079698cbc8cf15afc10ae1ac09e11f68778564d2dd2ae8af31fe757fa70e05b09e487e84857d4ffab9715ec3c56d9894c6241d3abafe
SSDEEP 12288:ZvwBjU3oPRPjoQtLlcIxccfkFVexMKGj8KysQOuol4r:wZjo8lcItfwTJHysX4r
TLSH
T14FA42368937F041AF21ACDFDA0434F5B069A119BB61367F14004F67A43BEB1B259EA87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.ExtensionManager.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.ExtensionManager.6361A8C3E2587E3C7410\Microsoft.VisualStudio.ExtensionManager.vsix
Size 2.2MB
SHA256 ecfdb8efb71176f3afb27923e525a944b2add160f6e46415576b8d5b3c00fadf
MD5 b17a3443bdd3ccb9a76bd1fca2e63056
SHA1 172fe4b33c0ee70657fa4e33d78b2416f65b406b
SHA512 9757bc62717b7bd03c979281953151c2a72a91bb25c2865e551640e72ffa5ca59be51fc2be8f6e3ba1a3d7ac6dc96790a0203d2e83bc9ea36675142ba33b518b
SSDEEP 49152:Ga64ZRWL1VitkLtj9iDzBOPNwBZINYehrgmqVTcPNwBPtjf:nZZRWLakJkO+ZaYUUvVI+tf
TLSH
T1F7B5331282AD1903FC9FDE389DB506AF7F532A41701AFD9C048E23ED8EAD94435B15DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.ExtensionManager.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.ExtensionManager.Targeted.17DE959D98B5E0162B04\Microsoft.VisualStudio.ExtensionManager.vsix
Size 30KB
SHA256 df9696da9b9bd93781422e2a63fbe1d73133b2aa15b5ca1fa4a6c8470d343ad0
MD5 3a4deda7c26ce51f23905e776fed52c3
SHA1 8264d792fec6903a90a4d8b0eb9b7ae5dc50df5d
SHA512 7c0c42ed9630e58d45d381b8bc1949a2f27444f96d9ce0d212a0b8ba500de13d94cd9f08e65694fb7f09a9fc42ef6ae7523f4b659db6c254b7dd5c43b7bb0c93
SSDEEP 768:pjJCK4zoBbZyIm+moQJSbWBCdqfRcb4QjE:pJCZUZtmbojuKmzJ
TLSH
T140E2E179837A6156C1940E7C27227D2E63CDC94936DA8E0246EA2F5F569C7230B4F0EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab1.cab

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.FileHandler.Msi.3BAE17CB528B3BD0A67C\cab1.cab
Size 1.3MB
SHA256 5dce5489725bfa46d5ce6fb9d614005ec505410e24392be586c966f8d97d6644
MD5 1c27deda2c8b49a9aef8dddd002f32fe
SHA1 20ce7913967eaad0c41aaca2b799e3056c62593d
SHA512 e6d31fb854b8ab0b6d1d7ae1605f99c83e2386e3d1292a40f05587fa2325a3c39a35a6cfd31b5051bd8c59192007484c826b954926569b6e9a9265eb02a67556
SSDEEP 24576:omUeEyZt/C3gGJnLxks8QwJ3Vxeapu3E1P8Y979cw2o/3zdX4g:omUeXT/jcWN3QBE1P8YRU6Gg
TLSH
T14955338EA5647671AC9F2EB5AC38F1045FED95C33720F5473AB2E87C5E1B227261026C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab1.cab

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.FileHandler.Msi.A7DC9408A00E36F86B74\cab1.cab
Size 512KB
SHA256 36b62afbc61af7bb38e3f90c158b6e300910e6ec0451e1088df4214ee4b357d6
MD5 2687c448a12ad976fe5b0b29f573b330
SHA1 0bd8aff93a9c2aff23af0de895e9ce24eb77d4a1
SHA512 16a468500b58c5ac65341d6d9045200b19ecc6030094c1eff86eb9c6e036a4acdde3c5541d5cd3f2f88491292adb111298b83aef7257f8f22f59721d371dab54
SSDEEP 6144:oAVyT0GTf6wSNF6jv869LwuMYtvqajoeQvoPgDpahaTvkyBkNv1eTxcSAyXHhwu0:/yThnb8orMYdqajoeEwFux4UhBs
TLSH
T109B42316280E0057DE0877BE1A68DB04A1338AABD7DE846DCED17147ACB652C46F35FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Finalizer.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Finalizer.E005284491724AFB49E8\Microsoft.VisualStudio.Finalizer.vsix
Size 607KB
SHA256 ac8d32844924a7fb8d8b359c03796efbdae628a95778ed419e886da5b9d8bf72
MD5 3823db6193650eb21df17ff132685ca4
SHA1 000f589e97b3200e33fc04d957125b5c787836cc
SHA512 6ea5e3607e9abc41a50803c7fc44dc47d7770b9f739ec5f7ba5dea8500ba34f53f009bcd5cd270f28228aa50adf941475d56cc32de9be25946c60d874f545401
SSDEEP 12288:5B+jMzevhjy2X+NvtfQNwS2Bxr03BaFAxTd7hKk6ihvEKwoMdB1Ex7wRaFfk:fKMydYvy2S2BxAROAntN5EKwo4LU7wRp
TLSH
T1DCD433A85D32D4D7ED7CE1F8485128408B019364334E7C9A49E23FF2E5EE78B6589B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab1.cab

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.GitHubProtocolHandler.Msi.36269944180BD9256E2F\cab1.cab
Size 1.3MB
SHA256 9228e7066c11633d091eb23ac1571a099c4677bdfccc05b3c10368fd94772316
MD5 2cf0f487f1fa35a6bc25be708d880881
SHA1 53e328157441f3613fc274c348fa2eb71bd72f3e
SHA512 1bfece5f1916114c460eda380cfa26d3cc6f0b941a539f1f50e207387e4fbf8b033de8a386407a4eaa745a17168d1a8919d9cd4e7b3a94cae9112ddd94c2e57e
SSDEEP 24576:ly52esjZVO+ha7XI+Fx9ikTy5diXSYVXisa6K0L+0C8g6gy3VlL+OmOA5O:85TsjZM+ha7/Fx9iCCYJisa6xhpkyFlp
TLSH
T1195533592C2C98E67A17F472416AEF02517D2730030859CD9987634BF3BFBA1CFBA41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.GraphModel.300E1C2C368C337FC800\payload.vsix
Size 249KB
SHA256 8729d6adf96ecc634d99e839f63f7ec7036be15fa731c21ea2d49a86f12abfbe
MD5 7ae623a8ce49a8ec621d46e2840c1c11
SHA1 37168286a648642405f696f8730189c0840be760
SHA512 91dc1c968bc1dad87cc4ad8e3bbb3c759ead9de34784c508284ac18f721ce6c13b53e40752e94121e87a55de66b60685720500c88d596ba965a7d6c6f37091cc
SSDEEP 6144:3skghf6Sq2KQNkBRp5rAsQ9tAAAkM/55H7vzqOf3H:Xm6Sq2Kak/P5Q2k45p7jfX
TLSH
T14544230EEF0C9FD1E66890330A68E522B114FFAFAE1C375245709ECDAC595F5A04D8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.GraphProvider.42810B83CF47A58D1E12\payload.vsix
Size 733KB
SHA256 1f6311017fbedf2191e1513eabcfd13709e70d8a32fde32a9cf63953d05a1ff8
MD5 359e64b8029539dca72bf898a36d0f0d
SHA1 4982aae7b5f33a003aef0540312b535668f4f885
SHA512 b31c5e850c6451bd473142754cedbb51acfee234177994a9f1c8751ee9e0dddf763859a79dad80fd7830887104ba96a0dcc81a37b9da3c063b21fb69e4154b5d
SSDEEP 12288:91cQbhWX08VLv7uDWkJXwPvj7YurV2+61GlkBg/X37Qs+17Cp143HJDNDThKOs4:gM8X08owPr7BQDykBgDQs+17Cpy3p1T9
TLSH
T183F42310B113B814EC4A38BAB1C99778D0DF5D9B67C5BC9848713B85A29C2D4CFBD68B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.GraphProvider.Auto.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.GraphProvider.Auto.950378FAD1F154C33B51\Microsoft.VisualStudio.GraphProvider.Auto.vsix
Size 180KB
SHA256 4578307b47962c3f0df99a9f3677949e25322571e95ff141c680f27560b42818
MD5 8e5f6e8e260185099068bb35ceb73a71
SHA1 ed2aeae72ce0fbb49f3e9f50b1b6847af55f9aad
SHA512 e5e193d6dd6e034b3636b66d678f267e87dc8e81768a0a3229388711d88d0a82d436a692b8284cc0beed85b25aea2fc52b51869efa15d478261dfb964484cbb9
SSDEEP 3072:5x1zF88lptsrQHRRLjQZMm4bGV2wMN0uZV02ZTxIEVngrTuDkTy50uxmP:5zi8lpmsHrLjQZ4bGV2D5XKTuUuxmP
TLSH
T123042376838F2A03C6874D77B145F443E43D8A63D8C7EAA06FC078684AFAA435711767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Identity.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Identity.FFB641DF2A095A288F47\Microsoft.VisualStudio.Identity.vsix
Size 2.2MB
SHA256 9bbb0083bab05522fa84a203f300cc38fae8e020db27fe4f1a017445c9dc1040
MD5 e89e727249dece6202415717757b0978
SHA1 8383ec57e0130182eac77d9e33b0833dd5fc0562
SHA512 83f45ee90374e56168d5df04fd2eed699cdebeb85d7b31e2b8f70ebcf6cb247afa4539adc4d88fd54cf152584cb6794a8c2f47195770fce7db783a03d02baa28
SSDEEP 49152:v2XUYPTkOy84J+2a/BgRXSuhfWo9iLPuKxRXSCohwzrEn:+XUrON4k6Sce6iCKPSCoaEn
TLSH
T1E2B53306990ACED3CC1E747D1C6AD3D4269262E57BB1F11CA5332A8A61357DF836E8C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.IdentityDependencies.DDE162E1283268B11282\payload.vsix
Size 3.8MB
SHA256 5c627c1c8a89fe4e0ef43bf20afbd8278cb053248f6122322ed2693299fa0fd8
MD5 3ec93ae171e20c0accaef320a0f46e8e
SHA1 f1824ac3168bd0c063d524754c0f485ebd17d8ed
SHA512 d4fbd260b25764761e599b02f4cfb07f064932073555f314b42dbe6501e30a428130f62a5062f0b24abbf139a5885e0e1c6ee3232d85f01c7a66db1ed433a599
SSDEEP 98304:uXVmFbAVHwHwoQ2ImNwWgNZZvKp3Ewz7CW0:ulm9yHZoQ2IxWg1vKpUwz7h0
TLSH
T1B70633D07AB47451EA1221F25A9EE01F3D5C6AF189E46C58DCB2EBC3A30E1F514A6CF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSInitializer.exe

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Initializer.6D4CB63BC7607AC20344\VSInitializer.exe
Size 57KB
SHA256 2c07a246f730d7b97869c8e875755ea07a133b24b94f4343a7b7d968541557a6
MD5 c5f94da44beddaa61580922c2e7a3774
SHA1 398ce63d8ba83501824a74f3dd18ede08b32f895
SHA512 06caf11559707240d16010c171920f90be23e185d29b5bdbeb90cdd98b1842e8e67986b49dec5a8bcb0419f27375cf3de30781afedc608f1bbf454f3f050ff02
SSDEEP 1536:LHg4zVxfWQbsPhN8pumQDJ9XjOQUdS+RYEfSbvQ/1SpFjx1z0:vVIQ8uumcJ9XjOQUdS+RYEfSbvQ/1SrQ
TLSH
T16343850543F8C633EAF79E7168F649029AB7BB872C31CD1D0291628E5927F54E9B1723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.LanguageServer.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.LanguageServer.8F4E670A63A1935B0C55\Microsoft.VisualStudio.LanguageServer.vsix
Size 1.1MB
SHA256 2e0c8c023467c96538bb859c7dfbc6cef5ad01b14ae362eab3d2b88513a2e41d
MD5 c9a183da911b87904dfc327c7fbecfc4
SHA1 7e00c90768633606f8d47fbd7ac1530f18c865af
SHA512 93036dd73cfc66b2ae04ab98e20f4198d6fe9da5e2bb724edb178979e799fe3c7b15c3afe7dd16023a9bd074fc4e3de595d8f46b6cf047986a9fc032ed67813f
SSDEEP 24576:Qx/OA2L6WbnldlB+f4rmWDCALJgRj41/tB90OX76K2EyHOPAF:gOA2LvldlB+0mWWqY4xF0OyEyh
TLSH
T15035334B85592DB5F58383362104902BF6ECA1C59FBAED1D2BA26C024CC9ED836574FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Licensing.CD53D3F1BBD4EC838FA8\payload.vsix
Size 509KB
SHA256 a9276e193ce7d06cccb5b26973492c259dd858b32ada26b4dcb1b7008fb646be
MD5 9375b21a3a2e707695ab870f4125c3b1
SHA1 73dbb4f8ea4a969c33ec8675fbed5fa9fb77c31a
SHA512 db47f46b0e0a8300885bd967061b2969ca53b5c501d0038dd01b6a86090284731781c60aed6d616b03f4b16258164332cb87fc3802f43087a8e73076454e6fa9
SSDEEP 12288:qrU1IbZvdSjy6uAN4tts5FbVucWXDKrzp519uAIdgUay8AL9:9YldSjy6/N4U5FxujDKrdIAIdL
TLSH
T157B423F9B72EF3C1D081B6F39484A4E3B723E573EAFC58DD0B6D46E669218611570A20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Log.C3A697CDE86EE6A41D5D\payload.vsix
Size 860KB
SHA256 613ff847ae33264d9ca7adc2ddce50df983e36543662fa97eec0975070fa09f3
MD5 43d02ca97667be8352d0347b46a6a9ec
SHA1 f38f622a309d6d87f39eaa04beb35ec4df767bea
SHA512 76a79d17abb9c3ff286d3bb29a8256ae5bc1a752313649b7f517ea2d024467c6db949422cc600bef6f97fb09e63314c0a39f787e63a5e377f16aca817ea01e4a
SSDEEP 24576:koNbkyYLLfqAMwQRc3+85QShOJt4LFAIcUx8me7u:P4yYHfdnQqN1hOJEwUx8j7u
TLSH
T12A15330B8C734111CBE296BA15F7342A4F257AB2AB55DCA7B28C7A2774783304FB2745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Log.Resources.5AE8D647F5B5FF386C1F\payload.vsix
Size 33KB
SHA256 bd36df74c4cfcd57aea675f7fd5b035ed952647480a5d1fe8f4b087e4f8f7a38
MD5 64f6467f490b3c79aa5fb7adf0a73cb6
SHA1 4a32a5acca420f231846fc53ec7baa8a930b2ab3
SHA512 52bbb70574fd8d1bd4e78196a04209ce2c8aa9a298e044343a4fe8902e2c4a7e2724e965683b57ac8ffb4321a27fe84d7bdd4147c212ccf5b9e893cef9bb9196
SSDEEP 768:BgjOXwdXK8b/UFqHjic/0O3RXvS6LR8NQ3Sjx3GeE:70LL8A/S6L2a3Sjx3a
TLSH
T1A3F2E12F5D844244E610D9BFC4A70449F484D3B6E75AFA019B84ABCD8DCE7A2542B9FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Log.Targeted.4EEBF0E7E20BA59B7A9D\payload.vsix
Size 55KB
SHA256 884aa9b71860458443a46fc69d4c48c1d8aeb2336f2fd627868bd8ccb1c11d67
MD5 999a9fb51c0633c078c551823035b093
SHA1 c5cd7a1e8a4952898a22d07f2630a0aa295183fb
SHA512 5b4f5a5c451ae363f3badd2f6e0f7d991a1c2f6880fb6d41a332275b28adeb40f0c4ce1f16d2ebf6fc06028f311480417be28741d45a02c4c0e82897dc3a84dd
SSDEEP 1536:5F8+kyr8v1AuJIQx4KmX8zzJGEsNzk3GnlV+s59H4NXthW8bzTWe/:nk6bue+4KLVGfKGyH
TLSH
T1D343F2109F16B337C01BB33C4466FA1F5699D50E5E43CA0228F82A6466F779B4ADB14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.MSAGL.52D877B0F55FFE430A74\payload.vsix
Size 464KB
SHA256 a341cb21767eaa39fcb4798f9a209215d765da5341ce3d70d10b81315577654b
MD5 3d8be298154e86d9064560513e6c816e
SHA1 1e215bd323a720d130d32c1aac4352935a328797
SHA512 91557e32037cf16b69a6bd14c60400a925c2fd0db3ea0848645a5eb36dd2c13cdd22c1f157f19fac56d0170732f10a2a3be4d46968916ef659dcae262ac35605
SSDEEP 6144:Y8gkpxc6EgYP+iGkQL74NBut5D3TXF13UUBCKd39YQ6OWOyCflvQrVONDcorDC5Y:xxxIgYPpGnXzsHOVR7vQpqcb9Hz7AMI
TLSH
T15CA423953FFD5253B01CD031B6D2E46366848C4879A531B74D7482EB2A3ACFBB92D827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.MefHosting.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.MefHosting.A0AB9DB75944F9B65174\Microsoft.VisualStudio.MefHosting.vsix
Size 87KB
SHA256 1a408f2d9757ee0f30471a68c542c5cd09c7de0b23bfa5601585442c710de9fb
MD5 7dcc3d5c0104a53fb46190f092edeea2
SHA1 060d6b32a03a2c749e5ba0a899833b3ab052bd52
SHA512 972c8623db62b100aa2bfaeb3d50e6114fe42f205752222ece365ae4ffa817d02bca775db5600ea7885021a5bc8843c7479f2a7d05718666a2db3529eaee805a
SSDEEP 1536:5DzBpxQgemA2DlqDS3iWvf4CvFvC4hRyLwuW/WitFcZAPHO45Nq:BLi/KloS3dpFvCC8LU/Wit2ZAPHe
TLSH
T1E49312BCD147CE25C9300DB1ADA39E445274A7E0E82BF51529C1CABBFA52BD25D090EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.MinShell.Auto.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.MinShell.Auto.2460590B57A5B536D445\Microsoft.VisualStudio.MinShell.Auto.vsix
Size 9.8MB
SHA256 c7d31f57e84df500dc5a4b722308f48cce9b5493a7f0002bb57e4ce248893df5
MD5 3f0fa768bbc45566205c9190253cb89e
SHA1 254cda6e9900975067a923af124cfc28ef016a21
SHA512 93e5b51aa6111518ef415517453d49ee1e5f4ca900c14dde1a46628eaccfff6e0471c00769751e20df89d574f7c4671290c23b33219af9ea33e4b200196bc1d1
SSDEEP 196608:OX8R4cN6LBpcGNojF1B/er70cAePuGzTgovm3WjZfCCmzBMy2LyP:OXbcIpBojF3/FePhzTCEVCCL3U
TLSH
T19EA6335FDEC21CB4F0AEF17EDBEB7412E1991A1404A6FF273E28392586ED7604359488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.MinShell.Auto.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.MinShell.Auto.Resources.AF862B1003DB1ECC2E5E\Microsoft.VisualStudio.MinShell.Auto.vsix
Size 33KB
SHA256 63fa5d33c651d9e5d15076545585c29955df0eef42b96f26ea72f96a486422bc
MD5 be50c47458b6d037f6657e384381c6d6
SHA1 fb47d13ef55e64162aad8377cd4d2493ed2ac887
SHA512 98aa899aa9ef93c2323142e51e3f1d988e5c1c334aa13a02749a2aa1b866c218516c70c09c3cea3e1afffa1e06f11fccd4264e81b2f98ea8a2f5785446d00600
SSDEEP 768:y53n5GZWPOndFhVEOiuuOITvnvGzD2piyNQy8mxO:McZuOndFhVH36P+HcNQNmw
TLSH
T18BF2E06D4A6D31CBC74015B99D3154070E8AEA2FB623BCC33BF1635814C9A590F6B4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.MinShell.D2D87C968D8BDE43E58A\payload.vsix
Size 5.0MB
SHA256 758768a1a498d9034e295e65baf6ff83974fb62fcb345ee12fad6153228be1ae
MD5 4298eb9dae63efaa7b74ec7e33bca19a
SHA1 a75f0f6335f2602b82a2e55e855e6d6f953350d9
SHA512 3c023235aefd557334438b11a1e6648a681385100a88683d2e49f6fe92dd620d9137a6b6a7b4b92ae81f36b23147381fead9bf057b164dc1cf25e05f2e5342a5
SSDEEP 98304:Nfr+/6H5zgXMNrpRcLu+uiNFHavmrSOoLj0YILdc9PE2+lIqy2mLL4LYEvvm:E/E5egpRcy+DHYmrvAj0/i9x+dFmnEvO
TLSH
T18736337EC3CD6234EB0EF5748D903A093A7C938185C1EB1B96ED714A84C9EC0776B669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.MinShell.Interop.3C4221779C794DF88582\payload.vsix
Size 802KB
SHA256 7f1af689f3f4873cd98432de16e1707b49a9ab46d304eeef16c5017b550fbbfa
MD5 f7085a2c686278318167ea8322c2b17b
SHA1 b459972534b0aeb50b5915afa875866ad6ccfc5a
SHA512 138a7f34a6ebfcd5b6a350ccb54d719da859dc94bdcb7c6675da3f8c2a66f66de50d67b6643bf0f5b1ac2f5f13ef8af6e4c953b11b44664810cf0255e911e88c
SSDEEP 12288:7XZBO6VL25+AGsL4O/gzKv77lh4jV2/BREqN+iTBNlSgcarS7njrZ7nE8FG0cVnI:7JBOUsvL41qhh4c4QB31ccSDjd7n2rI
TLSH
T1F10523D681CC069DE771CAB444A63907008A8BC79BDBAF3FA055954CC1DEBA133B36B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.MinShell.Interop.Auto.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.MinShell.Interop.Auto.A956A0592C618A2F10A9\Microsoft.VisualStudio.MinShell.Interop.Auto.vsix
Size 634KB
SHA256 532755e1dfe68363d71fba49bde649eedfc2acae3af157f23d8b39f089af8888
MD5 a7bc41aa4c45fdf90b712450b5aa5a9c
SHA1 db5b1843d23f4f7773e41041f2a45552575c6501
SHA512 7026d8598edfe073f08ce00de73df0832b11ae61103c984a5b1643317c6fc74e1a46cc653c34d1821763b80a2e26de6f0450e69ce36ac7a46c7c4ae42e1e3110
SSDEEP 12288:0aCnucjgV4jQdDxqjNOcE8k/U21G5+Y/Wgq80EMgxdjyQrOO9sS6OB:WuKgV4j6DxOLPk/U22+Y//Mgx1yQrxZB
TLSH
T162D433FD826900EBD8E36C39CB8A887B76DC97620DFF16B14106753B80AE0F5564476C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab1.cab

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.MinShell.Msi.Resources.EA43674D8DE8F0E34AB4\cab1.cab
Size 46KB
SHA256 efdce9b18990494310a2bb3a68f9302baf40f331737f8761ce9d88b9502ebbbc
MD5 8ddb2711aef7cb60edbbee4cb0f36f34
SHA1 6125c071dfd2c554994f79a9e13a23efa9075798
SHA512 3ae9a54bd4764a7ca7bf73b7edea6ef88c488cdcce61558f28571a4862a437e32c70945563fda5ad7ba0034349c5cb190b5b9aba8f102905998815461b41d301
SSDEEP 768:m9ts1lXXRWIOFW/u/8W5FecStu8OuavnLP23Wl3MY7AU+9zVT:m9tOlXXRo/Stu8LavnI2/6zp
TLSH
T14A23D093383D405AEC9A28F412A0C8977E39D3FB0612DB7576C1ED8C28577C46B2C9B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.MinShell.Resources.x64.4D2715B1B63BB65C24B6\payload.vsix
Size 647KB
SHA256 e8c4735b927a6f8f15e344e874b60cb2bf4b19a40f386154202b7e30d04061a8
MD5 77d1ec395887510badc1a01343b0b644
SHA1 5338de6e460313a21e17866950e97bfbf37737b4
SHA512 79a49f677de8d2fc12d097a0fec3bb906f8919e18fae23b953f4d654b8b26307a9cd7586205f699c0bf494dccd1975eed9f8f5d6fd2ed746c8a3f46356bdfddd
SSDEEP 12288:scurYnS17nu9e63NhgPCxhi3YQCHrnshx7RVeLO8lBffef:UYS17nu9e6zgPCxE3YN7Yxrez5y
TLSH
T105E4230E7C3E28EDCD7981303A7E472BE45B63BE6B71131F2A56C151682787795A382C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab1.cab

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.MinShell.Shared.Msi.34D91400A70A5DFB24E7\cab1.cab
Size 123KB
SHA256 59ac9a56d5c7e0e58cf7bdc17ab9f2cba7683ca056550862a3e82c06186743c9
MD5 b79631c69b2e1be9216e41bb460e5f65
SHA1 1d514171a679eea9a6f49228e9fb4dcba64909fb
SHA512 8a7776e6a24989814ea09dec82f737777d6633792043b4954712a1e186684602014b61dc4501f10efc89d2e484715ccf68e144a292b98d157f6eefc39900737a
SSDEEP 3072:ugoF7aMtHk8p7Q+IHGe8M9XinAXAxlJipTev/D1qI3XR90L7QCA:9oFZ68p7Q+Imez0AXAxlJip8hz0LMl
TLSH
T1BEC302CF9D740128AD49B8B252A4EA037C78EFD626A414C31B05DC5825F2752FF73B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.MinShell.x64.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.MinShell.Targeted.C9E58F4CB7AAB38C7E82\Microsoft.VisualStudio.MinShell.x64.vsix
Size 7.2MB
SHA256 2bdf8b2251d7118aee9248f036befb9cd1e35fb15c98c917004a3f9241ab5c86
MD5 541ac662691fd4678ff4927e1d9bfa97
SHA1 8ce333830d87ecff6f50b9d0df768d91d7270275
SHA512 2f38e0d5f37f3f534cef4d1fb44c23c12df73cc4a10a4dccc31933e83006cbfc87306df6fdf984e871da72e6c0ae599750389bc0541ada58c82a21f71274264c
SSDEEP 196608:qFrr+uEHwQFDH5dDYji++YXn2wt6EG9MSnPkWS6D3LWl92Mlh6rfJ:qFv+ut6DZdgimXGbgWS6XWaMlh6l
TLSH
T1C37633BBFD1100FB994957E59192741A9EBC428A3C90D44B33E2739B158E05229EFF8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.NativeImageSupport.E3C2F5E8CBA3FB4DE8EA\payload.vsix
Size 34KB
SHA256 dfac838f23469ae71f96a2f7e08be3daa81934116dcb4e469ed262ce7f7a2994
MD5 6def6b22c04fe085ed87f303a1f17d76
SHA1 5669bf12b276b869dfd2fd01bd6720f4df4e983c
SHA512 75ecfa80a90e8c3a83b84853883198aaf9e14ef3cd57de3433dbf27c662b2766ebff96ab10a5342a383967ddc27095baddbb1584ec02ac9d5a6f3d9deb093719
SSDEEP 768:6k7vcBJuk0o7cDTZQHiQvFIyIxAdo45BIDW7UnWVYE3qi5ssbU2DE:aJyo7CuHicCyAQo45mDW7UjxiW2DE
TLSH
T1B5F2F295C0951EB6C727ED3A9607FA02F59C0297967341B22494BECC4D379F5338A0BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Net.Eula.Resources.9944979E66FDA6942A78\payload.vsix
Size 27KB
SHA256 290f568f4725f671266899ebcafccbef1f590fd6df6028bfefbe2f18eb651e7c
MD5 ee96fb296722bb727353a29a1ea8dd46
SHA1 69587382984d18fcfb47cc78be432a419c0f0163
SHA512 373451085d285ec8219800744ccb4e74e9cac28b1075a021e6ca22dca458374f1534bd6a1c9a741fac4ba28f89fcd1a7d9fbf98f02f858523ebb83c4ea13d8f0
SSDEEP 768:leYzX5J+3WcZzS6CMBkQW1EBMPf0cj2CJMR:leYzFchSety9XD2Cy
TLSH
T151D2E128FB3E4D7AC255C73B251390668D0881FB09C51EE6D89A11B87DC8F50A239FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.NgenRunner.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.NgenRunner.BCBAE2D875444A311B2C\Microsoft.VisualStudio.NgenRunner.vsix
Size 132KB
SHA256 d1d88eff9b914056eeff4cb9836b8742bd6421e2b5725d2af46264ddb1813c4b
MD5 8829676207d9b877cde701ef3a54ce96
SHA1 e489d7fdc902e3fd55acb3c441bd803ea362d2af
SHA512 02a487ae16d92741e8135471556366f2762b2e3dc5d5e3b4374f0eaa18e12d15f5993278dde22beafec3f5ebcfbb8bf7529d2cf33cce7528c346e04d5408fdea
SSDEEP 3072:v9dtDjMom9zYxW4UrzG8n4Dtru+iRFwE9b6GBvGh1P3ngO:lf89so7+FDKpb6GBuh13gO
TLSH
T13DD313FAF5CD90C8D80F18353522B05641F3FA12BE96AF1540225BE97E6C821670C9FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NuGet.Tools.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.NuGet.Core.557E7911A1D18499A304\NuGet.Tools.vsix
Size 832KB
SHA256 737581cff95c27ab6e71ed15139b1d497478fbe6e70fefdf96862f86189faf4d
MD5 551abc2303fe96c5b9241f89439e91da
SHA1 6a57e46924ef9539ab326e858520338661f5df19
SHA512 e6f71f7d084855465661d3c221444c958032042e4219f13c40e6b461e5eae74fb73d536021cbd4e52487f93ab0d6994100d0876c855a2a42a6e57a19305bbf1a
SSDEEP 24576:V6FEtcvTu4HhG3HTNmJrFnJJ6Ss6WtVsmGYF2:V6FeuLBG3T2nqSs7VsmGn
TLSH
T1320533A4437401E5E1B5BFB2F8EC7150D75B9912A3B0964FA0DF2CD99AF94E0B0058EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.NuGet.Mcp.Server.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.NuGet.Mcp.Server.C847FBC68863ABD3C657\Microsoft.VisualStudio.NuGet.Mcp.Server.vsix
Size 11KB
SHA256 e232cfbe0754ff6611336ce0c2bb608db2779547ca4696e4bb7425913a2ac48e
MD5 46982b9eb94db2616decd64c76b88a6d
SHA1 8b1942b9f81b42686b2bd8f6ed799b2ab5bda201
SHA512 b12918642d66cfe4a544564ba7a49f32c9e7c12999c820525e0dafbbe904b80c74591566d661316f8fdf6545713fbe0d2bcbd6034e4b407fb390162bcd83b935
SSDEEP 192:Y3L5r1e8grvjqIRhVca9UIvttkbqwSRw7SlRKbKQvxqFiSeCogs523Qr8txmS7zJ:KzvEV5ttkbAmOa/5qFtHJQ8txlN
TLSH
T1C732AF2599EF0951D41034BC215D1863251DC64A31C3FE461AE87F8C5BCEF28C7EA67E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.NuGet.Mcp.Server.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.NuGet.Mcp.Server.Targeted.26F62800DB95BC816DAB\Microsoft.VisualStudio.NuGet.Mcp.Server.vsix
Size 1.1MB
SHA256 702e0ca220f17bcd00f7aa6986a5265a619ec89a15fb8a041262e2c4f85791fa
MD5 8b414516b584b27c27bc34dcf8393748
SHA1 945b9d5330f6149be08c1ec2c45bfc5ddd839b8a
SHA512 22abf0ae0f622b8825dcd43a54085c01f8a829c564ec9ac8948f68e5275b27e103d13caac05efadf09c882fa17f3800bc6cbd1d2ece8be3c5dca3ac5a94756bf
SSDEEP 24576:0YpCMcUBUQju5BVf0hSUz8C4bF1lmgeshRmgk6d6eZf:xBbIBVfLUQCu7+shRmg1HZf
TLSH
T1A03533F1A9022AE7C9499071ECE1684A5705FBC164E9E2B39DFDF8EBC058520F0B552F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.OpenFolder.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.OpenFolder.VSIX.1882C7DB056209303C9F\Microsoft.VisualStudio.OpenFolder.vsix
Size 2.1MB
SHA256 5a253d68696a61d437229e7b5596991c7af65635004541b7b4dcb570d26938c9
MD5 8a5b82cde5f1cbdfaf1cbd744e9e7811
SHA1 11caf6117d9eeb9d3b5585e0ffd0c8089a07adbb
SHA512 c6b877fce72bbf5fec10a5b81b0864047827400c7c6b5617b56af0442b2eb0f37aa4fa409b47658d1465949169162256f5d4a5d1c2944f3f83faa39105ce842e
SSDEEP 49152:DTkoFY79Kv988M8XzIZjv4zO9Re5emWhQeTqh36gdswf+:D4olF88dX8hF33mWhDT+q7A+
TLSH
T1A2A5330AE94039C4E177A9339BCD49B53663CC2398C8D2AD8395AB6C4CCA77451A7DCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.OpenTelemetry.Core.netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.OpenTelemetry.Core.netfx.F410AC8FF99957AA0E40\Microsoft.VisualStudio.OpenTelemetry.Core.netfx.vsix
Size 401KB
SHA256 494fa4a370c4e2b903f48a84dbdf28e8877fd17ce7713dab97304699a76fbf65
MD5 cd0fac8262bd1ce913041ee827cd7cb6
SHA1 4c45a854a33d3520c8f3eac08cbe34906775eaa8
SHA512 6be55d2417124bcb6da8fe3b1816abedef011122ab6bf0385ccedd9157b29a7d1038b4b81814e16b02fefd3a82b14fe9fc7ff1ec13ee24b1a0fdd23dc91d3cdb
SSDEEP 6144:VBrwVxl7Ri21FZIbBqkzWHc4Cbb5VdTBwnd8JcPMh/vF4oLb2d0Jki8y8tASwtKZ:jEnPFZIVtVX9S4caFbLid0F18tAjv8h1
TLSH
T158942354C460C86BD0574C303BF1132AFF47B811798A6A7602E6E7B37B6FB54B69083A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.PerfLib.DDF9BB9D20B0BDF3E08C\payload.vsix
Size 3.3MB
SHA256 82a626c2ed142caea8ca65939d2b65db4c932a3ab76457b5e3c2b96e96d18368
MD5 62aec41925467baea80566d57a8397bd
SHA1 6bd3a45203baec0554c7ff75cd87916312d81137
SHA512 1b348d98a49f8715cb59e03f348de045d2991b1c932b67dc3700f21ffa361a057cfb4185800c983a923af9975fda7b3822cf06082e79c40aabad0647044994f4
SSDEEP 98304:hdMhWHqHi/+SEKtzGGjGw4dLlU+PIh5JNu:hIWHqw+SEKcwOUAIh5JI
TLSH
T1FBF5339AD5EC16F8AC6C5F7F4291FE21490B03C123A1AEEADA393C7D49D72104D7192E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.PerformanceProvider.DF09EB382D9C7BEC3B6B\payload.vsix
Size 50KB
SHA256 97ddc94a80598bd0e97c2c213f05600a9900842c6412cdb0402a8d493a15a937
MD5 1678f5462d7cf1c8e8218d207ce59d59
SHA1 3bd739449dea3d2c19d1f4d7ea003857f4f19865
SHA512 6f8e0cf3a536d41f8b0f16a54645237b8b597075bf2319ca43c31e4a4d9c0b1cab65e9cbc666ff9d1ef2a8138dce7e98cb843851bc9e8bdad0ab62746a194326
SSDEEP 768:6HocVPtNmAsj54ayBYAKcSvPKvcxZdbhZJdOB8jJdxTstG0kCyXNfVl5:6HZxWfNIY/xqvcbJvjJdxTskhCyXNNl5
TLSH
T1A23312ECFE0516C1CE22D938F8DF880D9A9680EDDC981D2709B1B29A8193B044ED95BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Platform.CallHierarchy.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Platform.CallHierarchy.B65919B7DE63A480284B\Microsoft.VisualStudio.Platform.CallHierarchy.vsix
Size 283KB
SHA256 f41a2be4ff60b983d1738ba39ce5352162f7d3f4efda1059d2a08dd6cd95be34
MD5 414590d7039f7bbec7fbd6d2c159778d
SHA1 e085c256797a13c5b518b5dd0abb86ad376a2c9a
SHA512 cf957ebfd90dd45f1e39f61da9bdafe501329824d952ba2cd39ef8f422dd27f87fd9eb1e93dc55fed9772fb17195ec38a2ff5c75954afda67faa0d1476448dcf
SSDEEP 6144:vTw8EwyywWeAxN38IW8tx1tJs0owtbBdKiQyOfQH9rM+FQmXPL8VBy5+BIzQSu:vTmFywPAxN3XxPfJTjtbBdKJdf+91FQ1
TLSH
T19A5423554A290453E01EE63F6F2AE60B7C534743D777E88CE8560989C08FC4CFF6AA65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Platform.Editor.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Platform.Editor.051FFB77EE6595963FBF\Microsoft.VisualStudio.Platform.Editor.vsix
Size 8.4MB
SHA256 614a49b4a045cce701ca3c86a6884f18d26991a4207421b21907294b589e358a
MD5 3ccae4639f34dc41556eeafb5803ac9d
SHA1 b462882156bd7c15d6609814ad8f46114031fe67
SHA512 37c66d81a34b9ee856ce57f1e0bbf42b96eee6d8854dd5c8b14064f65e9a41aa0552966f5bd0df20df71e0de4d57b7d6499d6e582a10619adc4e50bd1cd68b39
SSDEEP 196608:qJC82lQRrBRs7paboIwHln3oNEMR2I2Tj58YyGDV5Vfxy:qA82m3IpafwHlnOETw25a
TLSH
T1DF96330CE9C5ED7DE62E8A7BA5B5C88E4433D0939427D23C93B15A8A4204BC9CF736D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Platform.Markdown.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Platform.Markdown.899F45AC1B6138529979\Microsoft.VisualStudio.Platform.Markdown.vsix
Size 1.2MB
SHA256 7d4b86bb6259d04e40d72cfd955c3a126cbbba6e2e0f9708d7f77b8dcabf7be9
MD5 3b35464d8509df49dadcb271a156b135
SHA1 b9ae23c1edff616fc30475ae2e1e9a13ee92c761
SHA512 cbffb8e75ce92b3ecdb592018a5f42a6f490cfcc43bd9a136bd5cf7916a444db07c416947367ed1eac7f9093568d189d5d32827800b8cff4d8ea8aa671619efa
SSDEEP 24576:fxzcopL5RgEALH3Ci9XRS5zxSsf7qoQBEIOkGlYDSQCI0Hrpl/ymI1:5YopL5R8CwhStxSMmoQB1OzaDSQCT7I
TLSH
T18B5533D79748ACEEF0A2987AD1D75901F31BB1823F3A444D42CCF6354B680DE23AB656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Platform.NavigateTo.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Platform.NavigateTo.71A0A8C4837075EA9B35\Microsoft.VisualStudio.Platform.NavigateTo.vsix
Size 46KB
SHA256 cd5a5b993372deeef8541bc02c68ec9161b7655523f8d56d7bbe63549641085b
MD5 7e9921f247b5929d4e30a5b55dcbf7ef
SHA1 926b25f6b6d2174f78304ecf8e942085475e42d3
SHA512 4e82506d33f48794e0b7657b29ecc2d5a0934ad616ee5909605a0b11520c6b668d15ee3959d4a23ca67dc9df207767c55006e86b65431c6666009467ffb66786
SSDEEP 768:LYWV5Hhz+dBRpte42/8sYFA4IS+SQHeYoTLMz+zMSzQIg:MWV5HhidtteXvFjJSLYMLMYMa8
TLSH
T14E23F11D4158391AF624353C58969E277DB148A10832A81F2EB1EE2753C97CD163EFFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Platform.Terminal.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Platform.Terminal.C407653907B7DF472176\Microsoft.VisualStudio.Platform.Terminal.vsix
Size 211KB
SHA256 d700a3973111478044191698e71c9700ade2111496c27a3c2027a577312f7c37
MD5 4a9461ad6d34dfa8b87c5df4a70542fa
SHA1 df9d750caffb448ed9f468e68c5b7ef7dad3bd19
SHA512 1c68a2b26dafcfde76377681d759e807807f0c02457e26fa36a33437375edb2b3a2b957ccda59ef3f6b034626c9ef48de71fd65a76ef0d6ca553473560e0cc0f
SSDEEP 6144:cnRfvRN+uTnPcehoZPKiiW+7OiGmRw4YR7:kHRN+uzThHREinwTh
TLSH
T1E024220C9DB29D11CF26B4333FC8AFB943CBDB075C21BD26345AA98D22E5D28873A555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Platform.Terminal.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Platform.Terminal.Targeted.2B05B90632427689AD6D\Microsoft.VisualStudio.Platform.Terminal.vsix
Size 1.4MB
SHA256 60cff80ce2f5b9a0f4cbea9c39a302f14b537f24b4398bde6a5bb5b2e2a20e78
MD5 d455218d4f0ac131c0f4c3be76843966
SHA1 4bcdeb58354f003fa659ff912e6fb70a043e8cda
SHA512 5f8e92a3ed49ec51a86b7adbf9c3dbc78c03bee0e62bf32ff9b7389fceae07951df5e446bc542843ed53d52bfdd5748cb447cc160b153e3c88a5988d53ce03f5
SSDEEP 24576:zhEyZp/UJA3eL6vzRzBqn0kRmag5khlXav0c4adVa/vJJPi0cTstAtTZDJYpfna/:tEyQTuvzRFW9g5KXauJPi0cTbtFJYJnW
TLSH
T1BC6533ACCE634C7AD4AFB2353834EDA4CFF423A770F1548A1BB0321196946B57C49AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.ProjectServices.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.ProjectServices.DF0DBDF94FA54F1AC269\Microsoft.VisualStudio.ProjectServices.vsix
Size 125KB
SHA256 ec0f16cfcbc9b427cfa7edb92db6f07c7bcf75c7a353dc91467d81d0d849daa6
MD5 d13e994fac62eff2e42ab22b45113e77
SHA1 9695f997f92daa2658eb089c35308502843cc0aa
SHA512 6935589dedadb2a8318b3439932d0a7c1e14a32a021fa73ed3f8dced867fce80d5497ec6328659f61a7ed2f101302e4f6d5c33adcc04c9b1f38941f1f84a251c
SSDEEP 3072:JfZS1F7uzrvjd2QFcqSZyCV7rfjBRx1z3RVI9:vS1UrrcZV7rfjBRDzhG
TLSH
T128C3128456DECE35F871DD380CC5CB5A29CB808A936446F72BDE1BBE47963B1108BB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.RpcContracts.Auto.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.RpcContracts.Auto.435A11A3B80E8DEBFFB1\Microsoft.VisualStudio.RpcContracts.Auto.vsix
Size 684KB
SHA256 007f30b769d2d1496e1302eefbad4a46d5cc599689732a0f055be3932c41a967
MD5 587c234c40aba54c199c87abd5f7d60a
SHA1 bbabfb4db12d07d5648dadc4e55b98c82398ea2e
SHA512 0619ac1961a88173d1a7bf9ce53cb84a2cd9f57554d78ad2c7efd68b59e396e0d6c1ed26be4eb287a4a6574bca258b8ff8383cee23171e89e1198623ef512cff
SSDEEP 12288:SsizNjHw1MpAUrJ6D/82eYC7oTVfhdTfCuTQq6QXnlVIzO5JfFOc68YL7JqdFL:SsUJ+D8jWVZJtTt6QXDIgc8cNqrL
TLSH
T1B2E423ACFE969B48C4039532DF5F0DD28D478049BE733A629DC387345B142AE5ECA4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.ScriptedHost.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.ScriptedHost.C9FA7214F53136E82FD4\Microsoft.VisualStudio.ScriptedHost.vsix
Size 384KB
SHA256 c387c5a7e020d48a3b0d12b03d009a1409f525185b80b4d68b44f0bff435a99f
MD5 15759f143a7def8aee7b9db45f8845ea
SHA1 ffbf0234fec13bb1afe2e4919e5c8a06ab201c01
SHA512 c5c5d894acf508355d3b30b38c500e81bc913d69faa1e7d74179d52a21c5955d3452ed79ab69fbb3e2391f0dff83a0d6436507f5489a542d8d5b17bdda27f998
SSDEEP 6144:te9ywCqW3NAtdyZVleTF2mCpQcH0svpfChVnlJ8PezWIi3rgYChztYY6DjcOlp2D:tMCf+3yXkTF2m/yvgVv82z2SzGRBdP0
TLSH
T119842382428735C53790A9B0F38EE08D8DEA5DCB49DE7EF94A9C0EDF2400C7557D266A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.ScriptedHost.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.ScriptedHost.Targeted.B8B258DD27DAAE3FCC01\Microsoft.VisualStudio.ScriptedHost.vsix
Size 87KB
SHA256 8d481a10ea46bf1cea7bc6ce5bf9f7793c7c72657777bf7305e95346a3c75909
MD5 7e1e315b60cd90c9e27a30ebb634584a
SHA1 921d67a08cf4602a36704a0f906982f4bca8bdd7
SHA512 67c7283727f391ad38023ef6141e6ab57477edec25abd57cf1168e16f73ddd05d082182a45e9a4bdfae4a1cd6a9b11357fa7fd437d3af2a0caf21847e9f09822
SSDEEP 1536:kFRVukaZdIAGiCAAOPWIJNMOTG0QhGVsTVH2dzSsz6jIuTEKP6T:kH8kaZuyCAAOPWeNDXAas52dzEIuTE7
TLSH
T1F293122896210672F20284BD47714504CD67B9AB9064D0EEBE697F2FFC444C99E9FBCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Setup.Configuration.Interop.EA4DE1DDA3B3F5ADC622\payload.vsix
Size 26KB
SHA256 0f1ee52bc9762d0abce82569b46996d90f461afae43c6940cb7e613aa4320d9f
MD5 3b3e2aeeef54500c3b077a6e209505b1
SHA1 4d7f601e18c340932c26e8a091f26524f6903652
SHA512 dfc1254a554b3355839116bb9b121a72618d8d0cd00056351781662548b515bb02a0f79c210341c6463f8bba780763eff433bdd97ae89f964068bbbb94e5d889
SSDEEP 384:I1Yq5UG4y/jwgtc32KWnULG7QiXUZ1JDoJ8Od6KbXTalBJM/XlWWpD+65KI6CGUW:IaqiFy/jwgPKWn/MrRjmXuHJ0Np5kCjW
TLSH
T1BDC2E11E5206ACE8CF05C63E9B410C2F6D87D693100B9759E6B196AA90C7A314F46FED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.TextMateGrammars.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.TextMateGrammars.EDAC58C94FC44F4E9C1F\Microsoft.VisualStudio.TextMateGrammars.vsix
Size 1.0MB
SHA256 8f98faecf8b0a914738b51e51c1c6dcd4309ce394bb681551794863937e87a20
MD5 888f33b99cfb42fbe24671b4880a8aae
SHA1 d82a10c9cb2b4ab14dc3ed8e5d53b1a19f56806e
SHA512 be123f20b6b6d6a2c5b77bb8df527dc4b204ef1fb1721f70033031393d503b63c1c0adfa463ac81441cf8bc62441d463abe9a8e3e573d364d519ebad0e0c1f12
SSDEEP 24576:HFdf96Q87uFlFtv4XxFEr41mv1a/Adj/N0MSvmtI:HFdf96RuFl7v4Xxyr31uej/Kxb
TLSH
T18135015F6E5C0626D33BD4F8E5888342E771C5363350BA229DEC46B98D22EC58712F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.UIInternal.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.UIInternal.3EBFA0947AA4F59EA1E1\Microsoft.VisualStudio.UIInternal.vsix
Size 6.1MB
SHA256 d0a191d8dc9d0253ee376bcfffe1423a4f9f9686c0ecc0d970670df8cb3a97f4
MD5 ba44901f37c57d04ebc2c65393a22ef7
SHA1 2bae6e108cf9859301b26c2d2e6550c4c7125dd2
SHA512 e63012818a90697e887064ff49c8c8dbfac3f7221bfc6adfb4e3527a3623098b849b86846f26920215641736e433eae1b5b754425162a14fcf075eed3cb08e7f
SSDEEP 98304:i2pt0DHOVBjeqIuoYZEa93Grc6RwiYIJm/hNw80gz2U76g1R2cXURYfT8eia:JVVvImZEasoDgJCwYKUL2AUu9ia
TLSH
T1745633408DB5E968F3D0F84747BA924C1F13264F2E8B2CABF4449B29664BFDC565232C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.UIInternal.Guide.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.UIInternal.Guide.71043E45171BFCD703EC\Microsoft.VisualStudio.UIInternal.Guide.vsix
Size 14.8MB
SHA256 aca90cd9696a0f632bddbfaea4d787be4ed813a3ed33ab9a16802c0668257761
MD5 4c62be16a3757a8f0228aa56acfbaa9d
SHA1 66c76e28b08b1a7c1d42bd867282825f6ecdd6df
SHA512 9f991bced09c5c127a4e41542ed8891a28ae540c86c76dab7e35e987e318ac043aeef5b7f55a13afdd3fb608118a55bcd1a7bf77e713843bce0a6418d8aa29e2
SSDEEP 393216:MH3leoWZ1qbudB4KUaW+jefpTJJkn/84Yjz0ZnfCikvIZ:i3qzUKUTFhjsXYIn6eZ
TLSH
T123F633B083DF1580DA9F5036A9C6364A66CE5291B451EA0E2F4E5ECD4FC13508BFE6F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VC.DevCmd.3AAAAA324728FFA04C0C\payload.vsix
Size 499KB
SHA256 07dd9e9ea4735623c402ca11f6974f6edcae947c8be42e3712794f6ef66134c9
MD5 4e3da8dcda780d2f6f91b7fa38640fea
SHA1 0a54d7da4c5a46d23ffd64fc108969096decb1b5
SHA512 e597201ccf26efe0a833d40d593e65e7815156c6f707f7cf1010261813c8afef755d7c0b04d89774efdf9cc411449d01f7f93178e73ca099c8c7559a0c754e60
SSDEEP 12288:aBSjstXA6sIfXYYQHMot/i+h2pVz+Tgh+H:qGsthPY5HX1hCVz+Tr
TLSH
T122B423EC55E42575D31AB5B24508F620509FAFD656C2F9186A9C383B0FA3F503FB0A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VC.DevCmd.Resources.C404E0B58B2047A3EA9F\payload.vsix
Size 20KB
SHA256 57cd6c8bcb6d9410fe68057fff5d5eaf41b05db36ced3c87e550ef92a0653001
MD5 ecf66c5094a78fbbbe75a47a34a5066a
SHA1 0785d501707d826318b449d801c79b1cefe891c1
SHA512 aaadbc5437ae59fe72457c6df84cdbb6c36cb80062762ee3e729c712a5fe763ac1d1a119c7723229474cb9e37cd67882e9eff591906117b4c05bf911318ebb99
SSDEEP 384:NktFAVjoBMFKaofo51RQm92qyU4XdJaE6HDxqcJAih2xSraYB4d1UglCCvE/V:DNoBMBJ1roaFHwizrDLQpO
TLSH
T1A092CE3CDA734EE4DA520639471A5B0D7829F187B0E7322B2948B65B08F9B490E097ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VC.Ide.Common.22A2D507D8B356D69DDA\payload.vsix
Size 3.0MB
SHA256 6a9a2138a244d215630427390a48bcb4d7b1ed21e55f9e3d0adcbdfedd96e6a9
MD5 a118c83c826658f6a384d63b3a9b072b
SHA1 f93996a0a05d32cc7a78fbc7ac443484fe02dfb7
SHA512 d43db0293bd3562efea40c828e994f2b50fcbe7330c8cf0f34b695f05aee4792b37694fc9ed04b63b577028833b668800f824eea934a05b2989f3dbe6efddb65
SSDEEP 98304:BkmYQLC1LSmykpqp+5Bb5EJS7zzaXUK7W2a7/cXIDYOOW3g1rBh:w5LSVITd0SeV4DJMOOKoD
TLSH
T1FBE533184E93A32AF658ED78B744BE067169DB5A34F3FF8C4A4C4E466523FDF8428025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VC.Ide.Common.Resources.7D3546F6C7AF9FED3502\payload.vsix
Size 41KB
SHA256 a43b2d4c55ec2923bf85f5fc6b64653f08498fee0fa6db4a23253e76c1c32d1e
MD5 d61ce6528f7db0e1cfc87bb07dd88957
SHA1 d57798ca2ff8a04f2065ef6f0f40f72d1b2f57d7
SHA512 dec3594008de7305977bae822fbce29735003a2a38d90febf416c420daf3df834dbb430043d257b6bba11cc75ffd42031d9db9aa69f1acaa4af11edc13e0f2a1
SSDEEP 768:SrvFpJPlBY7F8nnjeuV0WXA2ZQk7dAc/adPpI3HeaUbWv16FjdtiSQyavIPQR:opJHYp66C0WQ2mkdA6aVpI3Hsm63tiSC
TLSH
T1801302148FA289F0D8CDC4F9A09D94DB01ACC66B15B2B69AB33077B14D81987574B3FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VC.Ide.Debugger.3FEEAADBF008B778450A\payload.vsix
Size 6.9MB
SHA256 fca5404354a10009abce72be8818893932869a98a6e28e6e258a6c0f93098f92
MD5 0e852e57e95bb68ad7d0a3c0f89d5eb3
SHA1 ed349dc2acfa69249543c325807202660da9aaf4
SHA512 a0b1640abfd8dfd1f8804c4e9ad851b1ba6da2447caab15f5b1765caf1003024182b4e77ca035aa3cf285901782fac3fe7b723db6a5204b89085bc90d9ac041b
SSDEEP 196608:2FxRZMJxFyxvl1xh0CjjT33Mn9PQi9bE2saFnnh6cw:2FxRZAfe1h0yj7Mn9bE2saF/w
TLSH
T12076338E987F2EA9C255B0BD83610813A12EFD79E151045B26809E709C9C3A7FBF47DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VC.Ide.Debugger.Concord.219342A0FA5B780CF868\payload.vsix
Size 175KB
SHA256 3f214b63d25b15dae309380fc32eac5cff651b94261f2570b460c84950d9bde6
MD5 1b6d5e88740effb6b315936a6b485d9e
SHA1 d7ae8f1f5f5c3e925a2b8aa7c2194627ebe203e6
SHA512 c8fbf87b5fc4e1df5b05409982a285d687220d8bd373360129d718e8ca27694c6cac81642b41e6c6aff7393bd4d8835f7b889f1d0e1906c0b278034572055960
SSDEEP 3072:UpIybdjFsVYrTMSxQcs1ck4gtgz39x/1X6QnOk4tILOVyMKFw7PW0H9eb4q:UpI4WYrT6qvzNxJNnzvE/7PTH9eb4q
TLSH
T1BB0412306E967198C9E3A0F574918546AEF25323DFB1165F5E807CCAACC2E46BB85F0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VC.Ide.Debugger.Concord.Resources.BFDD74A2B9C6039A3083\payload.vsix
Size 20KB
SHA256 4532a7a975495e43aab54e0c79e3792e0555f7cd0f9a4f8b015b583d4ab24216
MD5 7e4523f15ee11a8e8af02e681eb3ba14
SHA1 ba905a10c515dbf689f94b80eb1d15e4faaaef1c
SHA512 52c53849a54e1fed2f9710916c09eb68545b184dd111057078ee33370c954ca2c9ca4b327cf07fe4af24e6e0611010a5fcd8493eefa799d0c1d2b070e1583aa1
SSDEEP 384:AYpHV3BlhE+feiEO4HgVrK7OxwW0VDpzMskuEdPupGsV2Ky+iWC6/48n+kUv+VBh:AYtjlhEqntvwtVDpGdmf2Ky6C6/48dVX
TLSH
T1DAA2E12DD61D826BCF2392741939920CC894E0C663D3DD4E84E3221ED396EA6533E93C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VC.Ide.Debugger.Resources.8390DB33AABAB8EA6435\payload.vsix
Size 93KB
SHA256 1a25d5cd9339cff943ddbd4e176cad4e0c83e2c5b432ee8143a19475cbcc730c
MD5 0c457d1cb1386fb6a9cc393ea2ec817e
SHA1 5afa1dc175778faa0f9ee320ae7b00aca267f09c
SHA512 978d4d4e4afc65b3428e84c58bfb72f05d2e64eb7c38b130382b92f2d89a0088eab28161e3dca3c2b2d548a55520ae422a7f6ca3971b920b4c112a3ff8bae41c
SSDEEP 1536:G6WPcU2Uhl7Zoo6qUSWHInL1RiEvdrYSt+PCsSestdIU/pACQ9zNNuEFkoxmtPXD:nWPcsH7BavIHiEvdrYSYC9euIUjcRN7c
TLSH
T1A693127C9E841142FC87EEB845769E661288266297C13EEC8C4BA6BDD7F13150E0753F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VC.Ide.ResourceEditor.C3A8E9FC2B7E83AB9168\payload.vsix
Size 4.1MB
SHA256 29a3ea62306eb5c6fd0a9b309acd716bb1c651d8ab1bafb5e9ad8418d52d3a70
MD5 7f85882a135d9021da1fa936cb2179e9
SHA1 c844cb114f9c027f1770b69efc6c82e177e222d9
SHA512 d461d2591a0ac39bb893a8ff14ddb3388a2f48e23a09cc0aaa3a887d3f659fcdc45966d559491fd9d568f2add5c3067e0b33f34b61d7ca5eee81da3da8aa6ea8
SSDEEP 98304:J+5KqWGSMdNsimrcrau0yghskFmKBucG7EWHlJbArw4Ue22C:J6KqhSMdKX4kxu/7pJbz
TLSH
T1AA163338E919C383BBA0D46E8DF37B07CE87E6601F9CC48147D64585782DBE2391B59A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VC.Ide.ResourceEditor.Resources.D97F2AE5771C4D8AF5C1\payload.vsix
Size 425KB
SHA256 c927140e29a6f96195dd38639b673bb59ecb045bf98ab3a6bcad94d98602084f
MD5 1a79985f66906ea707627016ec026cc0
SHA1 abdd57fe19fff6093f33e2ee20a2c66f44b87e1a
SHA512 4356d04f9a04bd3eee734478301a4b9abd4e4356561d4827665f5efc3fb6d1243956f82ddb48cdd0d964e78051cf49e26ed34ddfd21d3fd609162078e250a4ed
SSDEEP 12288:frWZ9bgDhbZLqcqStBijK+nq6r6R3v3I3J:faZR6jqStBijLnqw6sJ
TLSH
T13B9412AB3B84418EC8173B3A720635543EDDB84B5D2B8675DDE4D68DC3849A80FE6BD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VC.MSVCDis.DD6D9BCEA2573910210F\payload.vsix
Size 577KB
SHA256 6234806b9c95c57e0f7fb2de64ea97707b3d6cefb7e88bc74fe5ec1e9b6923b0
MD5 97083baf8ebc70ee6f7a12e730374fcc
SHA1 e4a67f9771c836bb8e39547f4905597fe0fa2531
SHA512 2bce1e152a140277260ae0bf9acc3c5d9b762c48d75165329450031f9efdd9de933a28bd7af8eeb47f26dc6b4f5c6a4a7dc2e5383c90226446bf61c5d10caa8b
SSDEEP 12288:DhspsObYnGfc+KSy7XKLgrNdjkcuF51Gc3QlhN:Dh0VSh+KSy7aGYjQlhN
TLSH
T1FEC423FD395081E1C82CA43633F1CB46F06695F524273EB898626DAE4A9C11E493EF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VirtualTree.12D985893009663E7E4D\payload.vsix
Size 147KB
SHA256 15dfa7c9613718d07a86c098f7fbb268b6ebc0cbcb11782b2ba747d687f5f7b5
MD5 918e032f8d0b1c982ccf8de00197a023
SHA1 0bf5514489883eea00ce035a83f161d01b8dcb1a
SHA512 5dc6feb38a1c8b45e902865b2fb0e64793e19f7a0eb13050c13a653a9b1552f9acaafa3ef0a478598b4804b05d5887d77234026a8b3d6742d06ff5d4067ff713
SSDEEP 3072:5NfRhjvlWidIgc+mfHO/0ALxnmkPv4GjTEI4/cL49dg9J:Drd5c+AnALBBPgGPUcudg9J
TLSH
T1E9E312F4531AEF36E73E653996F2A12F95C910BF05D06CAA3916360B9187A4800BFC9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VisualC.Utilities.74A7A4B7773EBAF81C0C\payload.vsix
Size 155KB
SHA256 49901ab98690573a0181ce9771a8b2e8bc111377857e0f99167e8a5927f63f8e
MD5 4821e76f2b76b3984b67a996b57e6902
SHA1 802d872a1f20f0bb13ad5ef03e363eae7bd89301
SHA512 23aea981bf118e80536318d3a99d45acad31aaa42effe51a7c2a3e1789c6591eefc58235cddd00bf27232b1a0eb4ac7b97a08d077990c4fd01aeb2de28b02e59
SSDEEP 3072:Uu70ePbKifhbFmeIsy67dsHQ/3b2MQ4gkabeKvbuFPZm:NrFoRyeHQfb+4gIMbudZm
TLSH
T19DF31256B25F7970DB22B57222E1E85B5791C087630CC3446B5CDAB982E43FC98E7EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VisualC.Utilities.Resources.81E0C146D2C020C38530\payload.vsix
Size 9KB
SHA256 31ecdae5ff722e868156aba8b4ccdc5a416fb5c58f4f8e64aaac3d399bfa8693
MD5 9c06de5688420e05f2fce3d81dcc7e93
SHA1 acad69af3ec44c28a02d7c560207af8a1da653e5
SHA512 7c6ff513d5b0e27f89f7a3b582b6d6cfbdbeafc8c7029ee3c26612c48599b691f99ea9018c6ad24a66182ac777e4ce211509c915afc4a0d64ff6dee81efd6069
SSDEEP 192:rFAALqmNLk3GrqwrA2ZaU/GRMP1OgOj1SZu+Of9:rnLqmF8bLHU/GWRfun
TLSH
T1D4129F626E1B0950C30494349767A86B7C53E0CAA1915A66D6E707018D8A9FB7BCB0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VsDevCmd.Core.DotNet.5089ADB6FFA928FA33EE\payload.vsix
Size 11KB
SHA256 191ba5568f1437e3ed1e768d190375fb08d6ca32d2791e1c3bfbf6c97f9b0a98
MD5 3544035baf3749fa6c200b85f0535257
SHA1 868a118e0a5983274dd51814748ba78cf00dbe33
SHA512 0bf64b1399324923e6108567fe98084155953ad17cd7beaf82a5768121d86a8b8422cf7ad3ede02165f4dde9ae4133c1672266884a73d9f1d4fcd0d7b890cea8
SSDEEP 192:tclyywkHffZHLYTKmLevVOdGFtDMADYp/ULYLyvV8lI0gUkVDhsldCj6equsyHm9:tV0fZkT5LevVOdweADYpIvimUCXCWqQc
TLSH
T15242BE05E8751A11C406E43C8A1A155E2C0E845AEFDFBEC900DC6B24DCCFF6A4B6E1EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VsDevCmd.Core.WinSdk.931E5FB2085AB20B06A4\payload.vsix
Size 14KB
SHA256 4ae171de299bd6ce15536a147359e43c39c53f0984a3f0506974fa3fa54bd080
MD5 4058aa0d377b036093def61debba3322
SHA1 24f88019f76bae259be0f5a9d496bc24e1048886
SHA512 bece076b4586f1a74b24bd9a04d56981307951b6f641d623aa436ab8f99dcafb79637016d2a189b80e0902e2f5257195ae46610c297f1d83be4a2122afb62f07
SSDEEP 384:9ROoXr9HQ+YcquThWtBwKpe+R2GS4TZuJ/1IzRSQRUE:nJRHbYtuTAvwTkTTxOE
TLSH
T12762AF744E7E08B5EB45A87A56471C0D508BB50334C19AE32E4EBE8D262CDE917534FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VsDevCmd.Ext.NetFxSdk.5718F6F07B997AE0458A\payload.vsix
Size 12KB
SHA256 07435410639f9a8243d161e8b7a5265c2cfa1bd7194698deb3210610f2d55054
MD5 218ef4546fd6c06ba7f9300a5e10a912
SHA1 98cc2d82db4d5ab68e4ce4a5337f4633197e8ede
SHA512 a6ef4cc75cb7334c224cf8f78ec531afa124eef76c902f218df52bf28923cac88a2679063c3db2324530f7fce0eef7f7919760d09eada19c1bc78937a5825b05
SSDEEP 192:UIlvdOQwRNTgd2XmPkF0w9HUWU/4nQm/CNPvUVOymkau5gvcn72r6iWOSQR1uX:9lVNvd9Pg0wVqAQm/SPv0O0gvcouhQRS
TLSH
T1D742BF74761103F6C689EF3A40A3D501D40EC607A472EA90F2A173EE8AD8BE55B611FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.VsWebProtocolSelector.Msi.msi

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VsWebProtocolSelector.Msi.86993880CEB8BE6CAC14\Microsoft.VisualStudio.VsWebProtocolSelector.Msi.msi
Size 224KB
SHA256 ba48b21e61aeed88aebf02edacd64aee32876e050c6b83844583e5a6733bdf17
MD5 77b953fe960f3e5e84e6f3ac9b98cce6
SHA1 d95255805bde3d9b4c8f13b19128c65b66063df2
SHA512 65bf18a1ba8d81c16070c15367ef9c438eb45cdd7990a55c08fc784aaeba978decfb2d4b1279de6b915b33cc9e0e0467758948e5e3be43ee909c72df0e8f35ec
SSDEEP 3072:fJvi4iurkdIjcEAJS6c1lwiTVUQRwKs4vq7ry1wcw07x8y5miD:hvFOEAJtc1qWyg+Iwlax8Kd
TLSH
T1A7249D01B080C036C9BE16754978CAB26F3D7D504F6099DF6398BEAE2D343C19B77A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab1.cab

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.VsWebProtocolSelector.Msi.86993880CEB8BE6CAC14\cab1.cab
Size 299KB
SHA256 9a152e7554eac2006ed742cd8420b55da5682d1324c59f8e602f58bdbbc10e34
MD5 5f2edf6530b8fc214af4c663db8e4dbc
SHA1 01c18ab4934b86d382abdee194b0654a1cd3c505
SHA512 20aeaca0843b6abf6ceba7e46b889a11c8e1a616843f79ed33ee6328a4d93fee3bc3dfb4d4692dbe6f7d82ad1fe15e9a0d5226e7bf44cbe5ee2f1d16729b0e78
SSDEEP 6144:++vEz/NObaw+JOOL9a2VhuVUsCXGXrNdmGTwLPCU1E1p+0xfND:+nTobaw+JR9a2VhuVUBGXLmGTwzru1p3
TLSH
T13E642367C9382583AC387D04E638DB76A89E5BD4164F8977C2419CFD862B3EDD774220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.WPF.Internal.x64.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.WPF.Internal.0FC1653F600E5BE98DF0\Microsoft.VisualStudio.WPF.Internal.x64.vsix
Size 10.4MB
SHA256 a2713c63dfd05ff8e7a86a19aa164b7b4bf98daf616ec7bb8b416bf4cc87ab58
MD5 6438a656d64482591f5acc3dd72dc8ff
SHA1 e1b943f1338bbf615c7ae4835afb95a3a25e80d5
SHA512 c2c1529e5eb81170277648b062fc82ead29aa82efde79aabe19f1384202abe826482f2e90170bd335027d850d3eef7a0142afa96312e2de7de06b50887d2f955
SSDEEP 196608:jdDPRWHsRFR4xMUBjhN07gj6MC8Mv9C3HA/pg0cuRpcD1UP2Ag7pQVo:RDfclBjj07F8MkpJOcZUPN2pQVo
TLSH
T1C7B633AD9992BDD8DDBC0D3A4C4F199E557BC96A14E243D5438AC047FCB038F3906A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Web.Azure.Common.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.Web.Azure.Common.30CEBCFC2B3E6850FA3E\Microsoft.VisualStudio.Web.Azure.Common.vsix
Size 876KB
SHA256 40c3ce689262a0dbac4ad9284783355971e0bc16968531053054cf9ba15be077
MD5 417d2b8c4d0cbbdeddfcfbc0225c6cbb
SHA1 dd62d14e1ccf4e16fa008d2a8d3b767c776e8fef
SHA512 af089eecafc8d5ab2799638a36d8ed45224c57eca71c00be41d00b71031ac91b778bd528aa2175021e39d4fac403d9706ebc59f35735817ea883c3a842e62cb8
SSDEEP 24576:0MIuWMTLbNtfezburPNeQf1KOIeZTp4+g3iyoTH:0MUMTLbNYburPNeQf1KO/ZTC1wTH
TLSH
T1E6152338ACE759C9DA0BDB7063A69AB647CC082AB084EE37176DCB174A53770B350D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.WebSiteProject.DTE.30C86D653186141401A3\payload.vsix
Size 56KB
SHA256 1555a4de82f70d04a610c1ad24161b53f1ec0276f80d37deaca7dffcf9c208bb
MD5 a9d3b75798702dc1cf2f1c3320c38953
SHA1 8823b3b17825ac1614f610337b6bc482b246ef33
SHA512 b5901fda05be9b79a61255fcf844bd2bd7a6deb0fe248d0f30712792c8baf4a0e391c4ceaa5d75f86a379108dbe22eab4da57b15b827b11809ca1492fa919f5f
SSDEEP 1536:NoPyR22iNxcZ0UbYxKGFD6v3TquStb/0vI4sZz:+PY2d2bYjFDS7mb/0vI4oz
TLSH
T182430246055F8113E8966D3E25ACB00E7A0BA145BA18D9D007D1B82D449CFEF6377BFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.WhatsNew.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.VisualStudio.WhatsNew.86FB07AFAE2B987C6B2C\Microsoft.VisualStudio.WhatsNew.vsix
Size 3.5MB
SHA256 2d50d3380d86808fecaf0c996d1a51359d51b369df811633bbf846ff61c9b7f3
MD5 9a176bf2abc4854f604159068fe51537
SHA1 910b45b6543f22e4aad656de4c70eb662b7f1560
SHA512 a90fd03fb833de7615e2b6466ffc4e7e6109c1100dadf3449e2c6bf89cca32c21bf45f1fc493b5f3f8d350ca765c4f469bbd5369e52ac2fd8dc7ee3bd0c28ab6
SSDEEP 98304:iEGT/Y1m3cl/4AFAGNj7P05xCcILoxxk7T0w2suD:TS/YU6N7aCsyT0wNuD
TLSH
T15BF523344EFF1E54CE54ED71E9C1345293CD871DBD00FF265A6A39DA88E4B08BA260B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WebTools.DotNet.Core.ItemTemplates.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.WebTools.DotNet.Core.ItemTemplates.8CF1EF19B0411C425046\Microsoft.WebTools.DotNet.Core.ItemTemplates.vsix
Size 14KB
SHA256 fcae66613eb3ac87394a76a70403ba9cde14508cdcb0f346322e7546441254e6
MD5 b74e250a721067cbc429f29989b8af8f
SHA1 934393d4e0d61194030ed7b38d15c697e8f8debf
SHA512 e06adbdfdfe0613a620c9856c83ef88f0f4082f072bec442a8b025340d30b3d3584534b74fc0d9f1136cfc44dc97abe38029ef1574cce29462e14cbe0d885c95
SSDEEP 384:QDi4lYFwY502eYNs1tobfrCqI9snBAM4jr07CsMaN:QDi4lYFwY5npOUbDLIanZ4jr07CsMaN
TLSH
T1E1629D62C87CCB91C55BE53946D1A103AEFA4287B9437F100ACE279D64E6F90332A5DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WebTools.Languages.Shared.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.WebTools.Languages.Shared.CC1BA5BE711ACE3CD5C6\Microsoft.WebTools.Languages.Shared.vsix
Size 14KB
SHA256 eb308326841aabfc377b9568437f69f0670f253665c5a41552cdc970aea9ac8e
MD5 c50354b2a9575b756dc210d8a898e998
SHA1 a3aa413ebf65405a692e72eb75be3d1b24b209aa
SHA512 e08f5768043d6bdff73f99c43fd0d947f1858609aa9eaef4bca1f53a05a7d4ca20189249ebff1f502cfd2856e6483fc11e7d18c2bed769b7f0c57062d3477500
SSDEEP 384:UKN9fd7o+8V4iPNsNZplpvYmrc5QSqimEICxp:UKNddCrMplpQKbimyb
TLSH
T18362C0386D9F34B5C609877152F64852C87046EF0790EA6FFB370694E4AF6B01BD6E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WebTools.Shared.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\Microsoft.WebTools.Shared.BA6FC3BFD7B517AAD5A5\Microsoft.WebTools.Shared.vsix
Size 1.2MB
SHA256 f796657782afb00e6c736cd3427a1400984bb32ffc9d142e3a0cdd9ed44e0d31
MD5 05fa0801287a500d44e1d93cbad66878
SHA1 fcab372b5d5377ad0882626114874e4d38accbbc
SHA512 bb95cf5dd84d6f6c3bcec4f3ab592ca8d45c21130b29367b5d8a7c801df99a949771ff9dfcb1f8585aa8b9e77518271468403394a2fb6d52fdc3b7ce08116192
SSDEEP 24576:jd4XcNbJnTCBkeTcEFla7f4I9g530q8sixiGw1VcGedt2T4U0nFx2C:j4cNbMBRwEF87QIq8BOVU32MpFx2C
TLSH
T1F155E12FDAA99693C42EB53BCBCA7016DAA86FC77140FE0635DCF10945DE340763A246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\SQLitePCLRaw.50802A466CE0CFF0BC8C\payload.vsix
Size 122KB
SHA256 24c33287d68eb4a7b5526f814c22a085fb97a94c8d3bf9883be7b667d1408144
MD5 512ff3b45ca9360bb75ad34d6135268e
SHA1 d26260428beb4d0cba771934c8db9e110524b71c
SHA512 e894c92f5a139ea1c433509bee652c4c1012ffc93a4649ba8cee66090e02331c2af8248f68f9655610bc416d916b010a6f3f343eff0b74f53bfcf579d6cbea4a
SSDEEP 3072:nheqlQeHSKhg1PyK1ClGRZac5RTXFbYEi+MFtKxH3faim:nmSSKhcPz5RUc5RT1bnM7KJva1
TLSH
T1D2C312EFE094AEC0E4856CF36C3DF747E8906A6C41578C1296F89AC3AC54E93270997D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLitePCLRaw.x64.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\SQLitePCLRaw.Targeted.872412FD8A67492D8697\SQLitePCLRaw.x64.vsix
Size 2.3MB
SHA256 4d2687e00265982b716b11f649fbe7415f94a3972cb6bc290cb5474b7a8c7a03
MD5 7c770df753390e1c3d5b13fc1bfd1bd2
SHA1 9ec681fca0e128eff391ab3d6ad0ce166b77c631
SHA512 95879a22053199dc9918d92c61d8bf8bc22494403e9201305bcf2b44d20f7dd0c165a8353b117e3cc9d26bad16e7da07cc53040c95c3427b761afe2d376d4596
SSDEEP 49152:wKjvDUyn0rmI1Yu8qVFs9iIDSKjvDUyn0rmI1Yu8qVFs9iIDY:wM28kExSM28kExY
TLSH
T147B533459CAB3AF1F510CD92C62E8885629F6335B24221F07C9292793DFB7654FF3A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config_devenv.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\devenv_groupconfig.26F61705E9C62F59B8E7\config_devenv.vsix
Size 10KB
SHA256 9ebd42d70013d686689a43ca26a1adfc4be84d1e02a933cb229dd64ae7895f3f
MD5 2abae5380e0e7b3d9c154df8f082040e
SHA1 7cf59d677b268cffc7736874bba6fe512c6ea2f1
SHA512 0eebdd66c9d4574ce09da937721a052ae58fbb8e5ed4b07818c7ac120c962936eeb6e1c928862eb89420a0f514a09b6197bb1cc8ff1040199595f4142c20502a
SSDEEP 192:kl/dvU/rVcCJhtvnD90HCHrffYjdCzTfqYJ12zSKN2siQpcB31yq2J1E6pbJDl0T:kTU/rzt7qHCHjfYjd+ogQ031yq2J1lpu
TLSH
T1ED32A0179B3BC9D9C9041CB495E338366105D601B0E4CACBA198FB8E66916F34F1E2EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config_devhub_DotNetCurrent.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\devhub_dotnetcurrent_groupconfig.AB8CEF20B12CAA22FCDC\config_devhub_DotNetCurrent.vsix
Size 11KB
SHA256 ef93d2e0a1f3c29aefca4c265a2b2c01081dcb4469369b66247cc20408ad92e3
MD5 832fe383778b106c0e3a619cf2515c0a
SHA1 4e41aa10a056777e063b6818658e2eac634f6f03
SHA512 a13a6d71dc6bcffc8c37648b2c480331996ee9d74be8c70c766aea22ce0c421e3cf76fe1bd185be9f2b1283face675c540347192b44d0c150382130776e0f0f7
SSDEEP 192:iFMu+sSEWDgXPF3/JCqbh+3J6gXum3lCLmvgwIvUmc2ezu4mUWVfKhPtEJzYSW26:jEW8Xd34Wc3J6gXuEE6ofM37dd1WW2B8
TLSH
T1F5327D06C156A5ABCD075D3A98677423C213C787609194026FB43BADEAC8874DB2F9FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config_devhub_DotNetPrevious.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\devhub_dotnetprevious_groupconfig.B8AA6B82FF5613442BEF\config_devhub_DotNetPrevious.vsix
Size 11KB
SHA256 34169a6326b2bf6d5bd491612f2fbd25ee33258c88f0bb324190a9c7622f3ea9
MD5 c7ead40ab6278e7099e11c86516fcf23
SHA1 6d9313f49b4540f7812b13ae7aeaad155017bd58
SHA512 d85f13e86d09865bef7c018187bdd2f9e9cb61577de521dc1dc1a2899dee2323424cc76aee5659abf980bff1b8f8a3ea94c3c5ddb7966b09903137f129baca93
SSDEEP 192:1DJvUP4VyQmiQsqzZBGH/mNbcW/vYVSpiUVVJ+A4AiSTxjpZsxG1JT6enqqqYW2p:1LzzziZBGEbcW/wII3t4G81dGYW2CYJ
TLSH
T14C328D1CDAA02AB6D012A179CDB56303D315475BF0D6820EBEE01B4649C6C625B2FF3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.bcl.asyncinterfaces_10.0.8_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\microsoft.bcl.asyncinterfaces_10.0.8_netfx.666B9A93BE0D2322A482\microsoft.bcl.asyncinterfaces_10.0.8_netfx.vsix
Size 25KB
SHA256 44c1110aa9e0d9d53877f5c33a489862cb56992a034335343fcbbafb7493f9d4
MD5 759c9220e7cde58dd6bd0112035bac61
SHA1 744956961510acfa11b90d0691a6fc1ac992d9f0
SHA512 6fcee4c85a553b8c7e8ec47b74bb914ee7977bbef8aa6d15aac9875294e9a2cbcb973838421d62d756c9c4e234b7a4d8efc131ebc3c056e15f6a5cb1f971157a
SSDEEP 384:I/vGe5fUwI24Xw6VcpILHObM9I0a6xNVzSmOilX+Iim4uCKBPQpFSll7:I/vGey24Xw7oHOHkNVOfm41KBPr
TLSH
T1A7B2D01CBFBB7480D215BBBA935374B30B059DA224CAA480564632F11E09E154FABBFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.bcl.timeprovider_8.0.1_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\microsoft.bcl.timeprovider_8.0.1_netfx.C367BB4D8FC1FBC8DDE0\microsoft.bcl.timeprovider_8.0.1_netfx.vsix
Size 27KB
SHA256 bd98c82f2fd1c0e021425b871e2fedb037d192565d910ee3cb9b121a087b1c17
MD5 4d5619d323126d852fdc2517e7d32de6
SHA1 d83cd35b60563ec9af2adc825a9a084daccc871c
SHA512 02b14b3003cd662b30c962cf8feb60ec37be1d7fea24916706c1baa79f16fe78c24d88b8cdd30fbe320da67aaa02a960d4806469513276a6733e87fa319ce5a0
SSDEEP 768:B9OwzpUqZ+O47TMCMsRAB65uXnNu0g2/y8vd:B9hzWK+ORgV5u3Ngoy8vd
TLSH
T171C2E128DBA302F2E86C1D33DB9166A24406628E17FA6508A1DAA74D7B450447E774FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.extensions.dependencyinjection.abstractions_10.0.8_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\microsoft.extensions.dependencyinjection.abstractions_10.0.8_netfx.F51FDB2F9AB81A49EED6\microsoft.extensions.dependencyinjection.abstractions_10.0.8_netfx.vsix
Size 38KB
SHA256 df5ca4b8d2116d3f2a7a586d0e372099b941f5029d6f07786983b9e4a10affe7
MD5 1e019ca52065bd91a832a60b8272c03d
SHA1 f84ddd0146e3263eced27f7fb7f28ebb9f68e65f
SHA512 3c1d276dc3d4b491f66d509174ddc3265288b2dfd7af4e98c01b52b09dcf000cc3a427cb661938747104cfd328c3e67f88738f4beb47fc4027efbea1621b82d1
SSDEEP 768:iqA+mgDPC5FJYEx3xWiE44xDXNHIJFCAr5zpDI17tNarlFKF57PNA9OBD3GuM:i6OFiExPp45XNHIn5VzpDWyCLNA9Op2R
TLSH
T1F403F12577997713D75004701F622913F63D286A3178D8D9E9783E4CCB893D0AAAF64E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.extensions.logging.abstractions_10.0.8_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\microsoft.extensions.logging.abstractions_10.0.8_netfx.8B0EB99EC80E273C7B60\microsoft.extensions.logging.abstractions_10.0.8_netfx.vsix
Size 42KB
SHA256 86597b4b37e37b0e7366d4d1d479a6b30620135ee199cfbcecc356c00ec41c73
MD5 d3715566afd1c38a5b22fe96c0db25ac
SHA1 647a40bb764bca6d20cd60f2f57a176d136253fb
SHA512 a1982cd3fe03817b1ddaf54ccca91a1587fe66ffa1c3483c7b07ee6ddaeaa96fe9ee91cc40918b005434e412feecc2b530866add5abeb208208fa0bda7366c70
SSDEEP 768:vqCuWUxaZk24aGs4/h3B+2w8+4KSLX9GGVmwYMenQx1FFkPvo7I5aLmj2KbtDPu5:vqCuWUxa+5J59w8Y6TVm2tkQLmpxDU
TLSH
T1991301F9B4639025D11646F2AE403D16346D9EF320A8E8C35AB17363DAE5D036337E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.identitymodel.abstractions_8.15.0_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\microsoft.identitymodel.abstractions_8.15.0_netfx.6A8691F3C35B7E3CF81C\microsoft.identitymodel.abstractions_8.15.0_netfx.vsix
Size 21KB
SHA256 a1287cccf9db87f58e08fc18e4c8261658abb928a04837dfffbd06777d455d92
MD5 2a1740749be0b293d80f74c5b51133db
SHA1 c72539eba4b7d3e53dede4c6624c2edddf3a6620
SHA512 5a409ab3e1c091199dd8b1608b107b7556ec79e9b966b4f4168b27135b88502df1d6b2daab0a71bd10c5a39971020c7de52755c6ea3dd48d37e7010ef6e60c0d
SSDEEP 384:9ewpL4VDXjzF/Ozi901D+LKE0kKyROJ8l3SpFnHvxw/EgB:xLYXP9O+LKBk5sy3EFHZS/
TLSH
T1CAA2D11E9621E0D0C58699709B1BAF53B5C3D3F1308512061AD8DF9C9B89FE42B3B979
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.identitymodel.jsonwebtokens_8.15.0_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\microsoft.identitymodel.jsonwebtokens_8.15.0_netfx.0D14D515EDBF57BCAB70\microsoft.identitymodel.jsonwebtokens_8.15.0_netfx.vsix
Size 69KB
SHA256 5ed9b8452b07613b8ad2c3dd68b8f1266ad90d7d2e62c5b455aa51082dd58758
MD5 686511731e7c95f7ad214e1bc928af79
SHA1 40d3194742ffd7febfb39699820337116281c24c
SHA512 b7f7d2751423f017231c21c5f85c0fffa075fab4ff3483e0b2e077190a18cc34c4a18093a2929bd7b92197f969e0f76de40b4f644109f962c8715c93acf26dbd
SSDEEP 1536:tyKOc0utpam2fzZBoPqnXdNrvf1zDgX8PTzTZLVXkrLKCAyNlD+NTDZ:tdAmKYPqNNrntDgX2TzVLZkaYNyZ
TLSH
T1BB6302944C81B6F0E1451A756EE7A9B069848DEB60C28A450F782BB00371FC1BF6ED7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.identitymodel.logging_8.15.0_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\microsoft.identitymodel.logging_8.15.0_netfx.5FDD7C41892F83ED4444\microsoft.identitymodel.logging_8.15.0_netfx.vsix
Size 28KB
SHA256 a1fae128b1f4ec16e210bc2f3ac228e4d5748ec010c27e89cac1c9b7285e1006
MD5 cd4a03fbb1795d2b6b0b4120bcb8d8f2
SHA1 a060e8b0466253edd90f7e7c1e6cb7a4a070f8dd
SHA512 ff83721d120eea37f314fc43b94598ae6e48178db4c698d0a42a124ede3918ad127799e0ddb7c2c5caab5d0badebd3d538789985a9f35e52b9537c514330c235
SSDEEP 768:PapXhhFyxltQTFps/FgdqyTbf1O7DbEKu:y9iMTFa2dBEXBu
TLSH
T135D2E05CDA33D6E0F081A67D56C38435510A81CBCAB2C1A33F781A5D5CEE3E297A366D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.identitymodel.tokens_8.15.0_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\microsoft.identitymodel.tokens_8.15.0_netfx.546E2D350CDCCFCC2B78\microsoft.identitymodel.tokens_8.15.0_netfx.vsix
Size 131KB
SHA256 a00c8589add0759a2dcf1a0c8fb06690f0f3d1eb37c9c39efcfd055458e1fe63
MD5 b259a03d739bbe85afcc67eb7d315b29
SHA1 d66f79e9d41d899e0c194b4eb0eb21281d014acc
SHA512 346cbb03abd70a56df1a38f3401c63b0c8f7b68ff9ecd6928861b86be30516cfab097cca7f62dfb48dc24b60ac1ec5cc7c6a5e848e2e3ad7e1280e606fc317ec
SSDEEP 3072:IHGfN8sLnvhZBeJfWru4KtS7yXBJdPQBojrr4p4di4sAc6:IqtvhZBUfCnKtyorzdFt1
TLSH
T100D3125E8E384060E385FAF98542A63B60CE47FB6DD2269554A00340F54B47BF2A77BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.visualstudio.remotecontrol_16.3.52_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\microsoft.visualstudio.remotecontrol_16.3.52_netfx.6AA216FA1EC390DDD4C9\microsoft.visualstudio.remotecontrol_16.3.52_netfx.vsix
Size 32KB
SHA256 bc33ab4e835a9d5bdc659a025009df5f17d20bab9546b226decb62d9359d4463
MD5 9666e491bdbe8051272fa84ac4f88fde
SHA1 6e8b0004bb96b685f6fd689743b8337ccf121b09
SHA512 bcbdc71a85e2ef6f6cd10bd6c6772379a0439ba1dc523115fa356d1d1b608653119db30caae9878df5a7e3f6945f918b372a0ad2bce9f6d6e19914c9aa526c39
SSDEEP 768:gPyg4gQq5XYnR94Lbi3MZHy9XiFJmW85oWditlWSmbidDjcRsoha:gPT/QuYR9XYS9yDmboWEvFm0DjcRk
TLSH
T1FCE2E1BBDB652370C7235835B94F99424E893B57EA7D7DC32A0437560F08A821331AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.visualstudio.utilities.internal_16.3.90_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\microsoft.visualstudio.utilities.internal_16.3.90_netfx.D07700A3B1FD205DB97F\microsoft.visualstudio.utilities.internal_16.3.90_netfx.vsix
Size 40KB
SHA256 321ebe5bdee5dfd0bee5526cd60c9831131f834f688fa24099620e8b7429b44b
MD5 d7cc87613e2610d19d226025dfc56569
SHA1 8dc3d812bfa036126d06a7a7e0014309fb40187b
SHA512 f3dcd25b9b9ddbd253e9a9665e194998ebd4d27d41dbb542c4ca90752ab05ba38cc7c18706d43f1ea4c25e81e2623e8b66ee4b930763a49d4f9bffd9dbe2fce7
SSDEEP 768:1LJeoGLVKHUJDQ6Sag+dTly8BNjCOFpKjZtOhU/mD43LrPteR5mlnQe:1LUHByGDXzBpCLjZS4twuQe
TLSH
T17A03F196E0755479F2AAD17C1219C37B985C0395BA6F43C22565CB43CECFA03236CAEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.visualstudio.validation_18.7.1_net10.0.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\microsoft.visualstudio.validation_18.7.1_net10.0.41C503B08C52F80B7E82\microsoft.visualstudio.validation_18.7.1_net10.0.vsix
Size 44KB
SHA256 512b7693f456333b331c8eab637e91c0a5c00567440ba7417086751531ee8898
MD5 5dfe0c34dfe2169b3c85d182fedd1209
SHA1 c65ecd630c02ef223f3dd74480e61df19e149c9f
SHA512 72e3d207e6fa281a67fa2d5e531c6afc977fcab75fddfc0699776ea8a8b78a7a750712225cccdd6baa32e5cad454d224befb82799dde163c7dc793e887efa790
SSDEEP 768:pDPp06nvoLjUNs4ZcosiuR8+rddkxB+qmSki4qYpSvH1T3DES1IdBB/uS3:pDVnwLjUK4SHRddkHNbk4y0JES+dv/u4
TLSH
T18723F247CE09F926D01EFDB693E5280FC568C3409C468B4C528866A7E7D1BC42357D9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.visualstudio.validation_18.7.1_net8.0.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\microsoft.visualstudio.validation_18.7.1_net8.0.A6E063480B9B466A308C\microsoft.visualstudio.validation_18.7.1_net8.0.vsix
Size 44KB
SHA256 cf0437c8b5b09c74035477d7b55201f25a8e7ba5c707a4759d7f54e0e37574c4
MD5 7e7d023967625ca98b9fcfe7f882a17e
SHA1 413b00fcddc0284abf85fd455f5b17dd5a095fac
SHA512 eb2ede18f65dcafe727e15fe81abe62cdd80c766e3995967c35c698ebb59eded9c638114216d19d53c25435ca14af43ba74c647cb0f9bd92844d83f2486a3c56
SSDEEP 768:xJRh3Py/SRR2xt04RxTZtBy+Fa5RQYxfnHj2fPkGWyp8c8PhqRE24z6oXq:th/yMUx/ZtBVYpDbGVp8cVFHo6
TLSH
T16E23E18CDD0B49A1D31B00307297CC794815D6A23CA3D5AE17D89EBF8E09E530BBA5CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.visualstudio.validation_18.7.1_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\microsoft.visualstudio.validation_18.7.1_netfx.072E234C347F24519A88\microsoft.visualstudio.validation_18.7.1_netfx.vsix
Size 32KB
SHA256 ef1d9f51fc18cd35283863d9f7f5f6f2ac8e7c6e7603397cdafdf444211263a0
MD5 a18c066a23b99f42c978dce1808d68f0
SHA1 a286e7eb5a9d1c92a8009ed45da0ec939cf663be
SHA512 ac409f4fc7b177c736a1860ff14b78512f9eb8580acd0d6ee31aeb366eb0b4be1e202703442aebcb0478924201893049b057a42aa6f05afcbeea11f442587779
SSDEEP 768:yZzkyP4Gn4WbuOJDysjRsjh7VXOc+JF42A43a:ebfn4WVJDj+dJO22A4K
TLSH
T174E2E0A559125984C223F53558029407F0A9225798BFE40E40EE7CEE879FFE91BA8CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json_13.0.4_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\newtonsoft.json_13.0.4_netfx.81A88D398EB0D993CB1C\newtonsoft.json_13.0.4_netfx.vsix
Size 273KB
SHA256 ad00074401cd7763d9f49def7069078181324aa1db141c953cdb74fe4c7f3158
MD5 09cc68802b6cd790d54e1c744f876ce7
SHA1 d4b0540f3b075e361a6fbb77aa092b311f7530a6
SHA512 9da496b3de6f44a8c811f6b2bbbe5401b13c125dcca00c2959e865f863e975051e5ba89d9d19fddb14e8e8a0d8217ac34c92fabca8aed9f195942283069d2050
SSDEEP 6144:A5rV4LEP6Z3mv8JUY5rEK8XQqw9LVdyL23g1iDqB3EZ5rI:U4xmGUmj8XQ5gYDqxA5s
TLSH
T1835423C8DCE54602DAB1EF34405F2F272921D5AC4A19747DFACAE38C0B25AE15C45EBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers_4.6.1_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.buffers_4.6.1_netfx.1C2047FF22AB5C3754F2\system.buffers_4.6.1_netfx.vsix
Size 23KB
SHA256 26d3e6859929c3c4d369736d5a9340b5c89a139d840cc4c5d6dac9862ad66e1c
MD5 81ad68a901a9754ec9d967de03d6a403
SHA1 43854cfd8b11396b26d59aceb20f8fe7e61e5d97
SHA512 cc57c7d2d7f5df4f1f43ee1126ab98becd5d5ef0638682df83c5c58984cdcee503fd71250c81de4f5f05ff16a53e2930b19250e6e054f106b6f0a3ce16eea333
SSDEEP 384:Fy1TGJKNhemwGitU9XTHk89CXb8TE7d/Hd0OpZJ6mbc4Dilk1w+OSQozYrw:Fwic9kUFTCITedDpbc4+uwBa
TLSH
T1FAB2C06D49322350C81051387AC754B3C6E5C3F0E497A5FA7AB47F6B915EC83B6222FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.collections.immutable_10.0.8_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.collections.immutable_10.0.8_netfx.E009CC322ED3803B0C2A\system.collections.immutable_10.0.8_netfx.vsix
Size 112KB
SHA256 274377f777c68e052e95804ed1105136000c94788cf44e3450c37bf259564803
MD5 bedf52c0ff06c11b8141de1b71848a38
SHA1 f41f72b51072b2ab322d8e501bf3654fe592e862
SHA512 d0a1728661c921acba19582b3d1b5fa1bb0574a8225d264f6abff11a121d9588d757cd5b705e1cd140f699fdc1b6e15b3f7e84e692a223f4092b17d18bc3f956
SSDEEP 3072:92ZUpqVog9y3hWLW+6GH64ZrRJAQxmAJBo:9+UpUTy3htg3ZNHJBo
TLSH
T127B31266642C94DDCCB2FBFCD671E0E99918C989E2F374222C1CDBC46C9150FA64F4A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.diagnostics.diagnosticsource_10.0.8_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.diagnostics.diagnosticsource_10.0.8_netfx.399BF957C3C6C17D911D\system.diagnostics.diagnosticsource_10.0.8_netfx.vsix
Size 104KB
SHA256 38b030b94be883d3dfd5070a9afa1af272c36f964fed3b6181aad17ef9b35f9a
MD5 37373593e2dd1e2324924446a2a51114
SHA1 b3e8e7b603086ac9b8c4ff60a7bad289ada454ce
SHA512 3c9988c42db41a27ca367c6c87ea57b37576c1a205d2a9d50d8fb67b2f389c1278a28c21efc4e501196d2773b727c7782f96345a90e6342e18349c4938bbed58
SSDEEP 1536:sTNBtdSjCUIoqFnPdMxZcLuWZmvEwSTC0h3iPcZJvmhbqndURDWZ1tcK4UKT1HI:oSq5n8+kEwSB4AZndU/K4UKT1o
TLSH
T17AA31283C8D85516D89C67FEBF01B60777CCC9804CE4E851C71985CB8B56B219CBB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.identitymodel.tokens.jwt_8.15.0_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.identitymodel.tokens.jwt_8.15.0_netfx.06DCD18A8E868777EB96\system.identitymodel.tokens.jwt_8.15.0_netfx.vsix
Size 47KB
SHA256 fe8543d7e0a1fee2f6f683fd70f881c488b2bfde8c46450969fea4b7e2c587c5
MD5 f504706574cad0f995e9cd7e39e1d577
SHA1 7a2b0f72ded41cfd820a56b817ac5b04f2700f8b
SHA512 24150e7a5f6cc62aa832b9dbcd0214a249b800990aa5fe1221c026b8d6e987825ab8bdcd09b232501072009209ec4195b176bb7e8b35c87118509f5f618c626e
SSDEEP 768:ye6O+7IN9W0qD9n9Gn1lNi3AErCYCpYNnjQ26ZNMNb/eESvL9o9HmNlKr31T4RUM:8IN9W0qD90DNi3AErC/Cdj76ZbESz9ok
TLSH
T1D323011916EA06DCFE83D774E2A12D1BCAD5D6132CA22A0531D4DB4D0CC7C1F1D699AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.io.pipelines_10.0.8_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.io.pipelines_10.0.8_netfx.45E5FB1603421AC6E751\system.io.pipelines_10.0.8_netfx.vsix
Size 49KB
SHA256 dc570c0d5b54346f2e6d7871bd73d2b88e475653b5983931c13446a81580b54b
MD5 e41e8ccaaa07a0ea17254ae29a9af461
SHA1 932456e9174ca079992e20e285c7eef0c61dce94
SHA512 bbd66582ae714014ba248e822219e2d6649fd2093b32ff26a2207dfbf566a21f3b78391ebc093f5dcd31bc3c113193f8feb5edff93f3d465f24201e16f2ceec1
SSDEEP 1536:ZVh31TSoGhrpngyzJHJHRKPwmyhMNkbKWYI896Wk:nh39wLngyzJpH0PwBhMNwK98
TLSH
T19233022A91C1E482DED0F939451BA963D400C60ED0CB7C1FD5C90B556BA8E2A57C7BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.memory_4.6.3_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.memory_4.6.3_netfx.814EDDD5D3BB0423F042\system.memory_4.6.3_netfx.vsix
Size 69KB
SHA256 e22261a9a7444995c8ac24bfb64707532da0a9c3ddc17200791705006b4283ec
MD5 995f9c36b7027ca79ab17539a938c679
SHA1 23d7aa1695ec6ba65475e66c2607992e4775f70e
SHA512 682d65186a46c84a519403e51625502682d137844fbb46fcd06c3d3634632af75e640812138d8219987dde88906eb4dd46d2e4839498a09ac56ba5c4b0911dca
SSDEEP 1536:E317U34VUia5bnsMNxXvFAb0A/Sm0zKRDS3tczXKBoV2ItBaw6:Ag4ii4tbvnRzKRMO2qZkL
TLSH
T15663121A4B51FCC2FA14DA3527271C016A0DEA52124B5C559C167CDD67583B20382FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.numerics.vectors_4.6.1_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.numerics.vectors_4.6.1_netfx.E95931F98FED8679CE47\system.numerics.vectors_4.6.1_netfx.vsix
Size 39KB
SHA256 02da463d254de58f4bd5e73ed012ae12a45b0594b8728640b05bea72a7d6e549
MD5 0a019fadd160c90364057fb9353e6057
SHA1 9353c1d624cf3b47b838ae1e8c83cdb3e53b44c3
SHA512 6ecd0654b305af3622c0ab8321ee9a9c7629e1c00a7cd270b369b98f9b3cfd8951b120efbf927791afbd7934e7e50ae10ffc1e7923d778cbcc4262ccbb11c4e1
SSDEEP 768:Fq4p63ZxQdXYsgRwja/DzpPfqHv6k383Yblwu9VvvMAagtL90Y2:FqqDja/PdiN3sQ1VvUAnxuY2
TLSH
T1C203E1A10664C482E38B5AB35506AD12CA1DF3C9D0426F258E3827F5665B507CFE72FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.reflection.metadata_10.0.8_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.reflection.metadata_10.0.8_netfx.A1896F9F0EDA58F853FA\system.reflection.metadata_10.0.8_netfx.vsix
Size 208KB
SHA256 fcf724f9e2de3a0d185ea01152d08b63f9c5cec69bad613b0ad4c4478df98f34
MD5 3a2f0eaa449c98e3b480d44acae2acb7
SHA1 e2d38f1d4c85c2cf8bbe950a7efab86bb64a87cf
SHA512 9326ba9ec384a5f48eceb4ae94cdae88808bab7e96730af0333e017e0917684b609f7e2c8790134ae89fe88872c1af5024f2db71b50b4d3811781d564b21395f
SSDEEP 6144:T9VobpQcA0JRwt7idSfeVnKOtaQF8/abcnlV:T9VyKcLy4dSKKO6aof
TLSH
T1D22423E7BD855DF1C2FB913DAE56BEDAA248980EE0CB4C2425F26C437001A978BD91D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.reflection.metadataloadcontext_10.0.8_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.reflection.metadataloadcontext_10.0.8_netfx.DF2F0DBA6D5212889995\system.reflection.metadataloadcontext_10.0.8_netfx.vsix
Size 119KB
SHA256 b3641227ed42446a08ae45c28969306cb384d9e4db53b8d82874f23dad0070ae
MD5 0e15eebb67ed9f9f25b9a47d2310eddb
SHA1 5f5cfdf3e0f4da62aada93701a5f45f4f45c285d
SHA512 8b6d2f9e9f95af97ebad150ac8299d913a64321bfebaea3d67bd3e972e25a1b582b11afc835a1b280d8188ccaebd5150d03e839f171bbf503ad0f5fe44e6b9ad
SSDEEP 3072:IBKBIVgE/doam8yiY0nm+QP2FrOMyr/Tx24TX00lPMc:IB/Vf/OamZiYSm+QyO7J24v5
TLSH
T199C3122F4D74FBFBD007E43E49FE10328252870924B5954D611EA78766ADAECAB0349F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.runtime.compilerservices.unsafe_6.1.2_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.runtime.compilerservices.unsafe_6.1.2_netfx.E466D5281EE41DCBB732\system.runtime.compilerservices.unsafe_6.1.2_netfx.vsix
Size 20KB
SHA256 732ecf17e0faf7b4d7932febd449760ac6e111a73495a5387d9ace89f8c9155b
MD5 9852f485bf75d1d6229c4ff82cd49a48
SHA1 651c4b21c0d2ae02ed033925e1254e329acd3465
SHA512 ce467e143748bed8b73af2dd9c302ffc01b50d7b208c6e5e84ffc379d755d1e84c45d3a5e79100f5eac81d5c876e3a37f0a9756e4a74d6cad43d5c1e77a49501
SSDEEP 384:FPyWSCpGKMMVNfkfaQzo/Eg2L05hX2TgJX21HUF77t:yCkKXfAe2w5Rx+YHt
TLSH
T1C9A2D0884CAD0ED5D50116381A03D8E6566292E9718834C637C82FABEDD1DD74E3B4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.text.encodings.web_10.0.8_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.text.encodings.web_10.0.8_netfx.78B7E3F9F159CFEE4933\system.text.encodings.web_10.0.8_netfx.vsix
Size 47KB
SHA256 5b233ea554fdcd39662836acba56cf249d9574c3efa5b08c459fb12a3f5f3f6b
MD5 661733edfdfe9cfd213c809cc3645c43
SHA1 ca56acf4801eba14d7cd709246c4295ba3e6b53e
SHA512 9080974d3b8260a6acd413fb71ed07912bc7c232389410461ac40d86905d08c10105cc624b98b3f137198660adfab560447c3497fda004308918be381e8d20b0
SSDEEP 768:eXltnxrdSi835ySnaO6T9IK6B2qfT2IKQZSf7exFdTMlbqixgebLphY8FKn7ESy:6rnpMXF6Tef7SKxFdTMlbbgWLphY4Sy
TLSH
T1E923F1A4EB204591D455A7FE4D44A881D40CC4CB2B83F90378C63F86475E6B39A86FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.text.json_10.0.8_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.text.json_10.0.8_netfx.B0B0E53423313B618C0A\system.text.json_10.0.8_netfx.vsix
Size 275KB
SHA256 0301e879ee312c09bbc96d32a26c3e07647f87b249fcc212936ab18c8063c527
MD5 421c7daaa595c9ff40564cefe3e64090
SHA1 58fc59477f03d62e648325778997908192634f59
SHA512 a44f800d2da87fefd1b7f18f581e9f1950bb280fb9949caae1640d9fda85cd8404c97a38c29905b468f489949e1b7de189e073b3a7c1115bb5a7e9f99dd7103f
SSDEEP 6144:cy2Znp1J+efUdviWfQNArL+2Bxga0uiBaFACGNtDTbKd3kr7quwsZUml6ihvENkq:cy2X+NvtfQNwS2Bxr03BaFAxTd7hKk6r
TLSH
T18054234C3C7202BBC57E91F40C9158140F969F7037A754834AB65FF5A8ABA4EB78C263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.threading.channels_10.0.8_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.threading.channels_10.0.8_netfx.2D761CC012623AD1362F\system.threading.channels_10.0.8_netfx.vsix
Size 48KB
SHA256 cfb6f2977ff48fe3985b286727afe9cfafab6432346e4cdf4d4013b391b90236
MD5 da7d70ce09a8dfe86d1c0137eb67e3ee
SHA1 ce159eb24fd47f95b3da7902782b673ce1043ce3
SHA512 30d16fa706846f1eb380ab38d379759dab0ab5e94710edb4bbb2b0afa2eef465453ef303378da764b322f077c44034c2827c88fd95bfdca73ca78ff2c1a7b6c5
SSDEEP 1536:aG974XijVe+i2CGitdDezxQcck9bsDVxPm:/9YiRXi2CRDlcckKhI
TLSH
T14523F25F4EDD1175CA01F57DDDE5270A1C0F50A584B30E260E20872BA78BF0A26B77AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.threading.tasks.dataflow_10.0.8_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.threading.tasks.dataflow_10.0.8_netfx.E13584F94ADAC8C93D05\system.threading.tasks.dataflow_10.0.8_netfx.vsix
Size 86KB
SHA256 d1be33cc3a27208f70638e52269d9062f9060b187554cae50f72581d74e210ff
MD5 7754819d87ef35c9e63e5b7d6bf163bd
SHA1 69ff3c6f7a0e64f440687daae371dc326a46dfa3
SHA512 7f0ad4194069fa61bfa918bb0f02b7be101a24f218ff4fe8c85fa2697bce02a776bbd6d4686c8c8cdbf05041006b4412bf7ae4a1754bd27d0a5cc43fd03ff5e9
SSDEEP 1536:WqRnVyLZOiTyHfoOkWSnb85HJc4hADZdVzqQlC/wOPM0M+K46E1zFVMI:v8O3HwO8b85pwznl554zbp
TLSH
T1FE930277F4D482F7F2079E345ECE0801C375223B20B27155A64B2A0AF627B763BAD029
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.threading.tasks.extensions_4.6.3_netfx.vsix

Path C:\Users\Admin\AppData\Local\Temp\o3w5nyng\system.threading.tasks.extensions_4.6.3_netfx.538CD51B57D588F4275A\system.threading.tasks.extensions_4.6.3_netfx.vsix
Size 25KB
SHA256 884a8c7fce3d540892dfaf926a1f105cc7454509f7637c8060aa50a9e393b692
MD5 95326fcfc7131d1b0692e152c01a28ed
SHA1 f815c4627fdd150a8d6e64ae05c927990d6c09a2
SHA512 4dd87ef31e3730bd91e4e76fea251a1ba74c5bb6f16b172046c8192e7adeb49bf33e6b7b7deb4819d19cf0f7a2f08f421d8c5d3f8164e56701624f3528bc9c32
SSDEEP 384:13KzRjA8UNoGzKdyvAyD90DkTwYbjIKEGHj5XlVItDEcKIhFZSU2mqoO323/Mg42:wRCPlK0ACXopEcKIhyUJy23kgJ
TLSH
T1FCB2D0210B11A1B1C58382B9466B036F554D43B970E1BBF120D57FCB9CE2BC65FAAA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TBRSourceCode.zip

Path C:\Users\Admin\Downloads\TBRSourceCode.zip
Size 118KB
SHA256 5851083bc252c43707da26e4a5d0a8c951cf63fe816d602c488116f633f73171
MD5 2776271f4e961782c785adca8cc68986
SHA1 4350ce6cc83722b160604a0c3a4793fef9302b84
SHA512 2190b8cda369ea71af33e31d409156cb0c42e5761c25d93e63fafe3eb7e42be57baef40e974ae7a4557116051a512f2ab98f72a819c36f85cf1ed68b153605e7
SSDEEP 1536:bS03QhYkY25kU7WUMShjcvnp3jpCtaxpuNj6Ax4ZgOnQkntmjFEuTEZJB1so2HYn:b932SUrMeqpTEtaxoNWA2aMtmJEZew
TLSH
T13DC35AF3D340F629DD7EEA7B422F537C3E564E2804916D5A7A0A225033EE090663D96F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/232-2660-0x000001F89C910000-0x000001F89CA96000-memory.dmp

Download

memory/232-2683-0x000001F89D600000-0x000001F89D76E000-memory.dmp

Download

memory/232-3045-0x000001F8A31E0000-0x000001F8A32B4000-memory.dmp

Download

memory/232-2659-0x000001F881FF0000-0x000001F8822FA000-memory.dmp

Download

memory/232-2661-0x000001F89C730000-0x000001F89C7D0000-memory.dmp

Download

memory/232-2662-0x000001F89CAA0000-0x000001F89CB3E000-memory.dmp

Download

memory/232-2663-0x000001F89CC00000-0x000001F89CCB4000-memory.dmp

Download

memory/232-2664-0x000001F89C8D0000-0x000001F89C8F2000-memory.dmp

Download

memory/232-2667-0x000001F89CB40000-0x000001F89CB7C000-memory.dmp

Download

memory/232-2668-0x000001F884020000-0x000001F884050000-memory.dmp

Download

memory/232-2671-0x000001F882730000-0x000001F88273E000-memory.dmp

Download

memory/232-2673-0x000001F89CB80000-0x000001F89CB9A000-memory.dmp

Download

memory/232-2672-0x000001F89CE30000-0x000001F89CF3A000-memory.dmp

Download

memory/232-2674-0x000001F89CBA0000-0x000001F89CBB4000-memory.dmp

Download

memory/232-2989-0x000001F8A2F30000-0x000001F8A2FE4000-memory.dmp

Download

memory/232-2986-0x000001F8A2DA0000-0x000001F8A2DAA000-memory.dmp

Download

memory/232-2985-0x000001F8A2E10000-0x000001F8A2E28000-memory.dmp

Download

memory/232-2982-0x000001F8A2D90000-0x000001F8A2D98000-memory.dmp

Download

memory/232-2983-0x000001F8A2DE0000-0x000001F8A2DEA000-memory.dmp

Download

memory/232-2984-0x000001F8A2E30000-0x000001F8A2E6E000-memory.dmp

Download

memory/232-2675-0x000001F89CCC0000-0x000001F89CCE8000-memory.dmp

Download

memory/232-2980-0x000001F8A2DB0000-0x000001F8A2DD8000-memory.dmp

Download

memory/232-2976-0x000001F8A1BE0000-0x000001F8A1BEA000-memory.dmp

Download

memory/232-2830-0x000001F89C350000-0x000001F89C362000-memory.dmp

Download

memory/232-2824-0x000001F89C300000-0x000001F89C30E000-memory.dmp

Download

memory/232-2823-0x000001F89C310000-0x000001F89C328000-memory.dmp

Download

memory/232-2822-0x000001F89C3E0000-0x000001F89C3E8000-memory.dmp

Download

memory/232-2809-0x000001F89C0A0000-0x000001F89C0A8000-memory.dmp

Download

memory/232-2808-0x000001F89C090000-0x000001F89C098000-memory.dmp

Download

memory/232-2796-0x000001F89C1B0000-0x000001F89C2E6000-memory.dmp

Download

memory/232-2676-0x000001F882750000-0x000001F882758000-memory.dmp

Download

memory/232-2677-0x000001F89CBC0000-0x000001F89CBCC000-memory.dmp

Download

memory/232-2745-0x000001F89FE60000-0x000001F89FE72000-memory.dmp

Download

memory/232-2706-0x000001F89FE40000-0x000001F89FE52000-memory.dmp

Download

memory/232-2707-0x000001F8A0020000-0x000001F8A007E000-memory.dmp

Download

memory/232-2708-0x000001F89FF00000-0x000001F89FF22000-memory.dmp

Download

memory/232-2710-0x000001F89FDF0000-0x000001F89FDFA000-memory.dmp

Download

memory/232-2711-0x000001F89FE80000-0x000001F89FE9E000-memory.dmp

Download

memory/232-2712-0x000001F89FF30000-0x000001F89FF4C000-memory.dmp

Download

memory/232-2713-0x000001F8A01D0000-0x000001F8A02CC000-memory.dmp

Download

memory/232-2709-0x000001F8A0080000-0x000001F8A00D0000-memory.dmp

Download

memory/232-2705-0x000001F89FF90000-0x000001F8A0018000-memory.dmp

Download

memory/232-2703-0x000001F89FEA0000-0x000001F89FEF4000-memory.dmp

Download

memory/232-2701-0x000001F89D830000-0x000001F89D83E000-memory.dmp

Download

memory/232-2700-0x000001F89D870000-0x000001F89D8A8000-memory.dmp

Download

memory/232-2695-0x000001F89CE00000-0x000001F89CE08000-memory.dmp

Download

memory/232-2694-0x000001F89D3E0000-0x000001F89D3EC000-memory.dmp

Download

memory/232-2685-0x000001F89D590000-0x000001F89D5D2000-memory.dmp

Download

memory/232-2684-0x000001F89D770000-0x000001F89D82A000-memory.dmp

Download

memory/232-2678-0x000001F89CBD0000-0x000001F89CBE0000-memory.dmp

Download

memory/232-2681-0x000001F89D400000-0x000001F89D48A000-memory.dmp

Download

memory/232-2680-0x000001F89CD70000-0x000001F89CD7E000-memory.dmp

Download

memory/232-2679-0x000001F89CCF0000-0x000001F89CCF8000-memory.dmp

Download

memory/3188-3049-0x000001F5DD790000-0x000001F5DE251000-memory.dmp

Download

memory/3256-2780-0x000001C879140000-0x000001C87914E000-memory.dmp

Download

memory/3264-3102-0x00000274A9BF0000-0x00000274A9C0C000-memory.dmp

Download

memory/3264-3101-0x00000274A9820000-0x00000274A9850000-memory.dmp

Download

memory/3264-3103-0x00000274A9C30000-0x00000274A9C44000-memory.dmp

Download

memory/3408-2791-0x000001CCE8CA0000-0x000001CCE8CB0000-memory.dmp

Download

memory/4740-3002-0x0000021DFE720000-0x0000021DFE728000-memory.dmp

Download

memory/4740-3001-0x0000021DFE710000-0x0000021DFE71A000-memory.dmp

Download

memory/4740-2993-0x0000021DFF880000-0x0000021DFF89E000-memory.dmp

Download

memory/4740-2992-0x0000021DFF200000-0x0000021DFF208000-memory.dmp

Download

memory/4740-2991-0x0000021DFF190000-0x0000021DFF198000-memory.dmp

Download

memory/4740-2981-0x0000021DFF110000-0x0000021DFF14C000-memory.dmp

Download

memory/5080-3027-0x0000000002720000-0x0000000002756000-memory.dmp

Download

memory/5080-3028-0x0000000005310000-0x0000000005938000-memory.dmp

Download

memory/5080-3031-0x0000000005210000-0x0000000005276000-memory.dmp

Download

memory/5080-3037-0x0000000005A40000-0x0000000005D94000-memory.dmp

Download

memory/5080-3041-0x0000000006040000-0x000000000605E000-memory.dmp

Download

memory/5080-3042-0x00000000065D0000-0x000000000661C000-memory.dmp

Download

memory/5572-1697-0x000000000A810000-0x000000000A81E000-memory.dmp

Download

memory/5572-1675-0x00000000061B0000-0x00000000061D2000-memory.dmp

Download

memory/5572-1701-0x000000000C100000-0x000000000C150000-memory.dmp

Download

memory/5572-1698-0x000000000BCE0000-0x000000000BCE8000-memory.dmp

Download

memory/5572-1763-0x00000000056F0000-0x00000000056FC000-memory.dmp

Download

memory/5572-1696-0x000000000B910000-0x000000000B948000-memory.dmp

Download

memory/5572-1695-0x000000000ABC0000-0x000000000ABC8000-memory.dmp

Download

memory/5572-1684-0x000000000A830000-0x000000000A838000-memory.dmp

Download

memory/5572-1683-0x0000000008090000-0x000000000814A000-memory.dmp

Download

memory/5572-1679-0x0000000007820000-0x0000000007DC4000-memory.dmp

Download

memory/5572-1678-0x00000000071D0000-0x0000000007262000-memory.dmp

Download

memory/5572-1677-0x0000000006FD0000-0x0000000007036000-memory.dmp

Download

memory/5572-1676-0x00000000061E0000-0x0000000006534000-memory.dmp

Download

memory/5572-1702-0x000000000A6E0000-0x000000000A6F2000-memory.dmp

Download

memory/5572-1667-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Download

memory/5572-1662-0x0000000005AE0000-0x0000000005AE8000-memory.dmp

Download

memory/5572-1658-0x0000000005AF0000-0x0000000005B18000-memory.dmp

Download

memory/5572-1654-0x0000000005780000-0x0000000005794000-memory.dmp

Download

memory/5572-1650-0x0000000005B70000-0x0000000005C24000-memory.dmp

Download

memory/5572-1646-0x0000000005550000-0x00000000055A4000-memory.dmp

Download

memory/5572-1642-0x0000000005000000-0x000000000500A000-memory.dmp

Download

memory/5572-1634-0x00000000055F0000-0x0000000005690000-memory.dmp

Download

memory/5572-1638-0x00000000057A0000-0x00000000058AA000-memory.dmp

Download

memory/5572-1630-0x00000000051C0000-0x0000000005346000-memory.dmp

Download

memory/5572-1626-0x00000000005E0000-0x0000000000634000-memory.dmp

Download

memory/5572-1764-0x000000000BA40000-0x000000000BA62000-memory.dmp

Download