1a77644ab1bc42c6ffb71f74455e0821d556321d451e60ba3d05f755bf9d9f83

Analysis

max time kernel
150s
max time network
19s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mind-Setup.exe
Size 22.5MB
Sample261003-mdd4vswene
SHA256 1a77644ab1bc42c6ffb71f74455e0821d556321d451e60ba3d05f755bf9d9f83
MD5 e1ef1e6fd83d9d8476b177a06b3470be
SHA1 5434aaf71cf30001f49fc7ba3c6f645807754a2b
SHA512 d51fb729c25321858fb658fa4b35929347cf51c054ee5a26a157b59d8b546210a08301a857ade135473067ce67b15bc612ff556bb2012d6f00823124570dda69
SSDEEP 393216:DJNngATE7n+WXlWi8ihIuDLmlNBSTTmTwVV2+qaTNIvt1jvZ4HJ98D9Yk:wijxi8ihISyTBSnmM32L1jaI9Yk
TLSH
T1A4372262FE02D0BFD48A02B5E43EF739B73692958B2A89C346D90C586CE13B0595375F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
1936	inst-dotnet-10.0.0-X64-WindowsDesktop.exe
2392	wixstdba.exe
1540	windowsdesktop-runtime-10.0.12-win-x64.exe
5208	windowsdesktop-runtime-10.0.12-win-x64.exe
4536	windowsdesktop-runtime-10.0.12-win-x64.exe
3276	wixstdba.exe

Loads dropped DLL 1 IoCs

pid	Process
5248	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} = "\"C:\\ProgramData\\Package Cache\\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\\windowsdesktop-runtime-10.0.12-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.12-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.12 (x64).swidtag	windowsdesktop-runtime-10.0.12-win-x64.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI63A2.tmp	msiexec.exe
File created	C:\Windows\Installer\e595327.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e595327.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Mind-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Mind-Setup.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mind-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inst-dotnet-10.0.0-X64-WindowsDesktop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\ = "{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}"	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\Version = "10.0.12.50000"	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.12 (x64)"	windowsdesktop-runtime-10.0.12-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\Dependents\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}	windowsdesktop-runtime-10.0.12-win-x64.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1480	msiexec.exe
1480	msiexec.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncreaseQuotaPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSecurityPrivilege	1480	msiexec.exe
Token: SeCreateTokenPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeLockMemoryPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncreaseQuotaPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeMachineAccountPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeTcbPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSecurityPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeTakeOwnershipPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeLoadDriverPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemProfilePrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemtimePrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeProfSingleProcessPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeIncBasePriorityPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreatePagefilePrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreatePermanentPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeBackupPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRestorePrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeShutdownPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeDebugPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeAuditPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSystemEnvironmentPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeChangeNotifyPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRemoteShutdownPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeUndockPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeSyncAgentPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeEnableDelegationPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeManageVolumePrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeImpersonatePrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeCreateGlobalPrivilege	1540	windowsdesktop-runtime-10.0.12-win-x64.exe
Token: SeRestorePrivilege	1480	msiexec.exe
Token: SeTakeOwnershipPrivilege	1480	msiexec.exe
Token: SeRestorePrivilege	1480	msiexec.exe
Token: SeTakeOwnershipPrivilege	1480	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2392	wixstdba.exe
3276	wixstdba.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1480	msiexec.exe
5248	MsiExec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5880 wrote to memory of 1936	5880	Mind-Setup.exe	89
PID 1936 wrote to memory of 2392	1936	inst-dotnet-10.0.0-X64-WindowsDesktop.exe	90
PID 1936 wrote to memory of 1540	1936	inst-dotnet-10.0.0-X64-WindowsDesktop.exe	91
PID 5208 wrote to memory of 4536	5208	windowsdesktop-runtime-10.0.12-win-x64.exe	95
PID 1480 wrote to memory of 5248	1480	msiexec.exe	96
PID 4536 wrote to memory of 3276	4536	windowsdesktop-runtime-10.0.12-win-x64.exe	97

C:\Users\Admin\AppData\Local\Temp\Mind-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Mind-Setup.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Users\Admin\Downloads\inst-dotnet-10.0.0-X64-WindowsDesktop.exe
  "C:\Users\Admin\Downloads\inst-dotnet-10.0.0-X64-WindowsDesktop.exe" /norestart /passive /showrmui
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\TEMP\{478E3A4E-FEB0-4849-B090-8617439E4186}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{478E3A4E-FEB0-4849-B090-8617439E4186}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{96718EAD-5715-4DAB-A1B5-0F060E14BD32} {72BE78E8-D532-47C1-B61B-710320CC54C2}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2392
- - C:\Windows\TEMP\{478E3A4E-FEB0-4849-B090-8617439E4186}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
    "C:\Windows\TEMP\{478E3A4E-FEB0-4849-B090-8617439E4186}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{B52EA820-A014-4AC6-A619-5006B5E9ABA9} {5E27DFA2-95C7-4E41-8D43-7E08BE0E6197} 1936
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:1540

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9256A17EBC9EE9CB3F1330C70B4A6A1B
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5248

C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
"C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5208
- C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
  "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261003112102.log" /passive /norestart /showrmui
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\TEMP\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{89E89E6D-F58C-4F4A-BA91-E8F7335B6285} {C3F440C6-A704-4749-A070-6C2FA1B7D3A7}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261003112102.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261003112102.log
Size 23KB
SHA256 fb9feebe9520bc4639866d921ab0807403844dd03a52d12e91b57b0b637421fc
MD5 47302046d7feb64b26f1322f91a03fe4
SHA1 9df930862b9a169f43c7da5baa1e04d34ec1736c
SHA512 abd5a58537e0ebd4cecd54ed32f149a106b33f449f3bfac273d9cd1e68ba02e8c1f05c42062476c4cbdc13204076055527acef3b9ea6b9d5f18b6bf292b53856
SSDEEP 384:SFVWS/r2UwzvUd5KJ5Kj5Kg5KdQDesvXMXNBJ+Kl+fpEU:X4dUJUjUgU74
TLSH
T15AB2318C16DC9A453CB0C30F915D2EF4A5E065FD1BBC08FC6AF7436D4A99C98C7AA1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261003112102_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20261003112102_000_DotNetHost.log
Size 2KB
SHA256 c259255167035aaec07161245cff8fb2504fb6392577d4a40ff54da4bbf2b937
MD5 81915fe180aedfc029a8c9987bd16019
SHA1 7f0eec28fb14ae923f212617ade9a5c22701a0ba
SHA512 0a364df4449e982420ab2523f9caef30d428428d78f494100db95a650987cfbbba97bc51fe1c18161aaa2caff9e136cb86270d2ff8924b9207897160627f92d6
TLSH
T1F641E9561AD50D09B1F65707DAF3C0627A73FC92A934DF8C2345431906ABD016868BBE
MD5 SHA1 SHA512 TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{478E3A4E-FEB0-4849-B090-8617439E4186}\DotNetHost
Size 848KB
SHA256 f59a0c4177cd57a71c99b22009131a3bdf898ee6db62ef0415f056c4b26bb53c
MD5 57a71197c3da73f5088600fe1315f870
SHA1 5ee2d560c4d70756e29cd7d065cb38fd8a750ac3
SHA512 df44b6deb6c72b0bf8de820767041a378e97e4994e95ce00b675676b3892803620d94373492a04a598dfef334f135152b267b175ca3148af10f8341a88024927
SSDEEP 12288:LBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYA3hy6J:dGyASwoO2T7RgZMY0hy2
TLSH
T119055A1BBF9414A9D8A24EB1C5B78321FE357C082320959F46A4B12DDEFB6E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{478E3A4E-FEB0-4849-B090-8617439E4186}\DotNetHostFxr
Size 920KB
SHA256 ff33e8f0a6f4624f8c160f96aa8066eeb86bcc6e608fe258deeea13bbd18e82f
MD5 0dbebff80e13ff5ab5de800e763e5b37
SHA1 e044e032e89bbdededce81d655ae84e3123d367d
SHA512 6a4d2f9d8c713aa4abb3281904a61a0be2241d1bd419d97b8650d2398925f169a85dbcf2467653fcd624127df74cc2c8f4025c70a222f47bd91cc0e3e2cab8f9
SSDEEP 12288:CBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYY1a3rHLf:GGyASwoO2T7RgZMYF7
TLSH
T171157B1B7F9014A9D8A24EB5C5BB8321EE357C082320959F47A4B12DDEFB6E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{478E3A4E-FEB0-4849-B090-8617439E4186}\DotNetRuntime
Size 28.1MB
SHA256 22319614080d76c82a33b196c5765ca70ff1f38041e907c7d5ed8775f6c5f3f6
MD5 4d24332e3f8bc0e2b708e5ef1a77c7bc
SHA1 c5719df9a461dbe3fcdc98fa124233c2ab9c40d7
SHA512 40b135e2e289067cbfb90f7f26cde73342411faa028533fb969effe688734c88ba19e2083040e62309011f81eb964c18b6017929a3a04b145c7677160163173b
SSDEEP 393216:H4lM4oYejHXelWkVUhg75WNLimpDkyBKuy75k9PX17foSjUQaoMU+//+tFwA/T/g:N487t5DkD+VJnixU+nuFP/mP1QgRvx
TLSH
T1C95733637FC419B9D8625FB6C0FB8751AE353C44236055AB42947269EEFA3E024BB3C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{478E3A4E-FEB0-4849-B090-8617439E4186}\WindowsDesktopRuntime
Size 28.7MB
SHA256 1a20c13d8103d83ada5db2f9b380f69273cb17766c6e5ca954ecb93230f218e2
MD5 6712931c838d7173b4fe90e26cf3b44a
SHA1 f84ec5355723e6ec63fbae066c1279c343da0450
SHA512 a52a9a6f8a93fad3b2bab1abab55cec643b1b5f32a40ac11a89c36fc79a7fc1603c58de7883adad7730a6790eaae831a8c4a556cf5f09f4588f1be0a4e116c43
SSDEEP 786432:6BL3xuy6hjEjqDpD2dSNcZojdjc6uAkCt/BDmR+Wbv:6BL3xuysjRV2dSqGlMAkApDKb
TLSH
T1FC6733577E8209FAD8264E71C4FB9364EA393C4C6310659F02A4741AEEFB7D0627A3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI63A2.tmp

Path C:\Windows\Installer\MSI63A2.tmp
Size 411KB
SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
MD5 1981cd407f5b5e81c70ba2729c56b381
SHA1 e0b6d311930ab3557d5a0a8769edefb49c32aa3f
SHA512 3b7c18ca780cf05a01062661156d71e0a4626469f28040e46f07c7deb8f9a643b838bbc88eda515362c5895171a337a3f5d9b8e321e539408fc1ae47e6ae4181
SSDEEP 6144:GDvoaVoIMrKAzCsTI+q6JL9eZYr1JJS5qZ47BwhYjzmHim:QvoaVo/2WCsT7pXJS5qgBwhYg
TLSH
T135947B29B3E418EDD4B682B6C5A78430FF75744D332095AF8BA4916D1F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{478E3A4E-FEB0-4849-B090-8617439E4186}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 0da13bd67e88529919a3d066aa6767188b7b2b97e5dd1df2e3e1a83970c25111
MD5 6134cde82dee63b5cdfc38e7686622f9
SHA1 fcb0ab62a70f76f8ac704027ad1676080055edde
SHA512 f365db6d84c137b2257996bab84a923f7d90464416cb7605a80539fbc446e72511c7946fcb0eb496e790ce505c29d8ac5469fa6f047acf786149f07315b6fb85
SSDEEP 192:iFzanZTl6/wvRSn9Xta+ai2fZ8SsCsysz:3nFptsCsysz
TLSH
T10812E5512BFD0219F0F3AF48EFF6A4155A3ABD152E39C92D01211D0F49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{478E3A4E-FEB0-4849-B090-8617439E4186}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{478E3A4E-FEB0-4849-B090-8617439E4186}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{478E3A4E-FEB0-4849-B090-8617439E4186}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{478E3A4E-FEB0-4849-B090-8617439E4186}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{478E3A4E-FEB0-4849-B090-8617439E4186}\.ba\wixstdba.exe
Size 431KB
SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
MD5 14e0c606e68508fa618bd5c514015577
SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
TLSH
T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.12-win-x64.exe

Path C:\Windows\Temp\{478E3A4E-FEB0-4849-B090-8617439E4186}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
Size 968KB
SHA256 08a7e2db64e2ed8f0c0476d4463af75e691d1db571a05de6e161ce0178fbce90
MD5 95f7a028a67ce1c82bc647d02e1f2d0d
SHA1 6facfe6e1234168184b3ffb62189e608040fd65b
SHA512 07c388e66f7c6d9e9c257fc595c6eb9da5f9b1647a52fa10c81e72a49ce2b714eaeae9b7a604fbda61ca7f1aa1ae6a9781c50d8ce5259164ce27b81281cea773
SSDEEP 12288://hzPsOEX5eZbWC1I0iqm+4/Pm0zykD7xd5DWs2DuHxXQPE4Z8ob:/ZzPRq5eZbpTh47zykJnDWs5NQ84Zl
TLSH
T1CA256D31A566242BE6F40973F914D6307E28E7082B1C45B6C6D0DD0C79A89FA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\1028\thm.wxl
Size 7KB
SHA256 43e1e134d0591532323dfcd138ac8f5e99096cb6cb0213a486bbb3ecc5c47aad
MD5 2d7b0d29deaa836b538baaae8378ba48
SHA1 85d86c566f601ad6e22301183771b9cc7e5062e9
SHA512 ecc84dafe21bf858eb4693fd7c0802cf28dc5fcaf43eccc4ded3c4a83bd550e3dbf58012be695cf267917c39f6047eac89fd0cdec090e253c283783d01d8a916
SSDEEP 96:E5TrTfb5joKvyvOj8USd4sZij7N4WoWKWvsNMNizchn/hD2Rd0E/aQpSK1nuQKbm:4r5owj7NgwsNMNSiK1gd6r
TLSH
T1ECE10F5F7CEFCED46A332A0176B32989191DD28A13AE6CF4F5580C478B634216B73A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\1029\thm.wxl
Size 7KB
SHA256 2f174b5eed2a84e43396f3cae2e6521c9247bb0deccb16e7f9b461233c363534
MD5 f483510f350ad116c5c81468ad609bdf
SHA1 5343a3a695e6149c7a7ba831be75a91138763e44
SHA512 a39f3ebedb06361d95c39e4b7c5020d70be0e1e4654d5d5dfe254b44a7fa3a9c9c02659a28acc7ea8294620aa77818fb53609d7a2f6c9b6ae8d9adf9f2ac844c
SSDEEP 192:qxwpVLBj5iGRxrFe+4Lzv3zLfqRBxOTyv354+F:qxwNj5RxrF2PbLfWBETyv354S
TLSH
T17AF1FF1F58DFEED07B33194572B36A88681AC292035FACF5F8AE085787235059677E03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\1031\thm.wxl
Size 7KB
SHA256 2589887424dd4b0b27d36f7aa36d07fb6fa8d1c4dbe50059248a24823c742f92
MD5 4e98d12cfce46c393dcdf2736a2bda95
SHA1 aaf6a00e50cdf19f1c4fc6256ac040a750ca97af
SHA512 314d712f8fcb2a44abe1920aa9f44d2fef626732397d3d77e4ad0ea6a003b0ea38e361c96515c8e6f8cf7d61ab96de9a349a228522a9f4b81d82c8a8f1962662
SSDEEP 96:jgl95EIQ8+nPQP6Zc0y7jOROgYmwitzvzB5xz2kSl+ACIw052Q/LKtkCGpUvgd/q:jEpcoPWc0y7jGhYmdtzvzr8/oa/Lt/hQ
TLSH
T134F1425BA8EFDAD077332611B3736989791AD2C6136F1DF4F8A9480B8763501537BA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\1036\thm.wxl
Size 8KB
SHA256 ecdd5f7b7ed65bef8e3eec00537da44939b8e8f8f604e9b39329b45ec210efde
MD5 7673a053117454b94ff8155b9f06da1e
SHA1 2143896f16e8ec6d52eecb773e99d9a2f9daa4b9
SHA512 0d20a4d6819fc64e36cfcd9c029542d6ef834faa3c74dd636bc1b6697f92d8822cd19c1692c500956fdfe69a3278a84c0545c799878107d0d56520053b9ae266
SSDEEP 96:lsZt1vwZI+XNHwt/o5HezMxzMEy0vBW4eAQf49QcyhZpuWcK61xrG32gUgGv:o1wPWto5+zwzvWhvgYUgg
TLSH
T1E202105F58DBCFE06BB31717B6639589A839C286235F58E4F86B08078763914D337A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\1040\thm.wxl
Size 7KB
SHA256 c536f3f85936f6b38782df30a7bf88c7e7e66fa1e3257b20b75f9a4f0112b184
MD5 21fe14f06f2e38ca565581045a67eaba
SHA1 fe56b260ea7986f6234aeaa9f3adb010b01a0ff5
SHA512 a87e53dbcab33b95d78f67c7e62f0c3fa50711f54b11efee890b749dd21f42e68db185dc5a99160dd37403612abb9609d311dea1254c126b1e96ecf7aab67051
SSDEEP 96:p0NpgwGrmKmuaXo+Hnxy7McLi4vgjzH9euz3KLrQTNRREhZDWDIQ0gwZKWakCRos:wNBoJvUzH9euz3tTDCnZKWzDU+c
TLSH
T1BFF1EF7B68DFDDD0BA332748B2B3B589B51ED586235F19E0F4AA094B4753500A27BA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\1041\thm.wxl
Size 8KB
SHA256 000e1508d9bacb7156951988ba1d6dc36165facd2163352a93b9a66e8c642089
MD5 e29c1d15cf0eeb5fb10a6f0e92b041fc
SHA1 68cd096f0135524d5d07a9ec1fbcb69e1a1084de
SHA512 47d3acdafbc3dc960d569976fe3c635613608f08102a6cd0c246f8ebe0f3343e73fc9d87a673035a46fbc4de21c59b97054dfd596dde2f5f6eea25f6ff7b7d96
SSDEEP 96:/x55EeSXkI6+QsPIVLYitzzus2iK5EmV26W/0zYe9YQfNpYjruBzUYwvdCz1Q:/BQFPIVLYszzutz8yzYUO/CxQ
TLSH
T1B702102EA5DB89E06A331611756776C8680BCC85DBAB1CF0B07DC817977341DE237A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\1042\thm.wxl
Size 7KB
SHA256 09c51c910f7142ab7f73db8e826f3daff1525eea765d03bcd934cba53bc689d3
MD5 095c8d4db15a85c0c62842d0192202ad
SHA1 d703ab6b95a8190a3187a65ba1b779d856eff7b8
SHA512 86860b18e9101c2d27359e53e21c7f2fe939031850387a6a55c12d23b7dbe4133722b5fdf4364dc896d5aac5744b470b45198a47da6912a4827b88f433a79796
SSDEEP 96:YWnvHZWx805aEfLW344uU5OsW+yvuE4uU5J+jpD2kUcdkAdiY10IHDWw/fPb8Qhk:kjcuYhu5jx2kP1/3bmk9d4
TLSH
T1E8F1429B78EFDED026732C413AF36A95591AC2DA235B08F0F9254C878B738114637E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\1045\thm.wxl
Size 7KB
SHA256 209911674536ad5976dad21ae1e96a9fdfa61270120a94bbe0e8ae32a67239a2
MD5 4e407f5d7e06084cb9ec7b41b1f4b992
SHA1 0aa44f39e522935de900449937af13df18a6ef44
SHA512 926daa3c9d92b7f0e910101d6482ce6e153af13dd3f59236d3418df4a158857f00ea565869312f35c0bf6e689b6f1a0bead71f54e77783d65311838dc980c996
SSDEEP 96:vz5E6U+A8fOIZcvYqUC/W5TqUbFaOa0Q9zSzfmZ5AKgY1ou5DQ7JPy+u1/8X3vCH:ln9BmNUCqeUJaOaHNCPA/zGYP
TLSH
T1D5F1005FA4EFCED127331A45B6B369C9680AC5CA136F1CE4F8AE081B87675019337A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\1046\thm.wxl
Size 7KB
SHA256 7b095c32d1fbdd924d710d18d51a88a710bc152c8b30c6051524583bfabe38c0
MD5 13d65c9d4996d93edafb2696cc2a90b3
SHA1 80047984b6cee842764b24ef33a5c67eaabab2f3
SHA512 14ceaf26e16cfd039e18614d40148c44e09cc2e7130b19a3024aabb46bac77c1445cd7de84ef46577ae1ab4cf15cd0152a3ccd6fe070ee0a34b06f8f29ba0af0
SSDEEP 96:TD5ED4lH+wLwdBc7tlqIz5Vv0gpK0rD45g5q8MSQ7EugTuo6RADvAbK:Z1kvg7xlVv0gpXMfgLGK
TLSH
T1D9F1121F68DFDED037331A42B2B36A8A6509C2C5135F5DF4F8AA494B87A3500A637A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\1049\thm.wxl
Size 9KB
SHA256 3c911848f83d269fa2cd64bbfd7b5e88eb3a621bdd42c564c69100a8e8a40494
MD5 7904c2832b3cedabcdf0ec49dd8040ba
SHA1 2a7f428568ab6ea5fd54bb80376c552d80a0e7a3
SHA512 3c881efc2b611bda02b290bc79948818ce6e6a495dcf2dc938047875f301f18f9eae37ba109fd9b453504173cb9209192e0d2cd4603c7bf105042bc9775829e0
SSDEEP 96:C7lv+VxxVUC7bqFdwkd/XQF+L++qFQEemLq9OJRgcnZKQ8VXoshXuOxMvlmV3p/n:zVPVU//y+L++9wpZ/oRZ1
TLSH
T1A022FD2615EFA8D81222B117E9626E0E3C5B81FF3B6B5BF174641C6F76B3000833B606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\1055\thm.wxl
Size 7KB
SHA256 56d76adc63b71879e3291f0f306e54081e9e80f463fcb41dc6896ecd2298deae
MD5 e2fabe4eb312645c1231029191458f7e
SHA1 f9f143535ba48d9aeb791c62e79ed687911927b1
SHA512 ddf60df1ee2f00561bc806e384478b105182a4bec673b5eb26b1db7f88adb297af80b7bdfeecd5e0aefc3579bf20a84bc9bacdcfb727b9d1af2865cdcdc48a37
SSDEEP 96:YMANNFTFhC4h4bNReiNxfufGzzzSkbAS37lsu+wzPwQT8gpwMu7kVS0uuM/r+9Hc:YlFJydNxfu+zzzgoZ7Twh/6H/0
TLSH
T1DCF1231F78DFEDD467332A56B2B3268CB84EC382132A9CE0F52944479BA351152B7B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\2052\thm.wxl
Size 7KB
SHA256 340154c87016bd6af740e6a91ea86d722817f6dc2bc675c33133901443658179
MD5 e89b4290f9255b428cc21e217dc8e5e7
SHA1 84f78df432e53426412e2123c1990acfb743f6c9
SHA512 b313de643859aca6b9b2f05f88efd130c900065c08d2279af6f7d8dd0301a7a762ee0e051ccc76c737c68c86e51decd48287529e7fc9a25c0cb1228151447105
SSDEEP 96:dLf2DllNpoNWZd9rCfE4d57afwUtn93K248RYCPr/I5Qqj9BQru0iCiBkz6/3PPx:d0Np6fHGwMn93MRoL+u0x
TLSH
T11EE1119F78EFCEE02A332A5132B325CC2819D28957AB5DF0F4641C4B8B634205777A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\3082\thm.wxl
Size 7KB
SHA256 2416f9a3daa6767f418c5ab94edb8a83dc9326fcaf13de1186e61b5248349edc
MD5 65b3aa6dd10a5b8db1b7f7faa4c4c7e1
SHA1 ca32c8b853681960c86d19d533dff4ff1137a1c6
SHA512 d7fce89011c24d0c3928807293d42a3f694ef4357d3c42a84d9294de000b291279671e2059e063ac58806b8e718654260ce5c9ae8c748d3a0a8c9ce0e23ac55a
SSDEEP 96:oEBx4+Ck8rL6j+zTnnq6LuSznTUzO1GKW+gepaU5/QxANuRypklEDhmh8asuBtz:aX6qfxLzznAzO1G0ERdiu/z
TLSH
T132F1412F68CFDEE27B73194472F3958DA808C295235ECDE0F468085B8793905D637A83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperExtensionData.xml

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\BootstrapperExtensionData.xml
Size 276B
SHA256 258fac237622533e7f9ec3f95bcec8abcc31ae87e2017e5717af0841c61e9df4
MD5 240bac991e5860465ce0dfd580ea7cb3
SHA1 a352934cbb14ab877883ac219ceb78c92e27f495
SHA512 67ff8063a071436ae7dca8ee12ad1991bb70752dcc63f00f129f38dffa1aaf9299fff591fc67dbf4d2fdc57a9242831b149d575181b84857cd4f22463076f315
TLSH
T1DAD05E432FBE2304F1B30F49A6BA94102475BE009D78CC6D0228080C0573D92C8B2F77
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\license.rtf
Size 215B
SHA256 75cf03762aea3f3ef6ae0dc0290c4426052549a0b4335bcc3ba9ca30391e0751
MD5 5f5db41d3f86258e4b6f8b08ef870d0a
SHA1 3c02aea43c2bc7dff281ec8e5ad01abf058c1ed6
SHA512 26344831d563e95a26126f2d99ce9b773017596001fbf3d7f56b9a84c77a69240640b7bb191ec8ec7fa66d424134805113be8b9503adae19554aaba6c98223ee
TLSH
T19BD022EA15CC11AA3FB80A8CEB04D029ED7E419DBC41D682B1313A90F81192DB2C76A2
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{EAE2C75E-7FB0-4BB0-ADA7-0F01F0DD18E5}\.ba\logo.png
Size 852B
SHA256 cd2e8ed1fbb308d9d166f49794d323a9b22efba1033cdf906d1f4b030319e01b
MD5 8346e21859a269dccf1e408dc7593cca
SHA1 239f10674bf6022854c1f1bf7c91955bde34d3e4
SHA512 de9a54e7067fe4feade10f48d7c2bb4169f50efa0b06d3310421376690712af4d55dbc24dc5accc5013379b11abb59cc8c85896fe9f2a7c6a7ea2e28f6feac9f
TLSH
T16B0152E8C16455ACA24E76BA91F32450B653B46010C5CD8EBE00DF3442F4522AB976A6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1480-125-0x000001AE85540000-0x000001AE85EE4000-memory.dmp

Download

memory/4536-126-0x00000000007E0000-0x00000000008A6000-memory.dmp

Download

memory/4536-149-0x00000000007E0000-0x00000000008A6000-memory.dmp

Download