879e45078db5e25ff7d7f06162da04982b63fdb60a91b578626124c50186d26b

Resubmissions

06/10/2022, 12:44

221006-pyhc5ahdc6 8

06/10/2022, 12:40

221006-pwakhahdc4 8

Analysis

max time kernel
144s
max time network
147s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
06/10/2022, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

LenovoLegionToolkitSetup.exe
Size

4.8MB
MD5

4bb04adada4e23c0bbb20ea5cbb744eb
SHA1

f4f270a57c89cfe44ea20cda0d6d83cd1b471ac9
SHA256

879e45078db5e25ff7d7f06162da04982b63fdb60a91b578626124c50186d26b
SHA512

c01a41d165a8ce4c912f60b6b4fc08791239b8a487e2537e49ce2d37251948fb98b24d4af6320aaa6cdee22cff6b5a0b96cfa2a190e1621f9923c037145eb558
SSDEEP

98304:7kLjeoEDK0ONsA41YOuEDb28kpgmCyKr3xZ2XilWDnE55ljf:w6oEDfQiYvE32Gy43xZ2Xt2nr

Score

8^/10

discovery persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	32	msiexec.exe

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
4812	LenovoLegionToolkitSetup.tmp
3988	netcorecheck_x64.exe
4912	dotnet60desktop_x64.exe
3208	dotnet60desktop_x64.exe
4428	windowsdesktop-runtime-6.0.8-win-x64.exe
1808	Lenovo Legion Toolkit.exe
4836	Lenovo Legion Toolkit.exe

Loads dropped DLL 64 IoCs

pid	Process
3208	dotnet60desktop_x64.exe
2256	MsiExec.exe
2256	MsiExec.exe
360	MsiExec.exe
360	MsiExec.exe
3388	MsiExec.exe
3388	MsiExec.exe
3972	MsiExec.exe
3972	MsiExec.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe
1808	Lenovo Legion Toolkit.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	windowsdesktop-runtime-6.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca35acb3-b442-44fb-924c-4448120bf689} = "\"C:\\ProgramData\\Package Cache\\{ca35acb3-b442-44fb-924c-4448120bf689}\\windowsdesktop-runtime-6.0.8-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.8-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\tr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\tr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Runtime.CompilerServices.VisualC.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\ru\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\ru\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\es\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Resources.Writer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\api-ms-win-core-memory-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\api-ms-win-core-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\pl\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\pl\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\zh-Hant\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Transactions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\System.Windows.Forms.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\ko\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\de\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\cs\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Diagnostics.TraceSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\api-ms-win-crt-utility-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\System.Configuration.ConfigurationManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.IO.Compression.Native.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\hostpolicy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\fr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\fr\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\fr\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\de\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\pl\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\ko\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\pt-BR\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\tr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\PresentationFramework-SystemXml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\UIAutomationClient.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\ja\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\ja\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\tr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\Microsoft.WindowsDesktop.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\de\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\de\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\tr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\zh-Hant\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\ru\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\ru\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\api-ms-win-crt-time-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.IO.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\it\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\System.DirectoryServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\cs\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Threading.Overlapped.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\api-ms-win-core-rtlsupport-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Net.Security.dll	msiexec.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e576885.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6950FA03-8B88-4675-B685-FB21CA1762CC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI88E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI82A3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A4C.tmp	msiexec.exe
File created	C:\Windows\Installer\e57688a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57688a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6CE3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e576882.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D4B.tmp	msiexec.exe
File created	C:\Windows\Installer\e576882.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5E8.tmp	msiexec.exe
File created	C:\Windows\Installer\e576889.msi	msiexec.exe
File created	C:\Windows\Installer\e57688d.msi	msiexec.exe
File created	C:\Windows\Installer\e57687e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7CEA3ABF-FE24-42AF-ADE6-B4A3EE346743}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8381.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57687e.msi	msiexec.exe
File created	C:\Windows\Installer\e576881.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI85F3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D42.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EB3983F9-3D60-456D-A11A-C1366C79AD3E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI91C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7EBA.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3C3CA326-3F1D-43B7-B0AD-CBC06B2DED5A}	msiexec.exe
File created	C:\Windows\Installer\e576886.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e576886.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7281.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4752	1808	WerFault.exe	80
3772	4836	WerFault.exe	84

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F3893BE06D3D6541AA11C63C697DAE3\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{EB3983F9-3D60-456D-A11A-C1366C79AD3E}v48.35.45540\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\30AF059688B857646B58BF12AC7126CC\Version = "807645590"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F3893BE06D3D6541AA11C63C697DAE3\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F3893BE06D3D6541AA11C63C697DAE3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F3893BE06D3D6541AA11C63C697DAE3\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ca35acb3-b442-44fb-924c-4448120bf689}\Dependents\{ca35acb3-b442-44fb-924c-4448120bf689}	windowsdesktop-runtime-6.0.8-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\30AF059688B857646B58BF12AC7126CC\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\30AF059688B857646B58BF12AC7126CC\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F3893BE06D3D6541AA11C63C697DAE3\SourceList\PackageName = "windowsdesktop-runtime-6.0.8-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.35.45462_x64\Version = "48.35.45462"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\ = "{6950FA03-8B88-4675-B685-FB21CA1762CC}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\623AC3C3D1F37B340BDABC0CB6D2DEA5\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\094F9C7997352096B7082D27C35AD959	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F3893BE06D3D6541AA11C63C697DAE3\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FBA3AEC742EFFA24DA6E4B3AEE437634\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.35.45462_x64\Dependents\{ca35acb3-b442-44fb-924c-4448120bf689}	windowsdesktop-runtime-6.0.8-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\30AF059688B857646B58BF12AC7126CC\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\623AC3C3D1F37B340BDABC0CB6D2DEA5\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\623AC3C3D1F37B340BDABC0CB6D2DEA5\SourceList\PackageName = "dotnet-hostfxr-6.0.8-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\094F9C7997352096B7082D27C35AD959\30AF059688B857646B58BF12AC7126CC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FBA3AEC742EFFA24DA6E4B3AEE437634\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\623AC3C3D1F37B340BDABC0CB6D2DEA5\Version = "807645590"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\30AF059688B857646B58BF12AC7126CC\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\30AF059688B857646B58BF12AC7126CC\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FBA3AEC742EFFA24DA6E4B3AEE437634\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\623AC3C3D1F37B340BDABC0CB6D2DEA5\ProductName = "Microsoft .NET Host FX Resolver - 6.0.8 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\30AF059688B857646B58BF12AC7126CC\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{6950FA03-8B88-4675-B685-FB21CA1762CC}v48.35.45462\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.35.45540_x64\ = "{EB3983F9-3D60-456D-A11A-C1366C79AD3E}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F3893BE06D3D6541AA11C63C697DAE3\PackageCode = "20A181425160AB347A0203A2F2507892"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F3893BE06D3D6541AA11C63C697DAE3\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.35.45540_x64	windowsdesktop-runtime-6.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FBA3AEC742EFFA24DA6E4B3AEE437634\PackageCode = "032100580D65A584C952F49067EFEFF8"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3D8B53D9DC55ACC7DCBFF21198B65299	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\623AC3C3D1F37B340BDABC0CB6D2DEA5\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FBA3AEC742EFFA24DA6E4B3AEE437634\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FBA3AEC742EFFA24DA6E4B3AEE437634\SourceList\PackageName = "dotnet-runtime-6.0.8-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\30AF059688B857646B58BF12AC7126CC\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.35.45540_x64\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.8 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.35.45540_x64\Dependents	windowsdesktop-runtime-6.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FBA3AEC742EFFA24DA6E4B3AEE437634\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\623AC3C3D1F37B340BDABC0CB6D2DEA5\Provider	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\30AF059688B857646B58BF12AC7126CC\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.35.45462_x64	windowsdesktop-runtime-6.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA09DC07E8256FC5284912EAD0B2A9A8\623AC3C3D1F37B340BDABC0CB6D2DEA5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.35.45462_x64\DisplayName = "Microsoft .NET Host FX Resolver - 6.0.8 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\623AC3C3D1F37B340BDABC0CB6D2DEA5\PackageCode = "775436CBE9E579E4C99A524F9F227C6E"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\30AF059688B857646B58BF12AC7126CC\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FBA3AEC742EFFA24DA6E4B3AEE437634\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.35.45462_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\30AF059688B857646B58BF12AC7126CC\ProductName = "Microsoft .NET Host - 6.0.8 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F3893BE06D3D6541AA11C63C697DAE3\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.35.45462_x64	windowsdesktop-runtime-6.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\Version = "48.35.45462"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F3893BE06D3D6541AA11C63C697DAE3\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\623AC3C3D1F37B340BDABC0CB6D2DEA5\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\623AC3C3D1F37B340BDABC0CB6D2DEA5\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\623AC3C3D1F37B340BDABC0CB6D2DEA5\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{3C3CA326-3F1D-43B7-B0AD-CBC06B2DED5A}v48.35.45462\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\30AF059688B857646B58BF12AC7126CC\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{6950FA03-8B88-4675-B685-FB21CA1762CC}v48.35.45462\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FBA3AEC742EFFA24DA6E4B3AEE437634\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.35.45462_x64\ = "{3C3CA326-3F1D-43B7-B0AD-CBC06B2DED5A}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ca35acb3-b442-44fb-924c-4448120bf689}\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.8 (x64)"	windowsdesktop-runtime-6.0.8-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.35.45462_x64\Dependents	windowsdesktop-runtime-6.0.8-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\623AC3C3D1F37B340BDABC0CB6D2DEA5\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{ca35acb3-b442-44fb-924c-4448120bf689}	windowsdesktop-runtime-6.0.8-win-x64.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
32	msiexec.exe
32	msiexec.exe
32	msiexec.exe
32	msiexec.exe
32	msiexec.exe
32	msiexec.exe
32	msiexec.exe
32	msiexec.exe
4812	LenovoLegionToolkitSetup.tmp
4812	LenovoLegionToolkitSetup.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeSecurityPrivilege	32	msiexec.exe
Token: SeCreateTokenPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeLockMemoryPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeMachineAccountPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeTcbPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeSecurityPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeTakeOwnershipPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeLoadDriverPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeSystemProfilePrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeSystemtimePrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeProfSingleProcessPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeIncBasePriorityPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeCreatePagefilePrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeCreatePermanentPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeBackupPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeRestorePrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeShutdownPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeDebugPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeAuditPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeSystemEnvironmentPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeChangeNotifyPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeRemoteShutdownPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeUndockPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeSyncAgentPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeEnableDelegationPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeManageVolumePrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeImpersonatePrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeCreateGlobalPrivilege	4428	windowsdesktop-runtime-6.0.8-win-x64.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4812	LenovoLegionToolkitSetup.tmp
3208	dotnet60desktop_x64.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4836	Lenovo Legion Toolkit.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 4812	1776	LenovoLegionToolkitSetup.exe	66
PID 1776 wrote to memory of 4812	1776	LenovoLegionToolkitSetup.exe	66
PID 1776 wrote to memory of 4812	1776	LenovoLegionToolkitSetup.exe	66
PID 4812 wrote to memory of 3988	4812	LenovoLegionToolkitSetup.tmp	67
PID 4812 wrote to memory of 3988	4812	LenovoLegionToolkitSetup.tmp	67
PID 4812 wrote to memory of 4912	4812	LenovoLegionToolkitSetup.tmp	69
PID 4812 wrote to memory of 4912	4812	LenovoLegionToolkitSetup.tmp	69
PID 4812 wrote to memory of 4912	4812	LenovoLegionToolkitSetup.tmp	69
PID 4912 wrote to memory of 3208	4912	dotnet60desktop_x64.exe	70
PID 4912 wrote to memory of 3208	4912	dotnet60desktop_x64.exe	70
PID 4912 wrote to memory of 3208	4912	dotnet60desktop_x64.exe	70
PID 3208 wrote to memory of 4428	3208	dotnet60desktop_x64.exe	71
PID 3208 wrote to memory of 4428	3208	dotnet60desktop_x64.exe	71
PID 3208 wrote to memory of 4428	3208	dotnet60desktop_x64.exe	71
PID 32 wrote to memory of 2256	32	msiexec.exe	74
PID 32 wrote to memory of 2256	32	msiexec.exe	74
PID 32 wrote to memory of 2256	32	msiexec.exe	74
PID 32 wrote to memory of 360	32	msiexec.exe	75
PID 32 wrote to memory of 360	32	msiexec.exe	75
PID 32 wrote to memory of 360	32	msiexec.exe	75
PID 32 wrote to memory of 3388	32	msiexec.exe	76
PID 32 wrote to memory of 3388	32	msiexec.exe	76
PID 32 wrote to memory of 3388	32	msiexec.exe	76
PID 32 wrote to memory of 3972	32	msiexec.exe	77
PID 32 wrote to memory of 3972	32	msiexec.exe	77
PID 32 wrote to memory of 3972	32	msiexec.exe	77
PID 4812 wrote to memory of 1808	4812	LenovoLegionToolkitSetup.tmp	80
PID 4812 wrote to memory of 1808	4812	LenovoLegionToolkitSetup.tmp	80

C:\Users\Admin\AppData\Local\Temp\LenovoLegionToolkitSetup.exe
"C:\Users\Admin\AppData\Local\Temp\LenovoLegionToolkitSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\is-K2070.tmp\LenovoLegionToolkitSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-K2070.tmp\LenovoLegionToolkitSetup.tmp" /SL5="$901EA,4195697,832512,C:\Users\Admin\AppData\Local\Temp\LenovoLegionToolkitSetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Users\Admin\AppData\Local\Temp\is-3HJAG.tmp\netcorecheck_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-3HJAG.tmp\netcorecheck_x64.exe" Microsoft.WindowsDesktop.App 6.0.8
    3⤵
    - Executes dropped EXE
    PID:3988
- - C:\Users\Admin\AppData\Local\Temp\is-3HJAG.tmp\dotnet60desktop_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-3HJAG.tmp\dotnet60desktop_x64.exe" /lcid 1033 /passive /norestart
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\Temp\{B574C99F-1DE3-4EB7-8A74-CF8B65926634}\.cr\dotnet60desktop_x64.exe
      "C:\Windows\Temp\{B574C99F-1DE3-4EB7-8A74-CF8B65926634}\.cr\dotnet60desktop_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-3HJAG.tmp\dotnet60desktop_x64.exe" -burn.filehandle.attached=600 -burn.filehandle.self=608 /lcid 1033 /passive /norestart
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3208
    - - C:\Windows\Temp\{4CF46ADE-1059-4AE9-811D-E05E30636B0A}\.be\windowsdesktop-runtime-6.0.8-win-x64.exe
        
        "C:\Windows\Temp\{4CF46ADE-1059-4AE9-811D-E05E30636B0A}\.be\windowsdesktop-runtime-6.0.8-win-x64.exe" -q -burn.elevated BurnPipe.{A74DD3ED-9B52-4AA8-952F-3BEFDB3DBD2A} {6DF6EB63-EEB4-462F-BFDB-B7E93EDE5FBA} 3208
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428
- - C:\Users\Admin\AppData\Local\Programs\LenovoLegionToolkit\Lenovo Legion Toolkit.exe
    "C:\Users\Admin\AppData\Local\Programs\LenovoLegionToolkit\Lenovo Legion Toolkit.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1808
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1808 -s 1660
      4⤵
      Program crash
      PID:4752

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:32
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3B222F78350B9D8837F1AFC890FCBAAB
  2⤵
  - Loads dropped DLL
  PID:2256
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 87D111950C27EA0600E9B03E45699839
  2⤵
  - Loads dropped DLL
  PID:360
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9D39CA6BB41A971EF5314E436C63F784
  2⤵
  - Loads dropped DLL
  PID:3388
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F51D58C3A76CC06461B205CF0FB378C5
  2⤵
  - Loads dropped DLL
  PID:3972

C:\Users\Admin\AppData\Local\Programs\LenovoLegionToolkit\Lenovo Legion Toolkit.exe
"C:\Users\Admin\AppData\Local\Programs\LenovoLegionToolkit\Lenovo Legion Toolkit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4836
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4836 -s 1568
  2⤵
  - Program crash
  PID:3772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\dotnet\host\fxr\6.0.8\hostfxr.dll

Filesize
366KB

MD5
4fc4fb4d77a7ef49ee5133b5b6a194ed

SHA1
8c63016cd28a0c3896ccb5f98d5aaa08a9e281d8

SHA256
cc39ab9baa38b4cf39dbc34dcc920202c69570baf67f4f947c02b8fdf0e61fc5

SHA512
5c647ce6a15a61d9bb10660aa29eafe5f2509cc63408efb3659b5036a21d268b9ffe825a4bf67d9c8e78005e7a414cc782a20538a135b9a8b0ed6329702c9fc7

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\Microsoft.NETCore.App.deps.json

Filesize
32KB

MD5
1644ca5abb1da6551fe26c8b2712354c

SHA1
8194ce6de282c544d8425410a597f977bc84121e

SHA256
34ba41b6f99a70ab79fb22c9f352a8f0417c5b5e816d552d94af9c67335a08f2

SHA512
1bc53d61b3f40a6bb2063c122421ec4b43f6f710d596115370092321b548165a8185c945ddc98add56fe49a15ffb946fcf3b5113601e3a5631d84ef6f9527d48

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\Microsoft.NETCore.App.runtimeconfig.json

Filesize
159B

MD5
3fbd84a952d4bab02e11fec7b2bbc90e

SHA1
e92de794f3c8d5a5a1a0b75318be9d5fb528d07d

SHA256
1b7aa545d9d3216979a9efe8d72967f6e559a9c6a22288d14444d6c5c4c15738

SHA512
c97c1da7ae94847d4edf11625dc5b5085838c3842a550310cca5c70ba54be907ff454ca1e0080ba451eacfc5954c3f778f8b4e26c0933e55c121c86c9a24400b

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Private.CoreLib.dll

Filesize
10.1MB

MD5
1af8685bb8e67c6841b1f2150b0aec4c

SHA1
3b15c45109cbb61b1600bafede5275f1947934c5

SHA256
30a3a396ea1edd01ddbef642decf688def749c685880f4037c037d94aa7f0269

SHA512
404cdc52176cd34336c876fff884db6035b888da5d7ea102609317b4feca18a0d9ee882cf45cf317cbc3e8f1de339762bf03bd8a946fd04e23c21964e7a43686

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Runtime.dll

Filesize
41KB

MD5
83e4f7a918fa3ee8e573423fbd18acf2

SHA1
fa1cc21b687c239b2d4ba276c538d6c33bde6045

SHA256
301cd1655c519d9b528eaf52b950f321b2462f6cc35a9ef8a0f91ce19eb5834d

SHA512
40b88c17eeaace6e5eb1bd86fb8d84b6d4e0d284bb749e7f9655d4949de8c0fb7a9aaedbeba6da5becdc92f687cec2c2a39da7cb162ec36322de70889b662dde

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\clrjit.dll

Filesize
1.4MB

MD5
1972eb629b743754e28318ecf7e04628

SHA1
783f6b6f1de5168cb21b3fb7d929ad6899524d06

SHA256
e0d30abf7dde33dfe2165f8e9e63220ff9f2738ea81570275e7f1fdceabdebaf

SHA512
db2fcc3b5b0426b22fe776b0edf78c23c0ab4706217c5dbf6d0823427ecb7e3225d8bf112f25b2e81edc8fec39805335c2e4331b0ce9217de8e5ca87069a0c7d

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\coreclr.dll

Filesize
4.9MB

MD5
136ae18a33f456a70463a396474f3600

SHA1
276a61e8222a3d77c238a22795268fcf27d9f1ac

SHA256
35ec15d344f99d4c076c2ca47751cb7aa9d0cf75227cc5e354ae7d7c00c0bf37

SHA512
a31f7d8196cbf9980c3bdfbe0443d455767392c9ff83c7e527f410e35ec14e563e19bceef74faf71b55ea987be66bafd4073dade56fe5afeede8a500bc61cf53

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\hostpolicy.dll

Filesize
383KB

MD5
8920df1b3ab0660090b204d2881fbb4e

SHA1
ec8ec146c4226aece015d3b00439d0b505083dd1

SHA256
5b72566804a8cb4ac2d5d28438a6d197456e29299758dae57140b1c5ab84bbb4

SHA512
3ef742965369ca788e2ac229bf3f19648cc145f0a12f36c64f3e617039f32bccc0f24bc9736519ef7c12cd4e18831678d021d0268801bed4b593cdea1ee35ed2

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\mscorrc.dll

Filesize
143KB

MD5
3f623a087ed2fd714c2763a8f7954583

SHA1
d7fe83ad5997619594daf1c88ef63281ecd19ecf

SHA256
5aa6b0f0a2b220053b2663b97ec91200c850bc207bb56a7bfb18fcb2ad9bdb6b

SHA512
0c08d799ebb7dff1979644be48fa66100977c50e86c092f42a8743c8e4530765b8f6bc6b9d89daaa34296d1ef9f281fab52fdd45bec51bf524c811154282d069

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\Microsoft.WindowsDesktop.App.deps.json

Filesize
30KB

MD5
25b6ef2cb17e447487b8b5628a040cce

SHA1
5f9b3c0a02327609e0209ae77e3b598947fc2621

SHA256
1cab24f12316381ee5c7ed1c1b87cc63142720505dad63d0233e32d1ac58d274

SHA512
fc18fa9c376f646da75d2cccb47880af2f3ea810cf78291e6ac4969cb79c25914a58ce7de5743ad61058eac0815ab80fcf6f4c9ae0adfbe605da5ba7c530d2c5

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\Microsoft.WindowsDesktop.App.runtimeconfig.json

Filesize
288B

MD5
98196982086322d19e15af69621801c9

SHA1
d482b22d9acaccf443393933c608d8445f2f49ee

SHA256
c5285402c7d738fdec246210332f3b0c7bab03875da7fb656d7872fb3fe8b504

SHA512
359698d0de4b05f80b26bd5ffbd8534d321e4a402dfde289fa5bf7b48825f3873cf1db881018c8b9f16fa02f7ff55e96d14b287517ea892072bde17a716cfd79

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\PresentationFramework.dll

Filesize
15.5MB

MD5
dd719cfff212f6b7bb52eda8bb4d40c6

SHA1
dff1a728aa2759cbe0abb03de1f079c429dd6eff

SHA256
25246ad282c8960ec980bee3651e80b0bd9b9c9c15fa2c43731d4d1ef309f6c9

SHA512
2d00767b2aab274e7c5fb68cfc89cd4b125557370ef96fd88289a1d7802544020dfa57da0c60f6c9df7f161c9c84a4adae535cd0fffd2db726885024293e8e1f

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\System.IO.Packaging.dll

Filesize
273KB

MD5
bb6215b05280c71ee49d8f8c26d76d8b

SHA1
92fd1f0abbb6665c629541147e8835e719c1b1ed

SHA256
d52dbf7fa06e9881c820955b95283668f3aae73125f1bb0d2a105af8a9524b05

SHA512
7a66cc01b15c45c71e3ed1d6224e3bad1163bc1b455c61035ce642b82d8a51d587fb6ec47d32012b76168fa6da77f3ab6f14be76216ef6c9865084d4b07e02ab

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\System.Xaml.dll

Filesize
1.4MB

MD5
93bec1198a4b46e566f6e44a164a837b

SHA1
3458ab682811d21a3e761b75ce453a5498ccafb2

SHA256
0676dbb9a0173ae925e18c6c6df53d8c8a054595dc128baa11036ccfa394d77d

SHA512
8ffa49c305bf15a046a95ac72e5fcaa868d0da721871382f654fac91335ebc366562b882f2976e9aba00248298a156734c9503d15c30bc0afaebd9c408dbdce1

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\WindowsBase.dll

Filesize
2.2MB

MD5
f4454ebe54237727555b9d072363e397

SHA1
fc50be8a8b3e31ec7c8305471dd4c8da82b69dc0

SHA256
ee2d649d35da26a0cea0f68c003c0a416f85e39619428f1eb045d2f2b4fcd1b4

SHA512
936475cc808eb8ca4a318c95c7222e7b0a26c6bfbc786e19349b9323319c750dcb4105f9331b18db5d01bea17a101c2117d8a953ec3d795665ccf30b9753aa4e

Download Submit
C:\Users\Admin\AppData\Local\Programs\LenovoLegionToolkit\Lenovo Legion Toolkit.deps.json

Filesize
17KB

MD5
8f5dd3ddf051a27113d08bb9bc468fcf

SHA1
417d43a67616d76fccf03656d83934011d005b27

SHA256
56ca6688b95f8c8e006074f32068317ee20a9e483eb508b20a1bfeefad20629d

SHA512
d68b19731fae26a68b14bf888721be5c583a70433f249b190ebc6b650a0a860364c2ecb18eec29e325f7c9f56553024947bd0d360281e3e3dfbfd3e785af83f5

Download Submit
C:\Users\Admin\AppData\Local\Programs\LenovoLegionToolkit\Lenovo Legion Toolkit.dll

Filesize
443KB

MD5
03b1f6f2592eda4d4601454cdd9be661

SHA1
80bd38537be3d5e26c78f5816bad501bd89d2d2c

SHA256
edaa00c4eada28ec444991fb1ba264c844cbbb319cd6c821dd6e5051beb485f0

SHA512
87faa6f6ef9772e4593e1797aad378f844365a036ce9ea675c4cc9c5219b72f195f2cc2bd7a1e6281ce9e05453b4f8d86bbb77b09b8c895f903797463eacced2

Download Submit
C:\Users\Admin\AppData\Local\Programs\LenovoLegionToolkit\Lenovo Legion Toolkit.exe

Filesize
188KB

MD5
e72b02d991218ec06cafbb31b1272304

SHA1
858648334a5e8e3d95301ad300bf5fea7774a8d9

SHA256
bfba46d296d77ef1c487ec8cd939ab5911a311c16596ac95bb33d89815beb9ee

SHA512
af4b501ceb2fc6951b343d65569d6183b1fd02af46f37688b8255aecb6d841a34a867fadc53b6d66737730f6c325cfb4fa8a6b1b81dcacae6143c89db8716ff8

Download Submit
C:\Users\Admin\AppData\Local\Programs\LenovoLegionToolkit\Lenovo Legion Toolkit.runtimeconfig.json

Filesize
372B

MD5
d94cf983fba9ab1bb8a6cb3ad4a48f50

SHA1
04855d8b7a76b7ec74633043ef9986d4500ca63c

SHA256
1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a

SHA512
09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.8_(x64)_20221006144143_000_dotnet_runtime_6.0.8_win_x64.msi.log

Filesize
2KB

MD5
35df8f2ea9c92a0b488c045a7c426dd8

SHA1
9529aa2147141e8c45a6968f2c1497842d67eccb

SHA256
43aa14e29575bc5544dc04e9f175085060fa58794514d11eeb114d0a20ea78d0

SHA512
d9ba97dd546ad9c0baa9fb55a87dbf811abb8c9c2c2eba65447b2c2606c492a27b1cfb7f0f6a59a684c82629ac1aed9a2c70f8eb3d7237dc9b7f9e53a52b053a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.8_(x64)_20221006144143_001_dotnet_hostfxr_6.0.8_win_x64.msi.log

Filesize
2KB

MD5
d0552df44bb703c7243ffc65cb2a0a12

SHA1
83fa6caa924ffb806c9998280c922d768ad70efd

SHA256
bd5122c2683ce613dd4de9a448896c1f08c1297f0a701c0eeac05ea8d1446088

SHA512
07a366166b0dca2777c1bcf6a4a56b733e116bf630f392a159e041cb7ca1c82fdb51a02960216802c096e18ac2a5a79416a3bca93e296cd3fb0cf5a269cc312b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.8_(x64)_20221006144143_002_dotnet_host_6.0.8_win_x64.msi.log

Filesize
2KB

MD5
d27b2f4d4f97746832c503d608c9c03f

SHA1
a6f6285805417344543e9c976b51f8aeb14264b4

SHA256
9d8807fc342e0c6ce03f35198eea6777c24fbd6fbfe947afc9036e2e15592479

SHA512
a3d439e20d9b2fabb7801991f411f42be2e22fd78472ae72032b1e56ec2067bd79ccb3182848bcc621c77c448e1ce9bd7698ecfe3e702338c13fb057cb181495

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.8_(x64)_20221006144143_003_windowsdesktop_runtime_6.0.8_win_x64.msi.log

Filesize
2KB

MD5
2cd1b863e1435534fa812e662f3b7f39

SHA1
4153de2891d1945a7a6c1b99dfb8a461d123e529

SHA256
0da33ac240b9ba6c7cb5c9e8ff61cd0fc13c55ee39911814ee6bf1a52b0d6358

SHA512
76022bcb3fdf0307d11c141d55f548191f290fa8e24681aba3f71ae5512c0f86afddae9365b135f893b013551e5088a9e02b4949becb7a3fdb642bbffb427537

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3HJAG.tmp\dotnet60desktop_x64.exe

Filesize
55.2MB

MD5
3093812bb6e69c4b88007435595d16ff

SHA1
aba98aaa3db700d41eb067280f86f35b7ddea550

SHA256
7d30787fd4b338186a145aa5d2f4703a0ab02bbd29c46415cabca369b5195373

SHA512
53d5f38ebec2675d43c618c32533f3b8684384839b4bfa83902d06be535a56410255e26ee0a4844c170f7536be9039a126eebec8577a781b8a0c30c00a7ad20e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3HJAG.tmp\dotnet60desktop_x64.exe

Filesize
55.2MB

MD5
3093812bb6e69c4b88007435595d16ff

SHA1
aba98aaa3db700d41eb067280f86f35b7ddea550

SHA256
7d30787fd4b338186a145aa5d2f4703a0ab02bbd29c46415cabca369b5195373

SHA512
53d5f38ebec2675d43c618c32533f3b8684384839b4bfa83902d06be535a56410255e26ee0a4844c170f7536be9039a126eebec8577a781b8a0c30c00a7ad20e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3HJAG.tmp\netcorecheck_x64.exe

Filesize
140KB

MD5
de54c196cfe1bd90152460b6242f5ad3

SHA1
e1bc2721b1ba41b8157ce72bb6d56bf55b7b4785

SHA256
3b26fe9d187ce9e8275e970bd3884acaae4e0bbf7089759b3378ba44201a3b8b

SHA512
88a29b3788ad4da5f0581bc1e58dcd860060aaf1d3e3def3741d256652b8f257203e1e2b378dd7d38ae648f2efbd11268717a4107b4edb873babd8441b7f68d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3HJAG.tmp\netcorecheck_x64.exe

Filesize
140KB

MD5
de54c196cfe1bd90152460b6242f5ad3

SHA1
e1bc2721b1ba41b8157ce72bb6d56bf55b7b4785

SHA256
3b26fe9d187ce9e8275e970bd3884acaae4e0bbf7089759b3378ba44201a3b8b

SHA512
88a29b3788ad4da5f0581bc1e58dcd860060aaf1d3e3def3741d256652b8f257203e1e2b378dd7d38ae648f2efbd11268717a4107b4edb873babd8441b7f68d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K2070.tmp\LenovoLegionToolkitSetup.tmp

Filesize
3.0MB

MD5
6aec012f693d8b302b035e4e154a453a

SHA1
ba29940254a32818a688bc868f8cea4cecf61e2e

SHA256
5379c211841778c16cc8255152b92178f8054161e9443354a60c48ea03f8bfbe

SHA512
96d47426295967b788cfa3d0f5a0a387bd3c2830cfb7461b7860c0f2f23bc45b2c4781d743cb63a9cb0b30b86047cb1572ed1343b2e36820ad66c67267d956f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K2070.tmp\LenovoLegionToolkitSetup.tmp

Filesize
3.0MB

MD5
6aec012f693d8b302b035e4e154a453a

SHA1
ba29940254a32818a688bc868f8cea4cecf61e2e

SHA256
5379c211841778c16cc8255152b92178f8054161e9443354a60c48ea03f8bfbe

SHA512
96d47426295967b788cfa3d0f5a0a387bd3c2830cfb7461b7860c0f2f23bc45b2c4781d743cb63a9cb0b30b86047cb1572ed1343b2e36820ad66c67267d956f9

Download Submit
C:\Windows\Installer\MSI6CE3.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI7D42.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI7EBA.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8381.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI85F3.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8A4C.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8D4B.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIA5E8.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Temp\{4CF46ADE-1059-4AE9-811D-E05E30636B0A}\.be\windowsdesktop-runtime-6.0.8-win-x64.exe

Filesize
610KB

MD5
66b3596d1de143044c6b73e59dd11ff3

SHA1
d5adc16f67d7528255b1f239370696c109e7cca6

SHA256
cdcaac701828a2027b50f4a256d86b7f53498b7fcb3b53f8d9f0e8ac74866cd7

SHA512
2e50df4c06bef357c1c2ad25b2b350f9f01d55b5e0ad5b461a0b014acb73881645110c5f0c3e0307917cad99a12f0626ca38519c4928ebbd8d7dd290b355c3c7

Download Submit
C:\Windows\Temp\{4CF46ADE-1059-4AE9-811D-E05E30636B0A}\.be\windowsdesktop-runtime-6.0.8-win-x64.exe

Filesize
610KB

MD5
66b3596d1de143044c6b73e59dd11ff3

SHA1
d5adc16f67d7528255b1f239370696c109e7cca6

SHA256
cdcaac701828a2027b50f4a256d86b7f53498b7fcb3b53f8d9f0e8ac74866cd7

SHA512
2e50df4c06bef357c1c2ad25b2b350f9f01d55b5e0ad5b461a0b014acb73881645110c5f0c3e0307917cad99a12f0626ca38519c4928ebbd8d7dd290b355c3c7

Download Submit
C:\Windows\Temp\{4CF46ADE-1059-4AE9-811D-E05E30636B0A}\dotnet_host_6.0.8_win_x64.msi

Filesize
736KB

MD5
e601c40760a5abaaa6f3426fce6b796b

SHA1
1fce0cebd73a756efb4d60d65a09219eb2f00e5a

SHA256
7643ae53ae1af3a4e62d30931b5e0a61d7a62a05fdf8c413b61d05ae0525a39e

SHA512
9515029d9aa1bf374518a011087f9ac6771c709020b6246aa6fb67b351c5cbe3b16bfc7e4c6a8b2654d0cd5b0c63c86aade86da4da661df7b60273d9ee6d16f6

Download Submit
C:\Windows\Temp\{4CF46ADE-1059-4AE9-811D-E05E30636B0A}\dotnet_hostfxr_6.0.8_win_x64.msi

Filesize
804KB

MD5
a8451034a2623cb2058bc47b9d461196

SHA1
db396777dbbb8c15731454ed7c68dcc63b46edf9

SHA256
143596186bfe0cb5dacab7b5b0a50e5d8e2a236faa6b8911702f24cb13e3e825

SHA512
b974bbc26397a27d7101b5c3a3321f6dad50cf1cd61aa844ce80208b9911566503b9e95bb6066dcc2dd2e02b4b4f866019d0afd86d2d1e894cc210cb72f1d455

Download Submit
C:\Windows\Temp\{4CF46ADE-1059-4AE9-811D-E05E30636B0A}\dotnet_runtime_6.0.8_win_x64.msi

Filesize
26.2MB

MD5
b8d0c9a8a471d78d7b6c4976ce22e3c0

SHA1
eff2d2f89b2873b582b13b19de23abf32384a167

SHA256
d6efb6ee0c9720e3256d7ef62b1db81d0a4bebb8615a14a06230e0bfe39cb92a

SHA512
cafa373b359fe0a68fcfe300424bbc3847c58cf3b407e420281a32e7c9be2c9ea89c08dda274feaacda07211cb30a16d13f7c4f3f6e08d2e83f883d5accfd956

Download Submit
C:\Windows\Temp\{4CF46ADE-1059-4AE9-811D-E05E30636B0A}\windowsdesktop_runtime_6.0.8_win_x64.msi

Filesize
28.6MB

MD5
de278f8bd9266240e83e6db16bba7044

SHA1
28ecc5f0abe0707f68def731495b068f9d4291e7

SHA256
0fdd572fb5599e13aa2b3748ec027e0df7d34aad5b761dfef3a120b03071221c

SHA512
974704de2877bed14dba480126d1744e7307c9186c3fe424bab1b05ce83b20d0fee753ca6b413e389805445a2f707979190710fe804c47bdbf1dec024d71ab63

Download Submit
C:\Windows\Temp\{B574C99F-1DE3-4EB7-8A74-CF8B65926634}\.cr\dotnet60desktop_x64.exe

Filesize
610KB

MD5
66b3596d1de143044c6b73e59dd11ff3

SHA1
d5adc16f67d7528255b1f239370696c109e7cca6

SHA256
cdcaac701828a2027b50f4a256d86b7f53498b7fcb3b53f8d9f0e8ac74866cd7

SHA512
2e50df4c06bef357c1c2ad25b2b350f9f01d55b5e0ad5b461a0b014acb73881645110c5f0c3e0307917cad99a12f0626ca38519c4928ebbd8d7dd290b355c3c7

Download Submit
C:\Windows\Temp\{B574C99F-1DE3-4EB7-8A74-CF8B65926634}\.cr\dotnet60desktop_x64.exe

Filesize
610KB

MD5
66b3596d1de143044c6b73e59dd11ff3

SHA1
d5adc16f67d7528255b1f239370696c109e7cca6

SHA256
cdcaac701828a2027b50f4a256d86b7f53498b7fcb3b53f8d9f0e8ac74866cd7

SHA512
2e50df4c06bef357c1c2ad25b2b350f9f01d55b5e0ad5b461a0b014acb73881645110c5f0c3e0307917cad99a12f0626ca38519c4928ebbd8d7dd290b355c3c7

Download Submit
\Program Files\dotnet\host\fxr\6.0.8\hostfxr.dll

Filesize
366KB

MD5
4fc4fb4d77a7ef49ee5133b5b6a194ed

SHA1
8c63016cd28a0c3896ccb5f98d5aaa08a9e281d8

SHA256
cc39ab9baa38b4cf39dbc34dcc920202c69570baf67f4f947c02b8fdf0e61fc5

SHA512
5c647ce6a15a61d9bb10660aa29eafe5f2509cc63408efb3659b5036a21d268b9ffe825a4bf67d9c8e78005e7a414cc782a20538a135b9a8b0ed6329702c9fc7

Download Submit
\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\System.Private.CoreLib.dll

Filesize
10.1MB

MD5
1af8685bb8e67c6841b1f2150b0aec4c

SHA1
3b15c45109cbb61b1600bafede5275f1947934c5

SHA256
30a3a396ea1edd01ddbef642decf688def749c685880f4037c037d94aa7f0269

SHA512
404cdc52176cd34336c876fff884db6035b888da5d7ea102609317b4feca18a0d9ee882cf45cf317cbc3e8f1de339762bf03bd8a946fd04e23c21964e7a43686

Download Submit
\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\clrjit.dll

Filesize
1.4MB

MD5
1972eb629b743754e28318ecf7e04628

SHA1
783f6b6f1de5168cb21b3fb7d929ad6899524d06

SHA256
e0d30abf7dde33dfe2165f8e9e63220ff9f2738ea81570275e7f1fdceabdebaf

SHA512
db2fcc3b5b0426b22fe776b0edf78c23c0ab4706217c5dbf6d0823427ecb7e3225d8bf112f25b2e81edc8fec39805335c2e4331b0ce9217de8e5ca87069a0c7d

Download Submit
\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\coreclr.dll

Filesize
4.9MB

MD5
136ae18a33f456a70463a396474f3600

SHA1
276a61e8222a3d77c238a22795268fcf27d9f1ac

SHA256
35ec15d344f99d4c076c2ca47751cb7aa9d0cf75227cc5e354ae7d7c00c0bf37

SHA512
a31f7d8196cbf9980c3bdfbe0443d455767392c9ff83c7e527f410e35ec14e563e19bceef74faf71b55ea987be66bafd4073dade56fe5afeede8a500bc61cf53

Download Submit
\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.8\hostpolicy.dll

Filesize
383KB

MD5
8920df1b3ab0660090b204d2881fbb4e

SHA1
ec8ec146c4226aece015d3b00439d0b505083dd1

SHA256
5b72566804a8cb4ac2d5d28438a6d197456e29299758dae57140b1c5ab84bbb4

SHA512
3ef742965369ca788e2ac229bf3f19648cc145f0a12f36c64f3e617039f32bccc0f24bc9736519ef7c12cd4e18831678d021d0268801bed4b593cdea1ee35ed2

Download Submit
\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\PresentationFramework.dll

Filesize
15.5MB

MD5
dd719cfff212f6b7bb52eda8bb4d40c6

SHA1
dff1a728aa2759cbe0abb03de1f079c429dd6eff

SHA256
25246ad282c8960ec980bee3651e80b0bd9b9c9c15fa2c43731d4d1ef309f6c9

SHA512
2d00767b2aab274e7c5fb68cfc89cd4b125557370ef96fd88289a1d7802544020dfa57da0c60f6c9df7f161c9c84a4adae535cd0fffd2db726885024293e8e1f

Download Submit
\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\System.Xaml.dll

Filesize
1.4MB

MD5
93bec1198a4b46e566f6e44a164a837b

SHA1
3458ab682811d21a3e761b75ce453a5498ccafb2

SHA256
0676dbb9a0173ae925e18c6c6df53d8c8a054595dc128baa11036ccfa394d77d

SHA512
8ffa49c305bf15a046a95ac72e5fcaa868d0da721871382f654fac91335ebc366562b882f2976e9aba00248298a156734c9503d15c30bc0afaebd9c408dbdce1

Download Submit
\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.8\WindowsBase.dll

Filesize
2.2MB

MD5
f4454ebe54237727555b9d072363e397

SHA1
fc50be8a8b3e31ec7c8305471dd4c8da82b69dc0

SHA256
ee2d649d35da26a0cea0f68c003c0a416f85e39619428f1eb045d2f2b4fcd1b4

SHA512
936475cc808eb8ca4a318c95c7222e7b0a26c6bfbc786e19349b9323319c750dcb4105f9331b18db5d01bea17a101c2117d8a953ec3d795665ccf30b9753aa4e

Download Submit
\Users\Admin\AppData\Local\Programs\LenovoLegionToolkit\Lenovo Legion Toolkit.dll

Filesize
443KB

MD5
03b1f6f2592eda4d4601454cdd9be661

SHA1
80bd38537be3d5e26c78f5816bad501bd89d2d2c

SHA256
edaa00c4eada28ec444991fb1ba264c844cbbb319cd6c821dd6e5051beb485f0

SHA512
87faa6f6ef9772e4593e1797aad378f844365a036ce9ea675c4cc9c5219b72f195f2cc2bd7a1e6281ce9e05453b4f8d86bbb77b09b8c895f903797463eacced2

Download Submit
\Users\Admin\AppData\Local\Programs\LenovoLegionToolkit\Lenovo Legion Toolkit.dll

Filesize
443KB

MD5
03b1f6f2592eda4d4601454cdd9be661

SHA1
80bd38537be3d5e26c78f5816bad501bd89d2d2c

SHA256
edaa00c4eada28ec444991fb1ba264c844cbbb319cd6c821dd6e5051beb485f0

SHA512
87faa6f6ef9772e4593e1797aad378f844365a036ce9ea675c4cc9c5219b72f195f2cc2bd7a1e6281ce9e05453b4f8d86bbb77b09b8c895f903797463eacced2

Download Submit
\Windows\Installer\MSI6CE3.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI7D42.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI7EBA.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI8381.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI85F3.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI8A4C.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI8D4B.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSIA5E8.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Temp\{4CF46ADE-1059-4AE9-811D-E05E30636B0A}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
memory/1776-152-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1776-137-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-733-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1776-117-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-228-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1776-118-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-119-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-120-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-121-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-122-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-123-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-124-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-125-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-126-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-128-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-127-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-129-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-130-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-131-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-132-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-133-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-134-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-138-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-136-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-135-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-139-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-140-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-141-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-142-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-143-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-144-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-145-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-146-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-147-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-155-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-154-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-153-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-116-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-148-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-151-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-149-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4812-163-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-173-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-162-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-164-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-165-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-166-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-167-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-182-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-168-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-160-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-169-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-170-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-171-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-161-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-172-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-174-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-159-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-175-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-176-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-177-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-178-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-158-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-179-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-180-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-181-0x0000000077C40000-0x0000000077DCE000-memory.dmp

Filesize
1.6MB

Download