asyncrat | b083bc071898398980cc296335bfa73553bf87e2f0826ed01ad2f71e3f314f04

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2023 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AssistSetup.exe
Size

28.8MB
MD5

51643b94c22b0d6a0aaa53dc15308f8d
SHA1

bf0830f651cd289a90a46d7dd5f9c24bae495fdb
SHA256

b083bc071898398980cc296335bfa73553bf87e2f0826ed01ad2f71e3f314f04
SHA512

592e926fded2bdcadaffb65877e370c01adfff77f5ea99f626c765d439beb1050de395f3157da3252cb56bfa79f6926316593acfe7108f31a995ac335751380a
SSDEEP

786432:NlEMdXj09/AYxfSqq/Z+r8FwH/+CEwWFsS/ZxeIH83Rs:NlEMdX5RquJycwW+IZcIYi

Score

10^/10

asyncrat coreentity discovery persistence rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

CoreEntity .NET Packer 2 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Assist\staging\app-1.1.1-live\Assist.exe	coreentity
C:\Users\Admin\AppData\Local\Assist\staging\app-1.1.1-live\Assist.exe	coreentity

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Assist\staging\app-1.1.1-live\Assist.exe	asyncrat
C:\Users\Admin\AppData\Local\Assist\staging\app-1.1.1-live\Assist.exe	asyncrat

Downloads MZ/PE file
Executes dropped EXE 6 IoCs

Processes:

squ7DEF.tmp.exenet7-x64.exenet7-x64.exewindowsdesktop-runtime-7.0.2-win-x64.exeAssist.exeAssist.exe

pid process

4260 squ7DEF.tmp.exe
4128 net7-x64.exe
1976 net7-x64.exe
5060 windowsdesktop-runtime-7.0.2-win-x64.exe
2956 Assist.exe
3172 Assist.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

net7-x64.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	net7-x64.exe

Loads dropped DLL 64 IoCs

Processes:

net7-x64.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeAssist.exeAssist.exe

pid	process
1976	net7-x64.exe
4880	MsiExec.exe
4880	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe
1124	MsiExec.exe
1124	MsiExec.exe
3972	MsiExec.exe
3972	MsiExec.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
2956	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe
3172	Assist.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

windowsdesktop-runtime-7.0.2-win-x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	windowsdesktop-runtime-7.0.2-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{007ff79f-5c20-48a1-92da-a78201768353} = "\"C:\\ProgramData\\Package Cache\\{007ff79f-5c20-48a1-92da-a78201768353}\\windowsdesktop-runtime-7.0.2-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-7.0.2-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\es\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\it\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\zh-Hant\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\pl\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\cs\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\cs\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Security.Cryptography.Cng.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\fr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\it\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\D3DCompiler_47_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\zh-Hant\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\de\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\coreclr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\System.Security.Cryptography.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Collections.Specialized.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\UIAutomationTypes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\zh-Hans\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\System.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\PresentationFramework.Aero.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Resources.Writer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Private.CoreLib.dll	msiexec.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.2\hostfxr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\de\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\pl\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\Microsoft.NETCore.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Text.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Runtime.Serialization.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\ko\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\tr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\pl\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\fr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\ko\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\ja\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Reflection.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\PresentationNative_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\fr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\pt-BR\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\zh-Hant\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Security.Cryptography.Encoding.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.2\tr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Security.Cryptography.OpenSsl.dll	msiexec.exe

Drops file in Windows directory 31 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI70A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4036.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5731e1.msi	msiexec.exe
File created	C:\Windows\Installer\e5731e4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5731dd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5731e9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI605A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4F3D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI51DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5627.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D95.tmp	msiexec.exe
File created	C:\Windows\Installer\e5731e0.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BE394B10-AD5D-4503-9AA9-E79F953B30E3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5028.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5731e5.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5731e5.msi	msiexec.exe
File created	C:\Windows\Installer\e5731e9.msi	msiexec.exe
File created	C:\Windows\Installer\e5731ec.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4AD6.tmp	msiexec.exe
File created	C:\Windows\Installer\e5731e1.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F0719345-342D-4A57-8EE4-30BF4FA3FBE9}	msiexec.exe
File created	C:\Windows\Installer\e5731e8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5964.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B7177578-AF27-44BF-A0B1-8B9D6AF7ECC3}	msiexec.exe
File created	C:\Windows\Installer\e5731dd.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AE2D80C7-F19D-463F-B48F-3F343806721C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D0A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI54DE.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exewindowsdesktop-runtime-7.0.2-win-x64.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C08D2EAD91FF3644BF8F343836027C1\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01B493EBD5DA3054A99A7EF959B3033E\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4E3F426DBD05F2A509C6867B91443826\5439170FD24375A4E84E03FBF43ABF9E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8757717B72FAFB440A1BB8D9A67FCE3C\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C08D2EAD91FF3644BF8F343836027C1\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01B493EBD5DA3054A99A7EF959B3033E\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5439170FD24375A4E84E03FBF43ABF9E\Version = "940298341"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\46FB7FF272F5025589435C618ADCE0DB\8757717B72FAFB440A1BB8D9A67FCE3C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8757717B72FAFB440A1BB8D9A67FCE3C\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8757717B72FAFB440A1BB8D9A67FCE3C\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\46FB7FF272F5025589435C618ADCE0DB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.11.53349_x64\ = "{AE2D80C7-F19D-463F-B48F-3F343806721C}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C08D2EAD91FF3644BF8F343836027C1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01B493EBD5DA3054A99A7EF959B3033E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4E3F426DBD05F2A509C6867B91443826	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5439170FD24375A4E84E03FBF43ABF9E\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\DisplayName = "Microsoft .NET Host - 7.0.2 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5439170FD24375A4E84E03FBF43ABF9E\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C08D2EAD91FF3644BF8F343836027C1\PackageCode = "0BFA2B7598007FC4A86E6030C31B8516"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C08D2EAD91FF3644BF8F343836027C1\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5439170FD24375A4E84E03FBF43ABF9E\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\Dependents	windowsdesktop-runtime-7.0.2-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\01B493EBD5DA3054A99A7EF959B3033E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01B493EBD5DA3054A99A7EF959B3033E\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01B493EBD5DA3054A99A7EF959B3033E\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{BE394B10-AD5D-4503-9AA9-E79F953B30E3}v56.11.53349\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.11.53349_x64	windowsdesktop-runtime-7.0.2-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64	windowsdesktop-runtime-7.0.2-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C08D2EAD91FF3644BF8F343836027C1\ProductName = "Microsoft .NET Runtime - 7.0.2 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.11.53361_x64\Version = "56.11.53361"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_56.11.53361_x64	windowsdesktop-runtime-7.0.2-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5439170FD24375A4E84E03FBF43ABF9E\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5439170FD24375A4E84E03FBF43ABF9E\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8757717B72FAFB440A1BB8D9A67FCE3C\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{007ff79f-5c20-48a1-92da-a78201768353}	windowsdesktop-runtime-7.0.2-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.11.53349_x64\Version = "56.11.53349"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.11.53349_x64\Dependents	windowsdesktop-runtime-7.0.2-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5439170FD24375A4E84E03FBF43ABF9E\PackageCode = "E9810EDD8CB18DD4EBD907117CFAB54C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{007ff79f-5c20-48a1-92da-a78201768353}\ = "{007ff79f-5c20-48a1-92da-a78201768353}"	windowsdesktop-runtime-7.0.2-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C08D2EAD91FF3644BF8F343836027C1\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C08D2EAD91FF3644BF8F343836027C1\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{AE2D80C7-F19D-463F-B48F-3F343806721C}v56.11.53349\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5439170FD24375A4E84E03FBF43ABF9E\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_56.11.53361_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01B493EBD5DA3054A99A7EF959B3033E\Version = "940298341"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.11.53349_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C08D2EAD91FF3644BF8F343836027C1\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{AE2D80C7-F19D-463F-B48F-3F343806721C}v56.11.53349\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5439170FD24375A4E84E03FBF43ABF9E\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.11.53361_x64\Dependents\{007ff79f-5c20-48a1-92da-a78201768353}	windowsdesktop-runtime-7.0.2-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{007ff79f-5c20-48a1-92da-a78201768353}\DisplayName = "Microsoft Windows Desktop Runtime - 7.0.2 (x64)"	windowsdesktop-runtime-7.0.2-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C08D2EAD91FF3644BF8F343836027C1\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C08D2EAD91FF3644BF8F343836027C1\SourceList\PackageName = "dotnet-runtime-7.0.2-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.11.53349_x64\Dependents	windowsdesktop-runtime-7.0.2-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5439170FD24375A4E84E03FBF43ABF9E\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C08D2EAD91FF3644BF8F343836027C1\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.11.53349_x64\Version = "56.11.53349"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\Dependents\{007ff79f-5c20-48a1-92da-a78201768353}	windowsdesktop-runtime-7.0.2-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01B493EBD5DA3054A99A7EF959B3033E\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.11.53361_x64\ = "{B7177578-AF27-44BF-A0B1-8B9D6AF7ECC3}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8757717B72FAFB440A1BB8D9A67FCE3C\ProductName = "Microsoft Windows Desktop Runtime - 7.0.2 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8757717B72FAFB440A1BB8D9A67FCE3C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ED3C087F2FE545B7A4672A6064363CD5\7C08D2EAD91FF3644BF8F343836027C1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.11.53349_x64\ = "{BE394B10-AD5D-4503-9AA9-E79F953B30E3}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.11.53349_x64\Dependents\{007ff79f-5c20-48a1-92da-a78201768353}	windowsdesktop-runtime-7.0.2-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\ = "{F0719345-342D-4A57-8EE4-30BF4FA3FBE9}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5439170FD24375A4E84E03FBF43ABF9E\SourceList\PackageName = "dotnet-host-7.0.2-win-x64.msi"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exesqu7DEF.tmp.exeAssist.exetaskmgr.exe

pid	process
1072	msiexec.exe
1072	msiexec.exe
1072	msiexec.exe
1072	msiexec.exe
1072	msiexec.exe
1072	msiexec.exe
1072	msiexec.exe
1072	msiexec.exe
4260	squ7DEF.tmp.exe
4260	squ7DEF.tmp.exe
4260	squ7DEF.tmp.exe
4260	squ7DEF.tmp.exe
3172	Assist.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

squ7DEF.tmp.exewindowsdesktop-runtime-7.0.2-win-x64.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	4260	squ7DEF.tmp.exe
Token: SeShutdownPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeSecurityPrivilege	1072	msiexec.exe
Token: SeCreateTokenPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeLockMemoryPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeMachineAccountPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeTcbPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeSecurityPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeTakeOwnershipPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeLoadDriverPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeSystemProfilePrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeSystemtimePrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeProfSingleProcessPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeIncBasePriorityPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeCreatePagefilePrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeCreatePermanentPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeBackupPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeRestorePrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeShutdownPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeDebugPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeAuditPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeSystemEnvironmentPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeChangeNotifyPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeRemoteShutdownPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeUndockPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeSyncAgentPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeEnableDelegationPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeManageVolumePrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeImpersonatePrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeCreateGlobalPrivilege	5060	windowsdesktop-runtime-7.0.2-win-x64.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

squ7DEF.tmp.exenet7-x64.exetaskmgr.exe

pid	process
4260	squ7DEF.tmp.exe
1976	net7-x64.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe
5000	taskmgr.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

AssistSetup.exesqu7DEF.tmp.exenet7-x64.exenet7-x64.exemsiexec.exe

description	pid	process	target process
PID 4328 wrote to memory of 4260	4328	AssistSetup.exe	squ7DEF.tmp.exe
PID 4328 wrote to memory of 4260	4328	AssistSetup.exe	squ7DEF.tmp.exe
PID 4328 wrote to memory of 4260	4328	AssistSetup.exe	squ7DEF.tmp.exe
PID 4260 wrote to memory of 4128	4260	squ7DEF.tmp.exe	net7-x64.exe
PID 4260 wrote to memory of 4128	4260	squ7DEF.tmp.exe	net7-x64.exe
PID 4260 wrote to memory of 4128	4260	squ7DEF.tmp.exe	net7-x64.exe
PID 4128 wrote to memory of 1976	4128	net7-x64.exe	net7-x64.exe
PID 4128 wrote to memory of 1976	4128	net7-x64.exe	net7-x64.exe
PID 4128 wrote to memory of 1976	4128	net7-x64.exe	net7-x64.exe
PID 1976 wrote to memory of 5060	1976	net7-x64.exe	windowsdesktop-runtime-7.0.2-win-x64.exe
PID 1976 wrote to memory of 5060	1976	net7-x64.exe	windowsdesktop-runtime-7.0.2-win-x64.exe
PID 1976 wrote to memory of 5060	1976	net7-x64.exe	windowsdesktop-runtime-7.0.2-win-x64.exe
PID 1072 wrote to memory of 4880	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 4880	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 4880	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 4908	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 4908	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 4908	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1124	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1124	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1124	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 3972	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 3972	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 3972	1072	msiexec.exe	MsiExec.exe
PID 4260 wrote to memory of 2956	4260	squ7DEF.tmp.exe	Assist.exe
PID 4260 wrote to memory of 2956	4260	squ7DEF.tmp.exe	Assist.exe
PID 4260 wrote to memory of 3172	4260	squ7DEF.tmp.exe	Assist.exe
PID 4260 wrote to memory of 3172	4260	squ7DEF.tmp.exe	Assist.exe

C:\Users\Admin\AppData\Local\Temp\AssistSetup.exe
"C:\Users\Admin\AppData\Local\Temp\AssistSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4328

C:\Users\Admin\AppData\Local\Temp\squ7DEF.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\squ7DEF.tmp.exe" --setup "C:\Users\Admin\AppData\Local\Temp\AssistSetup.exe" --setupOffset 348672
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4260

C:\Users\Admin\AppData\Local\Temp\Clowd.Squirrel\temp.1\net7-x64.exe
"C:\Users\Admin\AppData\Local\Temp\Clowd.Squirrel\temp.1\net7-x64.exe" /passive /norestart /showrmui
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128

C:\Windows\Temp\{8FDBF2DF-5DF1-4CFE-BD95-C580AD46D1DE}\.cr\net7-x64.exe
"C:\Windows\Temp\{8FDBF2DF-5DF1-4CFE-BD95-C580AD46D1DE}\.cr\net7-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Clowd.Squirrel\temp.1\net7-x64.exe" -burn.filehandle.attached=536 -burn.filehandle.self=544 /passive /norestart /showrmui
4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\Temp\{99FA2933-A6B9-44B4-A37E-491F0818D802}\.be\windowsdesktop-runtime-7.0.2-win-x64.exe
"C:\Windows\Temp\{99FA2933-A6B9-44B4-A37E-491F0818D802}\.be\windowsdesktop-runtime-7.0.2-win-x64.exe" -q -burn.elevated BurnPipe.{DC3D2FED-3D31-4A23-A453-51551FEE2AC2} {2FB6B1AE-01C9-420A-A55D-A07109CCF818} 1976
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Users\Admin\AppData\Local\Assist\staging\app-1.1.1-live\Assist.exe
"C:\Users\Admin\AppData\Local\Assist\staging\app-1.1.1-live\Assist.exe" --squirrel-install 1.1.1-live
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956

C:\Users\Admin\AppData\Local\Assist\current\Assist.exe
"C:\Users\Admin\AppData\Local\Assist\current\Assist.exe" --squirrel-firstrun
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3172

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 03720BE27A0A6862DC1B877EA6723CDF
2⤵
- Loads dropped DLL
PID:4880

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding B3CC6D0123EE5F46C6DCC645FD51D243
2⤵
- Loads dropped DLL
PID:4908

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 84AB74585D23F16E8D3E3D1631DF80C4
2⤵
- Loads dropped DLL
PID:1124

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding FC8BBDA0111C202E9AC46F7FA8413F1E
2⤵
- Loads dropped DLL
PID:3972

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5000

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\dotnet\host\fxr\7.0.2\hostfxr.dll
Filesize
373KB

MD5
a319af7ac377a40534618677567a6fd4

SHA1
16ed6905078edbcb48ccc15145cfe1d344f82b17

SHA256
cea44470b8c5f86b774ff20fed4764daa19e148ee645725fac34c0bb999576b0

SHA512
3ed47f35cc82494021308561d46c73afef1c5aace6f9012ceb211d78396dc6a1a1289d4155549b1028e419d28f8e0976d8995142d85c1d34d232efba08e4b75f

Download Submit
C:\Program Files\dotnet\host\fxr\7.0.2\hostfxr.dll
Filesize
373KB

MD5
a319af7ac377a40534618677567a6fd4

SHA1
16ed6905078edbcb48ccc15145cfe1d344f82b17

SHA256
cea44470b8c5f86b774ff20fed4764daa19e148ee645725fac34c0bb999576b0

SHA512
3ed47f35cc82494021308561d46c73afef1c5aace6f9012ceb211d78396dc6a1a1289d4155549b1028e419d28f8e0976d8995142d85c1d34d232efba08e4b75f

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\Microsoft.NETCore.App.deps.json
Filesize
27KB

MD5
9c442632205ec08c7e3016146fa203e3

SHA1
35806a46a668c780112051cb15d818985ecfe573

SHA256
246e5558699622194f6f89a8cc04d1c5fd979def828c494ebf828f07bf534b92

SHA512
a45cf29c72764e788eb6a1b6694769e52d49a15ff0704077b357fb1147fdbc7065c3e821145f223573da71e2fd640099d516a35ff4771f55e8afffb71046f8e6

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\Microsoft.NETCore.App.runtimeconfig.json
Filesize
159B

MD5
01da0d56ab33c0ed0e7ac85e5244190f

SHA1
9e1e4b59e590038f769e5fa01fb326109a7f38e5

SHA256
7133274dc5efab688a6efe2f43ca33e78a2498ef39efcad231b0e07ad2c26d17

SHA512
e11967ba33c719da1681a7f98056d40f450788d9b7c8b2f580d8bc7998fc35a78c53fc970301b097c527fab79fd477adad4eafcd75b4bb376d33c3fece9e8926

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Collections.Concurrent.dll
Filesize
258KB

MD5
255b2a00037d48cd364c1795961d1889

SHA1
e7d189b062775495424e550d69650734337b0da7

SHA256
75e5c430b05169ac1b72542e7077505f032801191acb02fc039525347a7a848a

SHA512
0e97efaabe7d8f66ff679a1d163b43cb92524d906190ecd9be37c8bef24268043f6c7332498b8efe83330a9f6e4b93ac709b964e056f55846970bce98e7f497b

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Collections.Concurrent.dll
Filesize
258KB

MD5
255b2a00037d48cd364c1795961d1889

SHA1
e7d189b062775495424e550d69650734337b0da7

SHA256
75e5c430b05169ac1b72542e7077505f032801191acb02fc039525347a7a848a

SHA512
0e97efaabe7d8f66ff679a1d163b43cb92524d906190ecd9be37c8bef24268043f6c7332498b8efe83330a9f6e4b93ac709b964e056f55846970bce98e7f497b

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Collections.dll
Filesize
262KB

MD5
35b831e6f16526b330bd30d42a5babea

SHA1
760f4a190793ef84d98bc0cc81618bfb3be20243

SHA256
3ff62a074bd7a3a2a9904afe328a1ac6ce0fec3e85c038b81e5af2de34d90214

SHA512
c6fffb374e7452f8fe609b7b600868aded28bf59115b754c1b17210703a649ea991be0e9ff1566af63da2b76343b9e30138dd2dbe160483be0cbb13e8933f261

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Collections.dll
Filesize
262KB

MD5
35b831e6f16526b330bd30d42a5babea

SHA1
760f4a190793ef84d98bc0cc81618bfb3be20243

SHA256
3ff62a074bd7a3a2a9904afe328a1ac6ce0fec3e85c038b81e5af2de34d90214

SHA512
c6fffb374e7452f8fe609b7b600868aded28bf59115b754c1b17210703a649ea991be0e9ff1566af63da2b76343b9e30138dd2dbe160483be0cbb13e8933f261

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.ComponentModel.Primitives.dll
Filesize
82KB

MD5
7e29912864fea508b1ca8ad4140cdf3a

SHA1
b779761ed58a079ba30c38adb1c6fd6541bc0cab

SHA256
59c4921d5e677b686b4441f090a2e39b181f1299b933750d4757fe4c16ac3723

SHA512
5e3d48acf1cbde471cc6e96a0ae016fa7713cb756639d18abe9ff7946937d0d7511eea53ff6f3b9319877e910903296b5146918ff951363728b1be9ce451bf93

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.ComponentModel.Primitives.dll
Filesize
82KB

MD5
7e29912864fea508b1ca8ad4140cdf3a

SHA1
b779761ed58a079ba30c38adb1c6fd6541bc0cab

SHA256
59c4921d5e677b686b4441f090a2e39b181f1299b933750d4757fe4c16ac3723

SHA512
5e3d48acf1cbde471cc6e96a0ae016fa7713cb756639d18abe9ff7946937d0d7511eea53ff6f3b9319877e910903296b5146918ff951363728b1be9ce451bf93

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Numerics.Vectors.dll
Filesize
15KB

MD5
84f227b79cf06316209ed876d3fe587e

SHA1
a55bbe0f3bb3693062fed2f74a0b1955758ab9a1

SHA256
27e5973f7996c98f20b95d3822b675808683199904a47af07ebbf5eb44f94d6f

SHA512
e02e62c75976ed5b35958c2b8edb2fb508f5b659cbfd1eec0a313d15c8c446ab16335f0d8c74317f94cf0fa8a59b729d3b42ed5562853dda97861cc1701de54e

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.ObjectModel.dll
Filesize
82KB

MD5
48d5bfb175150f372de329b54784e77b

SHA1
6cc7ca145f64111230c9860682a6134eb8304761

SHA256
068103791156a4a1ec41d397ad3a81f0cb4345468f4754142cade80310038e3c

SHA512
a78c24fac9eaccc2813e0e696197c8f76b252e0d68932c8d243a0df740c47ab9b17c0a4c511526e0dbb0b65da86ab849b710cb078394cc6873dad11306957575

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.ObjectModel.dll
Filesize
82KB

MD5
48d5bfb175150f372de329b54784e77b

SHA1
6cc7ca145f64111230c9860682a6134eb8304761

SHA256
068103791156a4a1ec41d397ad3a81f0cb4345468f4754142cade80310038e3c

SHA512
a78c24fac9eaccc2813e0e696197c8f76b252e0d68932c8d243a0df740c47ab9b17c0a4c511526e0dbb0b65da86ab849b710cb078394cc6873dad11306957575

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Private.CoreLib.dll
Filesize
11.1MB

MD5
68844a413d4b1a4df8b0397bfa936656

SHA1
97f2ae2957c199e8357775015fc02ecb12db8429

SHA256
771adfb73d545dd3c1ef018846adf7525d830777568eb3a868d2874c4c36a9a2

SHA512
c8fdc03005bbc4999f206da0ede74b610678cee0b0086a24e1321308e201cc5eb950fd3e22cee50cead3454f38e228b9cd5e403ca521463124c6418b9e3bd477

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Private.CoreLib.dll
Filesize
11.1MB

MD5
68844a413d4b1a4df8b0397bfa936656

SHA1
97f2ae2957c199e8357775015fc02ecb12db8429

SHA256
771adfb73d545dd3c1ef018846adf7525d830777568eb3a868d2874c4c36a9a2

SHA512
c8fdc03005bbc4999f206da0ede74b610678cee0b0086a24e1321308e201cc5eb950fd3e22cee50cead3454f38e228b9cd5e403ca521463124c6418b9e3bd477

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Private.CoreLib.dll
Filesize
11.1MB

MD5
68844a413d4b1a4df8b0397bfa936656

SHA1
97f2ae2957c199e8357775015fc02ecb12db8429

SHA256
771adfb73d545dd3c1ef018846adf7525d830777568eb3a868d2874c4c36a9a2

SHA512
c8fdc03005bbc4999f206da0ede74b610678cee0b0086a24e1321308e201cc5eb950fd3e22cee50cead3454f38e228b9cd5e403ca521463124c6418b9e3bd477

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Private.Uri.dll
Filesize
258KB

MD5
5078da0b3f7b575e4491d3d66c17d8a0

SHA1
f9e691c325740b6e81476787d722c6e7284a44e9

SHA256
5512099b7394a618b768d77d203a168c85a08bee97d38fc8ba190fcc24884602

SHA512
0f86a381044c4b638a04e58a6b57115df3626d30e0283129154316056a36c922047213d164a11addc3105cd9385ce26a40f877f08d9bdabe0653063c68375dd8

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Runtime.InteropServices.RuntimeInformation.dll
Filesize
15KB

MD5
0e505c05c81cde063d8fb08cb225de62

SHA1
f0c6f407a68eac26dba517c879df7ddac118f5ec

SHA256
fe114a61f67cbd0f3339965c18c7df1814f7c7f5446a647ab361a8d05d2390ee

SHA512
d1d9a04299b56c817f1935946f0e10cc451ca904d67719f7b397aa32931c5fa9dbfdbfa9cc5e5aae7497e5c79b18f6ff1cc45f058493d113b52fb123cf0a82b9

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Runtime.InteropServices.dll
Filesize
62KB

MD5
db61deef6560c46fcb52891e575f2df2

SHA1
a801aac33102582a4a17e2bfd2b3e41ce65a68bf

SHA256
33360cd48c12b26e493856135fc7ba426f43198408e446984267c8c63636357d

SHA512
5df9dfa06ab68ccaca6ebd148a8b095d3d183c392f607c7ae58c35cd5b46ff351475b628fd48c4ce7beb3e6630f053b6bde069ed29f49e6c214a8475e7d7a99f

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Runtime.InteropServices.dll
Filesize
62KB

MD5
db61deef6560c46fcb52891e575f2df2

SHA1
a801aac33102582a4a17e2bfd2b3e41ce65a68bf

SHA256
33360cd48c12b26e493856135fc7ba426f43198408e446984267c8c63636357d

SHA512
5df9dfa06ab68ccaca6ebd148a8b095d3d183c392f607c7ae58c35cd5b46ff351475b628fd48c4ce7beb3e6630f053b6bde069ed29f49e6c214a8475e7d7a99f

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Runtime.dll
Filesize
42KB

MD5
423bb028f37d49ab71a7b2c6da196976

SHA1
23cf26b8795993b0319e3ccf1393720ccde76cda

SHA256
8a1064aa4a5c802b7f8ecfa26261be26ae5687d28b2db9f7737feb5144fa93ec

SHA512
f0e82aa54667cbcfdccd0919d1111ac34bd2636fde0d7113171bbc6ee241cd78943b15e196b7f3a14d6c01afac6eb5852bbbfa505fba824a8c7d38fe2a19903b

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Threading.dll
Filesize
86KB

MD5
20290e82b1b625b45b99f311dad928f2

SHA1
366c187b3baaa48d598d9b52305e26b2b963606d

SHA256
cc7615a1c2add5ea6a6bea72deba250530281439071f19b707f02dace892550e

SHA512
a8816429f9606251bb180eaedb5202d7c233d3c1f0ae3ac6575d26dc70f913145734ad5b659893e4b5c1ac7133557498b34b0ab5ada55d5df934e288d5023bb2

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\System.Threading.dll
Filesize
86KB

MD5
20290e82b1b625b45b99f311dad928f2

SHA1
366c187b3baaa48d598d9b52305e26b2b963606d

SHA256
cc7615a1c2add5ea6a6bea72deba250530281439071f19b707f02dace892550e

SHA512
a8816429f9606251bb180eaedb5202d7c233d3c1f0ae3ac6575d26dc70f913145734ad5b659893e4b5c1ac7133557498b34b0ab5ada55d5df934e288d5023bb2

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\clrjit.dll
Filesize
1.5MB

MD5
7b578d29fb995af3a3f0bfb1193e4eea

SHA1
188b6555604586e04466ccdbaeef037ab6f3c3f7

SHA256
b4dc6fb897d2a68411a6022fa53d5c4cc6f7023393d709b0d360ccecbd0ed480

SHA512
3dae824d9e070e09400ba0ab80af44df811c26bbc5bc45fda860adcdce3948faa1932124de7af2ff9d48c1927b5fca554cd117df7601eae129f680df210d8c8f

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\clrjit.dll
Filesize
1.5MB

MD5
7b578d29fb995af3a3f0bfb1193e4eea

SHA1
188b6555604586e04466ccdbaeef037ab6f3c3f7

SHA256
b4dc6fb897d2a68411a6022fa53d5c4cc6f7023393d709b0d360ccecbd0ed480

SHA512
3dae824d9e070e09400ba0ab80af44df811c26bbc5bc45fda860adcdce3948faa1932124de7af2ff9d48c1927b5fca554cd117df7601eae129f680df210d8c8f

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\coreclr.dll
Filesize
4.9MB

MD5
da2c02566fa6f1735f3124f5f08b7e44

SHA1
0d929129200ac415aa2a817d3ba7ebcf30ac7f5f

SHA256
c85328a6f4230dfea9ea0143adce479402faaa23a92df1a38f3b27068ebd3d74

SHA512
54f0f3df0e1976198970327b9d4e8ef9b9b1d7607438b4886b217ddc1ea472231f2187ecc4da19767511dee83b28fdb8f7226ed93672a3998604fe652b127027

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\coreclr.dll
Filesize
4.9MB

MD5
da2c02566fa6f1735f3124f5f08b7e44

SHA1
0d929129200ac415aa2a817d3ba7ebcf30ac7f5f

SHA256
c85328a6f4230dfea9ea0143adce479402faaa23a92df1a38f3b27068ebd3d74

SHA512
54f0f3df0e1976198970327b9d4e8ef9b9b1d7607438b4886b217ddc1ea472231f2187ecc4da19767511dee83b28fdb8f7226ed93672a3998604fe652b127027

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\hostpolicy.dll
Filesize
382KB

MD5
55515dacaaa4e3c089bdb0ee350be827

SHA1
3b5615745d14b8c4866f9f4720198d4d6d936c13

SHA256
3b64012e943098c84e0ae1be880dd7c3031510b73095a6dd25a8410efc9fb26d

SHA512
faeace9fc68b525c0157c1226b03ec284df611423937167d4ae6e4ba57b8cee45903835044ebb74518e888a8ce88e31f9b41fe38d92c326d12dd1363e75cfe7c

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.2\hostpolicy.dll
Filesize
382KB

MD5
55515dacaaa4e3c089bdb0ee350be827

SHA1
3b5615745d14b8c4866f9f4720198d4d6d936c13

SHA256
3b64012e943098c84e0ae1be880dd7c3031510b73095a6dd25a8410efc9fb26d

SHA512
faeace9fc68b525c0157c1226b03ec284df611423937167d4ae6e4ba57b8cee45903835044ebb74518e888a8ce88e31f9b41fe38d92c326d12dd1363e75cfe7c

Download Submit
C:\Users\Admin\AppData\Local\Assist\staging\app-1.1.1-live\Assist.exe
Filesize
28.6MB

MD5
e73e955c79dd3617c657a24c91d9ef41

SHA1
e2d2802f8730e6e532abbb71319d450968d7354d

SHA256
d1c861f91eb1b1259ab900e1d6e5c34c33fe0b1f2a9f8efce4fa520a2af9b0a1

SHA512
4f7d821e67a2f7419763f19145b4ea49d7d29d73b01d4a905e6b31b3a87a4859efb35204b6b188e4201240425cb14f0c7d9ae1f98a69ee6f0b5019b9f838c4ba

Download Submit
C:\Users\Admin\AppData\Local\Assist\staging\app-1.1.1-live\Assist.exe
Filesize
28.6MB

MD5
e73e955c79dd3617c657a24c91d9ef41

SHA1
e2d2802f8730e6e532abbb71319d450968d7354d

SHA256
d1c861f91eb1b1259ab900e1d6e5c34c33fe0b1f2a9f8efce4fa520a2af9b0a1

SHA512
4f7d821e67a2f7419763f19145b4ea49d7d29d73b01d4a905e6b31b3a87a4859efb35204b6b188e4201240425cb14f0c7d9ae1f98a69ee6f0b5019b9f838c4ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Clowd.Squirrel\temp.1\net7-x64.exe
Filesize
55.1MB

MD5
010901d39e3b471cc872359dedfb3c45

SHA1
82585e5d1734b9924f4b6fea4b56c9b958f55e3e

SHA256
f9837b126eac04dda9cabd96cf3c1684240476dc723272f9a9d692cc4fac500a

SHA512
f40a360ffbc9b3c21eed07f2400e595505377f467ad3f80377937b88ea89f1afd302c00fe5e4a0bf4b7e281cb1af3d2f79b3ced7ed408d97b465310719199447

Download Submit
C:\Users\Admin\AppData\Local\Temp\Clowd.Squirrel\temp.1\net7-x64.exe
Filesize
55.1MB

MD5
010901d39e3b471cc872359dedfb3c45

SHA1
82585e5d1734b9924f4b6fea4b56c9b958f55e3e

SHA256
f9837b126eac04dda9cabd96cf3c1684240476dc723272f9a9d692cc4fac500a

SHA512
f40a360ffbc9b3c21eed07f2400e595505377f467ad3f80377937b88ea89f1afd302c00fe5e4a0bf4b7e281cb1af3d2f79b3ced7ed408d97b465310719199447

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.2_(x64)_20230201070632_000_dotnet_runtime_7.0.2_win_x64.msi.log
Filesize
2KB

MD5
55ede9b9d3bf9effac3aede33edc4283

SHA1
7bd71597ae8951e6da15b818d73ec86c803fc8a1

SHA256
6d365bba8b734d71c9ca30960d8b69664c4fa76c905c91a77140346bdf33fe13

SHA512
8b3c177bc7f6f7bfee5f28690de28391a32d7c807047524440e39fc1a04c969b280fa2598dbf73382ee64f0b6a9ab229f66f997e6f0017b132758c4aec149f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.2_(x64)_20230201070632_001_dotnet_hostfxr_7.0.2_win_x64.msi.log
Filesize
2KB

MD5
91e4f7cce322fb92c05bc19563f87bd2

SHA1
6d157b0cfc6c7efce3df378233b25cbe45b380a7

SHA256
4b4254b1fd800a9d2c5d6107f61dcdf0598f72b4a405f26313ff3bc6dddee158

SHA512
13566290e538f0dc29d256124cdad1429cf4daef6616c0e4999f008c7e61829397cf1c1122324e128fa8acbec28b82e5a2d2f1126a0f083a6a57b3c6d76a9183

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.2_(x64)_20230201070632_002_dotnet_host_7.0.2_win_x64.msi.log
Filesize
2KB

MD5
7ee1f36ae20c81c0072afd1facb3b27d

SHA1
ae29b260d6a84a9978fa2dc3e52407ce2c5007a5

SHA256
722eea93c92a4a25f45ba3534b22402bceaa0325882079c51c41028bb5cfe99f

SHA512
ecc33086ee93208aea609d31a175414d4852a502e961d0c0a07f50f50168c9308df01f0914e49aca3ab20c6a9ee2306b09c2d5c6cef434054a185d80b46cba2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.2_(x64)_20230201070632_003_windowsdesktop_runtime_7.0.2_win_x64.msi.log
Filesize
2KB

MD5
8c6387118580444467d4f641f265d9dd

SHA1
9828623688a5b0ed43d402912b831d6ae3b925e5

SHA256
cb4e2c4d5345646bd38fe161a026f7e56c267b123b43ae214833bbd7b55d7a5f

SHA512
3362181ee1bfacd617fb454d61faed04857674deb9db74433be2a72a0fe7ab695946e22c47ec9dfd9fe99c187eba13a5ac4fd5b06e5d7d24a4a8293a2e6bd710

Download Submit
C:\Users\Admin\AppData\Local\Temp\squ7DEF.tmp.exe
Filesize
12.1MB

MD5
69e09cdf35a034d70c65c7324e6ce8fe

SHA1
0392198e4b4a84d4274a6eeca739b5d4c7797566

SHA256
802088824acdb2784e18e2368ec913e4550a1078be377aea89a693602d2c5d4f

SHA512
a454f701d486cce6cd1840ce182988f85de927dad9f04f527b2d0eef4d37d4284ed7f736978e119b93250501b9e055ba912eb677ad6adfa8b5e9e3172353f041

Download Submit
C:\Users\Admin\AppData\Local\Temp\squ7DEF.tmp.exe
Filesize
12.1MB

MD5
69e09cdf35a034d70c65c7324e6ce8fe

SHA1
0392198e4b4a84d4274a6eeca739b5d4c7797566

SHA256
802088824acdb2784e18e2368ec913e4550a1078be377aea89a693602d2c5d4f

SHA512
a454f701d486cce6cd1840ce182988f85de927dad9f04f527b2d0eef4d37d4284ed7f736978e119b93250501b9e055ba912eb677ad6adfa8b5e9e3172353f041

Download Submit
C:\Windows\Installer\MSI3D95.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI3D95.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI4AD6.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI4AD6.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI4D0A.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI4D0A.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5028.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5028.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI51DF.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI51DF.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5627.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5627.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5964.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5964.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI70A7.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI70A7.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Temp\{8FDBF2DF-5DF1-4CFE-BD95-C580AD46D1DE}\.cr\net7-x64.exe
Filesize
610KB

MD5
f8ce9b64efeb346aba69310edef93488

SHA1
b84d496c76f0db15d926333109605f08c592814a

SHA256
c857ed7b8b578647b3dc790b7385590daeff7045e617e40310ca6ca9ee587293

SHA512
4e46e9b7139ef18b98287070a68d7868145e6f0d9104f39f65be391ed121e7a3158255cd72a9088c606deb56c3248de5aac48aa08e42e94adc903e459f654614

Download Submit
C:\Windows\Temp\{8FDBF2DF-5DF1-4CFE-BD95-C580AD46D1DE}\.cr\net7-x64.exe
Filesize
610KB

MD5
f8ce9b64efeb346aba69310edef93488

SHA1
b84d496c76f0db15d926333109605f08c592814a

SHA256
c857ed7b8b578647b3dc790b7385590daeff7045e617e40310ca6ca9ee587293

SHA512
4e46e9b7139ef18b98287070a68d7868145e6f0d9104f39f65be391ed121e7a3158255cd72a9088c606deb56c3248de5aac48aa08e42e94adc903e459f654614

Download Submit
C:\Windows\Temp\{99FA2933-A6B9-44B4-A37E-491F0818D802}\.ba\wixstdba.dll
Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{99FA2933-A6B9-44B4-A37E-491F0818D802}\.be\windowsdesktop-runtime-7.0.2-win-x64.exe
Filesize
610KB

MD5
f8ce9b64efeb346aba69310edef93488

SHA1
b84d496c76f0db15d926333109605f08c592814a

SHA256
c857ed7b8b578647b3dc790b7385590daeff7045e617e40310ca6ca9ee587293

SHA512
4e46e9b7139ef18b98287070a68d7868145e6f0d9104f39f65be391ed121e7a3158255cd72a9088c606deb56c3248de5aac48aa08e42e94adc903e459f654614

Download Submit
C:\Windows\Temp\{99FA2933-A6B9-44B4-A37E-491F0818D802}\.be\windowsdesktop-runtime-7.0.2-win-x64.exe
Filesize
610KB

MD5
f8ce9b64efeb346aba69310edef93488

SHA1
b84d496c76f0db15d926333109605f08c592814a

SHA256
c857ed7b8b578647b3dc790b7385590daeff7045e617e40310ca6ca9ee587293

SHA512
4e46e9b7139ef18b98287070a68d7868145e6f0d9104f39f65be391ed121e7a3158255cd72a9088c606deb56c3248de5aac48aa08e42e94adc903e459f654614

Download Submit
C:\Windows\Temp\{99FA2933-A6B9-44B4-A37E-491F0818D802}\dotnet_host_7.0.2_win_x64.msi
Filesize
744KB

MD5
734468d3921001b11e7fb7d9ffafab5c

SHA1
b061d1cc930dc31eea71bbbdf31d39875f855dce

SHA256
b7b738dc4c37c33fd9e16396a2abf089217860c6187a1a8b77d77239a476467e

SHA512
57878de441bbbf8a4072d6d11d80a8e8908b26bb6a798d49b68e05a668ce8dd78a413a8197f54e75349cba8f2053f16b3df4163c249e0fdd89b12830a467fa65

Download Submit
C:\Windows\Temp\{99FA2933-A6B9-44B4-A37E-491F0818D802}\dotnet_hostfxr_7.0.2_win_x64.msi
Filesize
808KB

MD5
c8cd42861a574801605cf993d23ec73e

SHA1
237c24b9476f8ff767500b9e862cbfd0a267197c

SHA256
6d68038514d24b7707cdcdbcc77637599271b57f28debf074ec7f1e3746b4dc9

SHA512
6371038e2feb42e08e64af1a31f98fbca22704e7ad6cc4c386c4bfa320600eda2c4e6b0995085639e893ea7c4783c3e383829d6ed28bbb1f5789e2d9c1e6b205

Download Submit
C:\Windows\Temp\{99FA2933-A6B9-44B4-A37E-491F0818D802}\dotnet_runtime_7.0.2_win_x64.msi
Filesize
26.0MB

MD5
31952088821f790b55a350f439465249

SHA1
6c09d35da6794d95390493c48c8cae2cec7dce3b

SHA256
6ef52dde0552e8b07a04f514b9a43e8191a10035963fa90ed7264dd381878df8

SHA512
3371e26fba463ec6c34c1fe36798310d4633ebf6ef41aba4f393169bbaa8ff5dffa577458f9462886b48f908845181e6b6256045816097976dde39647f18df14

Download Submit
C:\Windows\Temp\{99FA2933-A6B9-44B4-A37E-491F0818D802}\windowsdesktop_runtime_7.0.2_win_x64.msi
Filesize
28.6MB

MD5
08d16a3b5e6b2d2446b5d3f62b61fb3e

SHA1
b6ee0e4ce1d2bab10ef53d548c6c30c7c80511e5

SHA256
1668841637c59faf9edfaf979ba050f33a13df5e7a72007e89a07bfef0fa9367

SHA512
d8ab6f02d270a83bf5ce640de14c622eb4a9fe9ffc220f2eb93eb1d5c1ae88a8c678aa784ed6fbb7474b1cb8b89b091fb8e00325584b4f6b4a91385538ee0955

Download Submit
memory/1124-162-0x0000000000000000-mapping.dmp

Download
memory/1976-138-0x0000000000000000-mapping.dmp

Download
memory/2956-173-0x0000000000000000-mapping.dmp

Download
memory/3172-205-0x0000000000000000-mapping.dmp

Download
memory/3972-168-0x0000000000000000-mapping.dmp

Download
memory/4128-135-0x0000000000000000-mapping.dmp

Download
memory/4260-132-0x0000000000000000-mapping.dmp

Download
memory/4880-150-0x0000000000000000-mapping.dmp

Download
memory/4908-156-0x0000000000000000-mapping.dmp

Download
memory/5060-142-0x0000000000000000-mapping.dmp

Download