58c34d4631ced34ace48055bb07367d55b51860e3b483307a1783cc4008f7b76

Analysis

max time kernel
206s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2023, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

L4D2BhopScript.exe
Size

382KB
MD5

bd6f807dd05278946d7d85cdb114b2a6
SHA1

30644109ab1672bdbe94669fb992109a69cf9d06
SHA256

58c34d4631ced34ace48055bb07367d55b51860e3b483307a1783cc4008f7b76
SHA512

82fbad79abe76928e24f91694f18cdc1be29a609d5f4f3290ea9d337b5e0723142ae6090dd0caefc46d2a74c3967906a5e9653fbe88855f278c26b50cbea1d4d
SSDEEP

6144:+IVyJ/El9HHRmqU7aNn4p7THBojs39yq1fTqTj81CErQx:+nEl5BsaNnsloj030x

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-6.0.13-win-x86.exe

Executes dropped EXE 7 IoCs

pid	Process
4632	windowsdesktop-runtime-6.0.13-win-x86.exe
2576	windowsdesktop-runtime-6.0.13-win-x86.exe
3940	windowsdesktop-runtime-6.0.13-win-x86.exe
3972	windowsdesktop-runtime-6.0.13-win-x86.exe
4728	windowsdesktop-runtime-6.0.13-win-x86.exe
3808	windowsdesktop-runtime-6.0.13-win-x86.exe
2740	windowsdesktop-runtime-6.0.13-win-x86.exe

Loads dropped DLL 7 IoCs

pid	Process
3972	windowsdesktop-runtime-6.0.13-win-x86.exe
4728	windowsdesktop-runtime-6.0.13-win-x86.exe
3808	windowsdesktop-runtime-6.0.13-win-x86.exe
2076	MsiExec.exe
2424	MsiExec.exe
4044	MsiExec.exe
1852	MsiExec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	windowsdesktop-runtime-6.0.13-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d0da1241-5784-4a15-98a5-cf37e3f102e6} = "\"C:\\ProgramData\\Package Cache\\{d0da1241-5784-4a15-98a5-cf37e3f102e6}\\windowsdesktop-runtime-6.0.13-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.13-win-x86.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\WindowsFormsIntegration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\api-ms-win-core-synch-l1-2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\zh-Hans\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\it\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\Microsoft.VisualBasic.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\D3DCompiler_47_cor3.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\es\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\de\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\System.Windows.Input.Manipulations.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\Microsoft.WindowsDesktop.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\pl\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\mscordaccore_x86_x86_6.0.1322.58009.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\pl\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\UIAutomationProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\fr\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\ko\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.13 (x86).swidtag	windowsdesktop-runtime-6.0.13-win-x86.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\System.Windows.Presentation.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\it\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\es\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\api-ms-win-core-file-l2-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\tr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\pt-BR\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Security.Cryptography.Encoding.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Threading.Tasks.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\System.Diagnostics.EventLog.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\api-ms-win-core-util-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Globalization.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\de\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\ru\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\System.Printing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\zh-Hant\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\pl\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\ReachFramework.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\cs\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\cs\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\api-ms-win-crt-convert-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Net.Mail.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Transactions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\fr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\zh-Hans\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\zh-Hant\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\api-ms-win-core-namedpipe-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.13\zh-Hant\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.13\System.Linq.Parallel.dll	msiexec.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI7F14.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FAF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e584945.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58493d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e584941.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{41E9A2CE-CF7F-4F2E-80FD-50FDCBB8F286}	msiexec.exe
File created	C:\Windows\Installer\e584948.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI96E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e58493c.msi	msiexec.exe
File created	C:\Windows\Installer\e584939.msi	msiexec.exe
File created	C:\Windows\Installer\e584945.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{ACFA81A9-FD2F-4731-BE64-9163E3E9FF58}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{87EA745D-32DA-4DCA-9ED4-BF4BA6232E1E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F61.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6C33.tmp	msiexec.exe
File created	C:\Windows\Installer\e58493d.msi	msiexec.exe
File created	C:\Windows\Installer\e584940.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7194.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e584939.msi	msiexec.exe
File created	C:\Windows\Installer\e584941.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7416.tmp	msiexec.exe
File created	C:\Windows\Installer\e584944.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7782.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A0047888-886B-41B9-8080-0E8DC3539B81}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A18AFCAF2DF1374EB4619363E9EFF85\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{d0da1241-5784-4a15-98a5-cf37e3f102e6}\Dependents\{d0da1241-5784-4a15-98a5-cf37e3f102e6}	windowsdesktop-runtime-6.0.13-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC2A9E14F7FCE2F408DF05DFBC8B2F68\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC2A9E14F7FCE2F408DF05DFBC8B2F68\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{41E9A2CE-CF7F-4F2E-80FD-50FDCBB8F286}v48.55.52137\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A18AFCAF2DF1374EB4619363E9EFF85\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D547AE78AD23ACD4E94DFBB46A32E2E1\ProductName = "Microsoft .NET Runtime - 6.0.13 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8887400AB6889B140808E0D83C35B918	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8887400AB6889B140808E0D83C35B918\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8887400AB6889B140808E0D83C35B918\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8887400AB6889B140808E0D83C35B918\ProductName = "Microsoft .NET Host FX Resolver - 6.0.13 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8887400AB6889B140808E0D83C35B918\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EC2A9E14F7FCE2F408DF05DFBC8B2F68	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8887400AB6889B140808E0D83C35B918\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D547AE78AD23ACD4E94DFBB46A32E2E1\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D547AE78AD23ACD4E94DFBB46A32E2E1\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8887400AB6889B140808E0D83C35B918\PackageCode = "85A554BAA07FE3A4098C791A47844683"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8887400AB6889B140808E0D83C35B918\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EC2A9E14F7FCE2F408DF05DFBC8B2F68\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0621CE985F15E064E466B0A015ABF481	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A18AFCAF2DF1374EB4619363E9EFF85\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.55.53270_x86\Dependents	windowsdesktop-runtime-6.0.13-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D547AE78AD23ACD4E94DFBB46A32E2E1\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{87EA745D-32DA-4DCA-9ED4-BF4BA6232E1E}v48.55.52137\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC2A9E14F7FCE2F408DF05DFBC8B2F68\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A036181AE3507D45E36606F9464ED83\EC2A9E14F7FCE2F408DF05DFBC8B2F68	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A18AFCAF2DF1374EB4619363E9EFF85\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D547AE78AD23ACD4E94DFBB46A32E2E1\PackageCode = "77E0A51B0FCADE948A8B7D3B5565BF66"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8887400AB6889B140808E0D83C35B918\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC2A9E14F7FCE2F408DF05DFBC8B2F68\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC2A9E14F7FCE2F408DF05DFBC8B2F68\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A18AFCAF2DF1374EB4619363E9EFF85\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D547AE78AD23ACD4E94DFBB46A32E2E1\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D547AE78AD23ACD4E94DFBB46A32E2E1\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC2A9E14F7FCE2F408DF05DFBC8B2F68\PackageCode = "AF95CA6526721C04BBB76AAA3C100F9B"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86	windowsdesktop-runtime-6.0.13-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.55.52137_x86\ = "{A0047888-886B-41B9-8080-0E8DC3539B81}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A18AFCAF2DF1374EB4619363E9EFF85\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.55.53270_x86	windowsdesktop-runtime-6.0.13-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{d0da1241-5784-4a15-98a5-cf37e3f102e6}\Dependents	windowsdesktop-runtime-6.0.13-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D547AE78AD23ACD4E94DFBB46A32E2E1\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC2A9E14F7FCE2F408DF05DFBC8B2F68\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.55.53270_x86\ = "{ACFA81A9-FD2F-4731-BE64-9163E3E9FF58}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.55.52137_x86\Version = "48.55.52137"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.55.52137_x86	windowsdesktop-runtime-6.0.13-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C3A4927273E592E6DD7D9C50F987AF52\D547AE78AD23ACD4E94DFBB46A32E2E1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.55.52137_x86\Version = "48.55.52137"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A18AFCAF2DF1374EB4619363E9EFF85	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A18AFCAF2DF1374EB4619363E9EFF85\PackageCode = "F4C58A393AEF656478D5BFF1745871FD"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D547AE78AD23ACD4E94DFBB46A32E2E1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8887400AB6889B140808E0D83C35B918\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC2A9E14F7FCE2F408DF05DFBC8B2F68\Version = "808962985"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9A18AFCAF2DF1374EB4619363E9EFF85\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\Version = "48.55.52137"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EC2A9E14F7FCE2F408DF05DFBC8B2F68\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC2A9E14F7FCE2F408DF05DFBC8B2F68\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC2A9E14F7FCE2F408DF05DFBC8B2F68\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{d0da1241-5784-4a15-98a5-cf37e3f102e6}\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.13 (x86)"	windowsdesktop-runtime-6.0.13-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.55.52137_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.55.52137_x86\DisplayName = "Microsoft .NET Host FX Resolver - 6.0.13 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.55.52137_x86\Dependents	windowsdesktop-runtime-6.0.13-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A18AFCAF2DF1374EB4619363E9EFF85\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A18AFCAF2DF1374EB4619363E9EFF85\Version = "808964118"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D547AE78AD23ACD4E94DFBB46A32E2E1\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8887400AB6889B140808E0D83C35B918\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC2A9E14F7FCE2F408DF05DFBC8B2F68	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 447064.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
1672	msedge.exe
1672	msedge.exe
3832	identity_helper.exe
3832	identity_helper.exe
1828	msedge.exe
1828	msedge.exe
4180	msiexec.exe
4180	msiexec.exe
4180	msiexec.exe
4180	msiexec.exe
4180	msiexec.exe
4180	msiexec.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
4180	msiexec.exe
4180	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeIncreaseQuotaPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeSecurityPrivilege	4180	msiexec.exe
Token: SeCreateTokenPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeLockMemoryPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeIncreaseQuotaPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeMachineAccountPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeTcbPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeSecurityPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeTakeOwnershipPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeLoadDriverPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeSystemProfilePrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeSystemtimePrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeProfSingleProcessPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeIncBasePriorityPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeCreatePagefilePrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeCreatePermanentPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeBackupPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeRestorePrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeShutdownPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeDebugPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeAuditPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeSystemEnvironmentPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeChangeNotifyPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeRemoteShutdownPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeUndockPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeSyncAgentPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeEnableDelegationPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeManageVolumePrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeImpersonatePrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeCreateGlobalPrivilege	2740	windowsdesktop-runtime-6.0.13-win-x86.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe
Token: SeRestorePrivilege	4180	msiexec.exe
Token: SeTakeOwnershipPrivilege	4180	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1672	2352	L4D2BhopScript.exe	81
PID 2352 wrote to memory of 1672	2352	L4D2BhopScript.exe	81
PID 1672 wrote to memory of 4968	1672	msedge.exe	82
PID 1672 wrote to memory of 4968	1672	msedge.exe	82
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 1976	1672	msedge.exe	85
PID 1672 wrote to memory of 4212	1672	msedge.exe	86
PID 1672 wrote to memory of 4212	1672	msedge.exe	86
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88
PID 1672 wrote to memory of 2484	1672	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\L4D2BhopScript.exe
"C:\Users\Admin\AppData\Local\Temp\L4D2BhopScript.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=6.0.13&gui=true
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe54e246f8,0x7ffe54e24708,0x7ffe54e24718
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4092 /prefetch:8
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5584 /prefetch:8
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x208,0x22c,0x7ff716925460,0x7ff716925470,0x7ff716925480
      4⤵
      PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3740 /prefetch:8
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6408 /prefetch:8
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1828
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.13-win-x86.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.13-win-x86.exe"
    3⤵
    - Executes dropped EXE
    PID:4632
  - - C:\Windows\Temp\{6CEC5E70-2981-4D59-B576-EEFE8B3BA12F}\.cr\windowsdesktop-runtime-6.0.13-win-x86.exe
      "C:\Windows\Temp\{6CEC5E70-2981-4D59-B576-EEFE8B3BA12F}\.cr\windowsdesktop-runtime-6.0.13-win-x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.13-win-x86.exe" -burn.filehandle.attached=568 -burn.filehandle.self=576
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4728
    - - C:\Windows\Temp\{22663802-5DEF-48AB-B68B-FE16E333AD6C}\.be\windowsdesktop-runtime-6.0.13-win-x86.exe
        
        "C:\Windows\Temp\{22663802-5DEF-48AB-B68B-FE16E333AD6C}\.be\windowsdesktop-runtime-6.0.13-win-x86.exe" -q -burn.elevated BurnPipe.{59545BA9-5917-4C93-B4D0-7EC71E99A35E} {E15DC2CF-4410-488E-8BF2-7CE951F3B335} 4728
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.13-win-x86.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.13-win-x86.exe"
    3⤵
    - Executes dropped EXE
    PID:3940
  - - C:\Windows\Temp\{6E0741B4-2B95-42BF-ABAA-385DDF761AA0}\.cr\windowsdesktop-runtime-6.0.13-win-x86.exe
      "C:\Windows\Temp\{6E0741B4-2B95-42BF-ABAA-385DDF761AA0}\.cr\windowsdesktop-runtime-6.0.13-win-x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.13-win-x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3972
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.13-win-x86.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.13-win-x86.exe"
    3⤵
    - Executes dropped EXE
    PID:2576
  - - C:\Windows\Temp\{68BE4D16-990C-4365-B8CB-F2AC0B31F519}\.cr\windowsdesktop-runtime-6.0.13-win-x86.exe
      "C:\Windows\Temp\{68BE4D16-990C-4365-B8CB-F2AC0B31F519}\.cr\windowsdesktop-runtime-6.0.13-win-x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.13-win-x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6260 /prefetch:8
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15281210838938562422,3343170622493791952,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3760 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:260

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 124A8171A3FA0763A0F03BBC1A1AF7A0
  2⤵
  - Loads dropped DLL
  PID:2076
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B61C532CB9C86E37E6B5794708EB2486
  2⤵
  - Loads dropped DLL
  PID:2424
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9A3555E53584737B012B737326D4A85C
  2⤵
  - Loads dropped DLL
  PID:4044
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A2AC15050C47F92224E21576D00E1447
  2⤵
  - Loads dropped DLL
  PID:1852

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.13_(x86)_20230204235657_000_dotnet_runtime_6.0.13_win_x86.msi.log

Filesize
2KB

MD5
949eaa2474d391e65ac794cb4e489a1b

SHA1
a89befba172955fde8a282efa2a28308022fdf1d

SHA256
107220c120061a31e82db5847e2c65ed17b2928166baed508c67643e00f10ab0

SHA512
9cd5ffcc8d0cd0879976db26668cbe9fc8b10793a97fd39b73738f62ecc522cf7c198c8dc4af5c7da71d6850d08bf8ed62b5ea411070f96897e2e34aa8fa8cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.13_(x86)_20230204235657_001_dotnet_hostfxr_6.0.13_win_x86.msi.log

Filesize
2KB

MD5
01bf9992b82ddc23ea14ed533e20b884

SHA1
da916a2b3e7a2a320558a2e146950cc05793df9c

SHA256
b6625bb76f6b935de6bdc7aaddedabbe3d62421ac1a1558dbd5e16a851f372a2

SHA512
1c3230b3200ff13cc7b9f85056ec1a27e6afeaa4a4b24a1a30db56847c135a40677ca5b96e690876e9b7405e73cda32a3115429a97303382882c0c5c07288678

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.13_(x86)_20230204235657_002_dotnet_host_6.0.13_win_x86.msi.log

Filesize
2KB

MD5
3a779168c878e5fc4494be3f46921262

SHA1
5e5c49c978a7a73af7c7b82f2d0faebf707c0608

SHA256
cbf148a8b335414e444197ab97345c3ca28ed3c6e0652bf18ac61428df5daf5a

SHA512
f9c61b298c4562f0e90d9e925b02d62760b263fa6cef5d51a2c3564fa5f09899917b409350d238e708616876446c3d8bf84395c97b22c88fc9114f634bca7348

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.13_(x86)_20230204235657_003_windowsdesktop_runtime_6.0.13_win_x86.msi.log

Filesize
2KB

MD5
b6de0a136571c83fac5798d8f6b236b6

SHA1
3b7ca96e3cd27c5a4182a20de67418db1a2db028

SHA256
c4b0c835571b84ff27a603f4896e9a58831d20f499858b8fe7a6207a42fb89c1

SHA512
df1ad9b3a70953132c8961d02d51b683a76013070ab374b8917db968a9996166f5c2bb80addf6ec97ef6fe0c048f4a0fb01d6ccabd413bb0ff1d913a35358a3b

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.13-win-x86.exe

Filesize
49.6MB

MD5
27e8e8fd587e5c3a3789105dd78d554e

SHA1
1181aa4e3a14a7ec2ddc22fc473ea316ac7c55d4

SHA256
bf8f4a1dedf6a056e6139b28d8a9c23cf8893c7e26de8a82528efb652f6f6068

SHA512
4b4458212b159f37a9f369d6034a6a59796513582a4114c309337cb1989a0e3acb6a9bb67ac5cf0553d8473fef46777e3bf2f37cefae20d29888044333acba27

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.13-win-x86.exe

Filesize
49.6MB

MD5
27e8e8fd587e5c3a3789105dd78d554e

SHA1
1181aa4e3a14a7ec2ddc22fc473ea316ac7c55d4

SHA256
bf8f4a1dedf6a056e6139b28d8a9c23cf8893c7e26de8a82528efb652f6f6068

SHA512
4b4458212b159f37a9f369d6034a6a59796513582a4114c309337cb1989a0e3acb6a9bb67ac5cf0553d8473fef46777e3bf2f37cefae20d29888044333acba27

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.13-win-x86.exe

Filesize
49.6MB

MD5
27e8e8fd587e5c3a3789105dd78d554e

SHA1
1181aa4e3a14a7ec2ddc22fc473ea316ac7c55d4

SHA256
bf8f4a1dedf6a056e6139b28d8a9c23cf8893c7e26de8a82528efb652f6f6068

SHA512
4b4458212b159f37a9f369d6034a6a59796513582a4114c309337cb1989a0e3acb6a9bb67ac5cf0553d8473fef46777e3bf2f37cefae20d29888044333acba27

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.13-win-x86.exe

Filesize
49.6MB

MD5
27e8e8fd587e5c3a3789105dd78d554e

SHA1
1181aa4e3a14a7ec2ddc22fc473ea316ac7c55d4

SHA256
bf8f4a1dedf6a056e6139b28d8a9c23cf8893c7e26de8a82528efb652f6f6068

SHA512
4b4458212b159f37a9f369d6034a6a59796513582a4114c309337cb1989a0e3acb6a9bb67ac5cf0553d8473fef46777e3bf2f37cefae20d29888044333acba27

Download Submit
C:\Windows\Installer\MSI6C33.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI6C33.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI7194.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI7194.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI7782.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI7782.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI96E3.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI96E3.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Temp\{04C198BF-224E-4D2D-9E1F-BDB8C3135142}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{15AFF11A-06FF-4089-A6E1-EE7A3F8FFAE3}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{22663802-5DEF-48AB-B68B-FE16E333AD6C}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{22663802-5DEF-48AB-B68B-FE16E333AD6C}\.be\windowsdesktop-runtime-6.0.13-win-x86.exe

Filesize
610KB

MD5
a3553603e293c13b5b3d71d2ca821d53

SHA1
78f9e04b8d61915600224c8356e565a72b5d7b7d

SHA256
146c9655269cbf152f1d1f33b825abc2bfb57f5e01abe90a640d21e80c535149

SHA512
0c695d8b28938f0e5bb0f80101f904a56402b1b38582c52235568e3a22efc9e6d1314031934b4e18b17cde9000d8c69f2c2a6a2feb574c93a1ce674b2ac38ff0

Download Submit
C:\Windows\Temp\{22663802-5DEF-48AB-B68B-FE16E333AD6C}\.be\windowsdesktop-runtime-6.0.13-win-x86.exe

Filesize
610KB

MD5
a3553603e293c13b5b3d71d2ca821d53

SHA1
78f9e04b8d61915600224c8356e565a72b5d7b7d

SHA256
146c9655269cbf152f1d1f33b825abc2bfb57f5e01abe90a640d21e80c535149

SHA512
0c695d8b28938f0e5bb0f80101f904a56402b1b38582c52235568e3a22efc9e6d1314031934b4e18b17cde9000d8c69f2c2a6a2feb574c93a1ce674b2ac38ff0

Download Submit
C:\Windows\Temp\{22663802-5DEF-48AB-B68B-FE16E333AD6C}\dotnet_host_6.0.13_win_x86.msi

Filesize
728KB

MD5
a1517a6bf27988deb631b8a6faaa45b9

SHA1
78dfbbe9269bec6467205c95c4827eae0261f399

SHA256
655f5b2518b828be7db7c5c73349ce01dcb5ffc1424883cd369e3023d01b274f

SHA512
9bf25d5ca687b484a0d27a2bdc641bfc6f285f980214110647a957fdf5b1430770ef2eac1374a140ba3c11af9904cddedf69638a636506d7aa1a3d43b6ea9aba

Download Submit
C:\Windows\Temp\{22663802-5DEF-48AB-B68B-FE16E333AD6C}\dotnet_hostfxr_6.0.13_win_x86.msi

Filesize
784KB

MD5
d1fac2500de8afcb9358bd5b74702bb0

SHA1
e6ad79e196f565e7fdd337738a1d96ccc9a1ad86

SHA256
9afba4fbe7dfe4ea9d0ab3e3b450dc282781f89b103984d222918dba70a2c2d7

SHA512
90118932e15b77feb8eb470dbc8a77be3f62e8c6df723008a4ac855bf8e71552145a86fbd24c2c716c8b80c480415e4ab1d1ace0e479425f6c078ee86857facd

Download Submit
C:\Windows\Temp\{22663802-5DEF-48AB-B68B-FE16E333AD6C}\dotnet_runtime_6.0.13_win_x86.msi

Filesize
23.4MB

MD5
e5b6a59690fa9fadc0e37e8e54ae1155

SHA1
9ef5fb1046e60c572aca217fa25b629715c2f42a

SHA256
6c080efe64d2e6ecc2aed5cc38ad4db2511ec6559461a4af9656abb8de6df18b

SHA512
681a17558cdd553b2c75e3a372dee14a07116506bfcdf3f5b947c15f3988cf00e1e0509ad715c2572ddb55c5709a143b70b5ce183d02265ccc9dea61f9337494

Download Submit
C:\Windows\Temp\{22663802-5DEF-48AB-B68B-FE16E333AD6C}\windowsdesktop_runtime_6.0.13_win_x86.msi

Filesize
25.8MB

MD5
6a3d2549c323aac6c9fd276f0a547e75

SHA1
f6a68264fdecea577a9dce7ac57712cb5f1d74f2

SHA256
512e166cfc6a0656a45bcb081587fe7d0e9125c8119612654dd096a9e4316300

SHA512
faab3643a1354bb66b7be2d9f45d99275a8180120915514d80dcbe75e1249a6847cf4e873a752a3f6cc1d625df5379ea53fbe4a4bf6aee7d03bbdd470181caf8

Download Submit
C:\Windows\Temp\{68BE4D16-990C-4365-B8CB-F2AC0B31F519}\.cr\windowsdesktop-runtime-6.0.13-win-x86.exe

Filesize
610KB

MD5
a3553603e293c13b5b3d71d2ca821d53

SHA1
78f9e04b8d61915600224c8356e565a72b5d7b7d

SHA256
146c9655269cbf152f1d1f33b825abc2bfb57f5e01abe90a640d21e80c535149

SHA512
0c695d8b28938f0e5bb0f80101f904a56402b1b38582c52235568e3a22efc9e6d1314031934b4e18b17cde9000d8c69f2c2a6a2feb574c93a1ce674b2ac38ff0

Download Submit
C:\Windows\Temp\{68BE4D16-990C-4365-B8CB-F2AC0B31F519}\.cr\windowsdesktop-runtime-6.0.13-win-x86.exe

Filesize
610KB

MD5
a3553603e293c13b5b3d71d2ca821d53

SHA1
78f9e04b8d61915600224c8356e565a72b5d7b7d

SHA256
146c9655269cbf152f1d1f33b825abc2bfb57f5e01abe90a640d21e80c535149

SHA512
0c695d8b28938f0e5bb0f80101f904a56402b1b38582c52235568e3a22efc9e6d1314031934b4e18b17cde9000d8c69f2c2a6a2feb574c93a1ce674b2ac38ff0

Download Submit
C:\Windows\Temp\{6CEC5E70-2981-4D59-B576-EEFE8B3BA12F}\.cr\windowsdesktop-runtime-6.0.13-win-x86.exe

Filesize
610KB

MD5
a3553603e293c13b5b3d71d2ca821d53

SHA1
78f9e04b8d61915600224c8356e565a72b5d7b7d

SHA256
146c9655269cbf152f1d1f33b825abc2bfb57f5e01abe90a640d21e80c535149

SHA512
0c695d8b28938f0e5bb0f80101f904a56402b1b38582c52235568e3a22efc9e6d1314031934b4e18b17cde9000d8c69f2c2a6a2feb574c93a1ce674b2ac38ff0

Download Submit
C:\Windows\Temp\{6CEC5E70-2981-4D59-B576-EEFE8B3BA12F}\.cr\windowsdesktop-runtime-6.0.13-win-x86.exe

Filesize
610KB

MD5
a3553603e293c13b5b3d71d2ca821d53

SHA1
78f9e04b8d61915600224c8356e565a72b5d7b7d

SHA256
146c9655269cbf152f1d1f33b825abc2bfb57f5e01abe90a640d21e80c535149

SHA512
0c695d8b28938f0e5bb0f80101f904a56402b1b38582c52235568e3a22efc9e6d1314031934b4e18b17cde9000d8c69f2c2a6a2feb574c93a1ce674b2ac38ff0

Download Submit
C:\Windows\Temp\{6E0741B4-2B95-42BF-ABAA-385DDF761AA0}\.cr\windowsdesktop-runtime-6.0.13-win-x86.exe

Filesize
610KB

MD5
a3553603e293c13b5b3d71d2ca821d53

SHA1
78f9e04b8d61915600224c8356e565a72b5d7b7d

SHA256
146c9655269cbf152f1d1f33b825abc2bfb57f5e01abe90a640d21e80c535149

SHA512
0c695d8b28938f0e5bb0f80101f904a56402b1b38582c52235568e3a22efc9e6d1314031934b4e18b17cde9000d8c69f2c2a6a2feb574c93a1ce674b2ac38ff0

Download Submit
C:\Windows\Temp\{6E0741B4-2B95-42BF-ABAA-385DDF761AA0}\.cr\windowsdesktop-runtime-6.0.13-win-x86.exe

Filesize
610KB

MD5
a3553603e293c13b5b3d71d2ca821d53

SHA1
78f9e04b8d61915600224c8356e565a72b5d7b7d

SHA256
146c9655269cbf152f1d1f33b825abc2bfb57f5e01abe90a640d21e80c535149

SHA512
0c695d8b28938f0e5bb0f80101f904a56402b1b38582c52235568e3a22efc9e6d1314031934b4e18b17cde9000d8c69f2c2a6a2feb574c93a1ce674b2ac38ff0

Download Submit