0d33ab8f48e7046db2ef831c6297949734bb6dd8acd2e7d84afacfe2404454d1

Analysis

max time kernel
258s
max time network
246s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2023, 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NovaSetup.exe
Size

4.1MB
MD5

9f5019341609a7b2bc1356a509520688
SHA1

aa7d86fb786baff5055c7581eb07a457fcf162b4
SHA256

0d33ab8f48e7046db2ef831c6297949734bb6dd8acd2e7d84afacfe2404454d1
SHA512

ff9e2d29758ae1305cf7b344c0a1094402738ed933ffc61440f45831a529ee25cbf18f13ca7e0648d16b5c6c4af4e89b95536a4c9c3332a5399876b582618b97
SSDEEP

98304:Tip6o9raOWcD9XdMPABIw/t6KHDiAwzUshkqXf0FZp:TcAOWs9XNBZ16M2HUykSI

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	NovaSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	NovaInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-6.0.15-win-x64.exe

Executes dropped EXE 9 IoCs

pid	Process
3336	NovaInstaller.exe
3840	NovaLauncher.exe
5112	windowsdesktop-runtime-6.0.15-win-x64.exe
3248	windowsdesktop-runtime-6.0.15-win-x64.exe
3364	windowsdesktop-runtime-6.0.15-win-x64.exe
5324	windowsdesktop-runtime-6.0.15-win-x64.exe
1296	windowsdesktop-runtime-6.0.15-win-x64.exe
2332	windowsdesktop-runtime-6.0.15-win-x64.exe
4132	windowsdesktop-runtime-6.0.15-win-x64.exe

Loads dropped DLL 11 IoCs

pid	Process
5324	windowsdesktop-runtime-6.0.15-win-x64.exe
2332	windowsdesktop-runtime-6.0.15-win-x64.exe
1296	windowsdesktop-runtime-6.0.15-win-x64.exe
5844	MsiExec.exe
5844	MsiExec.exe
4992	MsiExec.exe
4992	MsiExec.exe
4104	MsiExec.exe
4104	MsiExec.exe
5640	MsiExec.exe
5640	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	windowsdesktop-runtime-6.0.15-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{06cd4f51-0a4b-471c-9ccc-e3dd11294c03} = "\"C:\\ProgramData\\Package Cache\\{06cd4f51-0a4b-471c-9ccc-e3dd11294c03}\\windowsdesktop-runtime-6.0.15-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.15-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\es\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\fr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\es\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\de\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\de\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\dbgshim.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\pl\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\tr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\ja\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\ja\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\api-ms-win-core-memory-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\ja\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\pt-BR\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\cs\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\fr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Linq.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\pt-BR\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\tr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\tr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\fr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\api-ms-win-crt-math-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.15\hostfxr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\es\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\ja\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Linq.Queryable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\api-ms-win-core-file-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\zh-Hans\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\System.CodeDom.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\System.Windows.Forms.Design.Editors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\zh-Hant\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\Microsoft.VisualBasic.Forms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Private.DataContractSerialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Net.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\cs\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\ko\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\System.Printing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\api-ms-win-crt-convert-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\PresentationFramework-SystemCore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\de\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Reflection.TypeExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\ja\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\tr\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\pl\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\cs\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.15\zh-Hant\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.15\System.Net.WebClient.dll	msiexec.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e59298b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5E39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI403C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{368BE572-D3CE-47B6-A3B1-DE0270E5C109}	msiexec.exe
File created	C:\Windows\Installer\e592996.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A7F.tmp	msiexec.exe
File created	C:\Windows\Installer\e59298b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI52BD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI64D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6800.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e592987.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI80AB.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI60DA.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AC25127C-9BB1-4F9A-9B02-B6B6178DD891}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EDD929D3-DFE9-40BA-8A13-30F9CE1E2F18}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5761.tmp	msiexec.exe
File created	C:\Windows\Installer\e59298f.msi	msiexec.exe
File created	C:\Windows\Installer\e592993.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B353ABAB-7F7C-4605-852D-0E5C3E1FA289}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D2E.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e59298a.msi	msiexec.exe
File created	C:\Windows\Installer\e59298e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59298f.msi	msiexec.exe
File created	C:\Windows\Installer\e592987.msi	msiexec.exe
File created	C:\Windows\Installer\e592992.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e592993.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F35.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A50.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{06cd4f51-0a4b-471c-9ccc-e3dd11294c03}\ = "{06cd4f51-0a4b-471c-9ccc-e3dd11294c03}"	windowsdesktop-runtime-6.0.15-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72152CA1BB9A9F4B9206B6B71D88D19\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.63.56729_x64\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.15 (x64)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BABA353BC7F7506458D2E0C5E3F12A98\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72152CA1BB9A9F4B9206B6B71D88D19	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72152CA1BB9A9F4B9206B6B71D88D19\PackageCode = "D40EDAF51CF001040827D3A544ACB01A"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BABA353BC7F7506458D2E0C5E3F12A98\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BABA353BC7F7506458D2E0C5E3F12A98\Version = "809491865"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.63.56695_x64\Dependents	windowsdesktop-runtime-6.0.15-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D929DDE9EFDAB04A831039FECE1F281\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72152CA1BB9A9F4B9206B6B71D88D19\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72152CA1BB9A9F4B9206B6B71D88D19\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\275EB863EC3D6B743A1BED20075E1C90\Version = "809491831"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3D929DDE9EFDAB04A831039FECE1F281	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D929DDE9EFDAB04A831039FECE1F281\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64	windowsdesktop-runtime-6.0.15-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72152CA1BB9A9F4B9206B6B71D88D19\ProductName = "Microsoft .NET Host - 6.0.15 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72152CA1BB9A9F4B9206B6B71D88D19\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72152CA1BB9A9F4B9206B6B71D88D19\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BABA353BC7F7506458D2E0C5E3F12A98\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.63.56695_x64\Version = "48.63.56695"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\275EB863EC3D6B743A1BED20075E1C90\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\275EB863EC3D6B743A1BED20075E1C90\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D929DDE9EFDAB04A831039FECE1F281\PackageCode = "9316A3B91A8FA7644ABFECB4F1243899"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72152CA1BB9A9F4B9206B6B71D88D19\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{AC25127C-9BB1-4F9A-9B02-B6B6178DD891}v48.63.56695\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BABA353BC7F7506458D2E0C5E3F12A98\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\10C2FB124D950F25FF9ADDA2F01D0202	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.63.56695_x64\Version = "48.63.56695"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D929DDE9EFDAB04A831039FECE1F281\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CBE19867019561065F9A6B3501BB72B9\3D929DDE9EFDAB04A831039FECE1F281	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C72152CA1BB9A9F4B9206B6B71D88D19\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BABA353BC7F7506458D2E0C5E3F12A98\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BABA353BC7F7506458D2E0C5E3F12A98\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\275EB863EC3D6B743A1BED20075E1C90\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.63.56695_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.63.56729_x64\ = "{B353ABAB-7F7C-4605-852D-0E5C3E1FA289}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BABA353BC7F7506458D2E0C5E3F12A98\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D929DDE9EFDAB04A831039FECE1F281\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BABA353BC7F7506458D2E0C5E3F12A98\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72152CA1BB9A9F4B9206B6B71D88D19\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F4236F1E6175C8944C86048FF35365B1\275EB863EC3D6B743A1BED20075E1C90	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\275EB863EC3D6B743A1BED20075E1C90\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C72152CA1BB9A9F4B9206B6B71D88D19\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72152CA1BB9A9F4B9206B6B71D88D19\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\275EB863EC3D6B743A1BED20075E1C90\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D929DDE9EFDAB04A831039FECE1F281\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72152CA1BB9A9F4B9206B6B71D88D19\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\275EB863EC3D6B743A1BED20075E1C90\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D929DDE9EFDAB04A831039FECE1F281\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{EDD929D3-DFE9-40BA-8A13-30F9CE1E2F18}v48.63.56695\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\DisplayName = "Microsoft .NET Host - 6.0.15 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BABA353BC7F7506458D2E0C5E3F12A98	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.63.56729_x64	windowsdesktop-runtime-6.0.15-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{06cd4f51-0a4b-471c-9ccc-e3dd11294c03}\Version = "6.0.15.32217"	windowsdesktop-runtime-6.0.15-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.63.56695_x64	windowsdesktop-runtime-6.0.15-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D929DDE9EFDAB04A831039FECE1F281\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\Dependents\{06cd4f51-0a4b-471c-9ccc-e3dd11294c03}	windowsdesktop-runtime-6.0.15-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.63.56695_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C72152CA1BB9A9F4B9206B6B71D88D19	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BABA353BC7F7506458D2E0C5E3F12A98\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BABA353BC7F7506458D2E0C5E3F12A98\PackageCode = "CB90CA157EBF6BA48A1C32AC8EB78EF8"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{06cd4f51-0a4b-471c-9ccc-e3dd11294c03}\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.15 (x64)"	windowsdesktop-runtime-6.0.15-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CBE19867019561065F9A6B3501BB72B9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.63.56695_x64\Dependents\{06cd4f51-0a4b-471c-9ccc-e3dd11294c03}	windowsdesktop-runtime-6.0.15-win-x64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 792098.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2752	powershell.exe
2752	powershell.exe
3336	NovaInstaller.exe
1972	msedge.exe
1972	msedge.exe
3172	msedge.exe
3172	msedge.exe
1772	identity_helper.exe
1772	identity_helper.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6140	msedge.exe
6140	msedge.exe
5760	msiexec.exe
5760	msiexec.exe
5760	msiexec.exe
5760	msiexec.exe
5760	msiexec.exe
5760	msiexec.exe
5760	msiexec.exe
5760	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5096	NovaSetup.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	3336	NovaInstaller.exe
Token: SeShutdownPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeSecurityPrivilege	5760	msiexec.exe
Token: SeCreateTokenPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeLockMemoryPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeMachineAccountPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeTcbPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeSecurityPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeTakeOwnershipPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeLoadDriverPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeSystemProfilePrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeSystemtimePrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeProfSingleProcessPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeIncBasePriorityPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeCreatePagefilePrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeCreatePermanentPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeBackupPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeRestorePrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeShutdownPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeDebugPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeAuditPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeSystemEnvironmentPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeChangeNotifyPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeRemoteShutdownPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeUndockPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeSyncAgentPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeEnableDelegationPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeManageVolumePrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeImpersonatePrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeCreateGlobalPrivilege	4132	windowsdesktop-runtime-6.0.15-win-x64.exe
Token: SeRestorePrivilege	5760	msiexec.exe
Token: SeTakeOwnershipPrivilege	5760	msiexec.exe
Token: SeRestorePrivilege	5760	msiexec.exe
Token: SeTakeOwnershipPrivilege	5760	msiexec.exe
Token: SeRestorePrivilege	5760	msiexec.exe
Token: SeTakeOwnershipPrivilege	5760	msiexec.exe
Token: SeRestorePrivilege	5760	msiexec.exe
Token: SeTakeOwnershipPrivilege	5760	msiexec.exe
Token: SeRestorePrivilege	5760	msiexec.exe
Token: SeTakeOwnershipPrivilege	5760	msiexec.exe
Token: SeRestorePrivilege	5760	msiexec.exe
Token: SeTakeOwnershipPrivilege	5760	msiexec.exe
Token: SeRestorePrivilege	5760	msiexec.exe
Token: SeTakeOwnershipPrivilege	5760	msiexec.exe
Token: SeRestorePrivilege	5760	msiexec.exe
Token: SeTakeOwnershipPrivilege	5760	msiexec.exe
Token: SeRestorePrivilege	5760	msiexec.exe
Token: SeTakeOwnershipPrivilege	5760	msiexec.exe
Token: SeRestorePrivilege	5760	msiexec.exe
Token: SeTakeOwnershipPrivilege	5760	msiexec.exe
Token: SeRestorePrivilege	5760	msiexec.exe
Token: SeTakeOwnershipPrivilege	5760	msiexec.exe
Token: SeRestorePrivilege	5760	msiexec.exe
Token: SeTakeOwnershipPrivilege	5760	msiexec.exe
Token: SeRestorePrivilege	5760	msiexec.exe
Token: SeTakeOwnershipPrivilege	5760	msiexec.exe
Token: SeRestorePrivilege	5760	msiexec.exe
Token: SeTakeOwnershipPrivilege	5760	msiexec.exe
Token: SeRestorePrivilege	5760	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3336	NovaInstaller.exe
3336	NovaInstaller.exe
3336	NovaInstaller.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3336	NovaInstaller.exe
3336	NovaInstaller.exe
3336	NovaInstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 3356	5096	NovaSetup.exe	85
PID 5096 wrote to memory of 3356	5096	NovaSetup.exe	85
PID 5096 wrote to memory of 3356	5096	NovaSetup.exe	85
PID 3356 wrote to memory of 2752	3356	cmd.exe	87
PID 3356 wrote to memory of 2752	3356	cmd.exe	87
PID 3356 wrote to memory of 2752	3356	cmd.exe	87
PID 5096 wrote to memory of 3336	5096	NovaSetup.exe	90
PID 5096 wrote to memory of 3336	5096	NovaSetup.exe	90
PID 5096 wrote to memory of 3336	5096	NovaSetup.exe	90
PID 3336 wrote to memory of 3840	3336	NovaInstaller.exe	95
PID 3336 wrote to memory of 3840	3336	NovaInstaller.exe	95
PID 3840 wrote to memory of 3172	3840	NovaLauncher.exe	97
PID 3840 wrote to memory of 3172	3840	NovaLauncher.exe	97
PID 3172 wrote to memory of 3908	3172	msedge.exe	98
PID 3172 wrote to memory of 3908	3172	msedge.exe	98
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 3572	3172	msedge.exe	99
PID 3172 wrote to memory of 1972	3172	msedge.exe	100
PID 3172 wrote to memory of 1972	3172	msedge.exe	100
PID 3172 wrote to memory of 1808	3172	msedge.exe	102
PID 3172 wrote to memory of 1808	3172	msedge.exe	102
PID 3172 wrote to memory of 1808	3172	msedge.exe	102
PID 3172 wrote to memory of 1808	3172	msedge.exe	102
PID 3172 wrote to memory of 1808	3172	msedge.exe	102
PID 3172 wrote to memory of 1808	3172	msedge.exe	102
PID 3172 wrote to memory of 1808	3172	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\NovaSetup.exe
"C:\Users\Admin\AppData\Local\Temp\NovaSetup.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Nova"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Nova"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2752
- C:\Users\Admin\AppData\Local\Nova\NovaInstaller.exe
  "C:\Users\Admin\AppData\Local\Nova\NovaInstaller.exe" -install
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Users\Admin\AppData\Local\Nova\Launcher\NovaLauncher.exe
    "C:\Users\Admin\AppData\Local\Nova\Launcher\NovaLauncher.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.12&gui=true
      4⤵
      Enumerates system info in registry
      NTFS ADS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffab4446f8,0x7fffab444708,0x7fffab444718
        5⤵
        
        PID:3908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
        5⤵
        
        PID:3572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
        5⤵
        
        PID:1808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
        5⤵
        
        PID:3780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
        5⤵
        
        PID:736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
        5⤵
        
        PID:4404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5340 /prefetch:8
        5⤵
        
        PID:1624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
        5⤵
        
        PID:392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
        5⤵
        
        PID:4092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6092 /prefetch:8
        5⤵
        
        PID:1992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
        5⤵
        
        PID:3212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        
        PID:1816
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x258,0x25c,0x260,0x234,0x264,0x7ff7963e5460,0x7ff7963e5470,0x7ff7963e5480
        6⤵
        
        PID:508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
        5⤵
        
        PID:5112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:1
        5⤵
        
        PID:2448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
        5⤵
        
        PID:1740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
        5⤵
        
        PID:1240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1892 /prefetch:1
        5⤵
        
        PID:5532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3164 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,7236080051405406398,7036349759721432270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1872 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6140
    - - C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe
        
        "C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe"
        5⤵
        Executes dropped EXE
        
        PID:5112
      - C:\Windows\Temp\{2C229BEE-F37C-4DD6-BD92-4D472B7E8622}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe
        
        "C:\Windows\Temp\{2C229BEE-F37C-4DD6-BD92-4D472B7E8622}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=576
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1296
        
        C:\Windows\Temp\{AE16D4F5-EF20-442C-94DD-D108B47637E1}\.be\windowsdesktop-runtime-6.0.15-win-x64.exe
        
        "C:\Windows\Temp\{AE16D4F5-EF20-442C-94DD-D108B47637E1}\.be\windowsdesktop-runtime-6.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{BEE81E13-0D85-4901-A8DA-E069867E4B82} {AF59B8D5-ED8E-4D08-9564-3184A0155BFB} 1296
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4132
    - - C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe
        
        "C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe"
        5⤵
        Executes dropped EXE
        
        PID:3248
      - C:\Windows\Temp\{2DF837CD-1F37-4A8B-B19E-721782799096}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe
        
        "C:\Windows\Temp\{2DF837CD-1F37-4A8B-B19E-721782799096}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5324
    - - C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe
        
        "C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe"
        5⤵
        Executes dropped EXE
        
        PID:3364
      - C:\Windows\Temp\{D4F3DBC7-8FF2-4E69-8FA8-E90C625984F5}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe
        
        "C:\Windows\Temp\{D4F3DBC7-8FF2-4E69-8FA8-E90C625984F5}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3244

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5760
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7B131B49785E32621A488FDD5741FAFD
  2⤵
  - Loads dropped DLL
  PID:5844
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1528F14274DCA58AA0366FC06B2E7397
  2⤵
  - Loads dropped DLL
  PID:4992
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1619755E8382DC2B01B0EE82F247370A
  2⤵
  - Loads dropped DLL
  PID:4104
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A1B15C586B1DBE593A9881519672A51F
  2⤵
  - Loads dropped DLL
  PID:5640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e592989.rbs

Filesize
56KB

MD5
d8cbe0dae3c850bc905a390ea7ca0569

SHA1
42cc0068ecc691dd8c38f3236aaae46d5285248d

SHA256
a47013269d5ab2c01af2e3c995652c53d2298d2359196662fca711366ef7ff2c

SHA512
2daad97e78b16b53a165971872aca71526d22e6b137dfe685a4b8823c5a36a76ec51f27509580cb1d057cad12bf2f501eb93f55fedd7f43731f8ceb44ce9fb3f

Download Submit
C:\Config.Msi\e59298d.rbs

Filesize
8KB

MD5
b6321b0b44ab73cc02e9d7d8735c4ffe

SHA1
12c17dc2fad2772c33c2abb9d29e59be12b2421a

SHA256
a97bbe514b282731c9a62dd43eb67500ed140dc1ef5997b7b704242ebad3c4fd

SHA512
1f950458f3602284059d33736a73b882dc4c7c54472f1bd1f20fdaf5028a7ece41b9cf375d8c75289ea3f2c4dee73f4d06540f2ba8bc68f431a19d6b57e6e9f5

Download Submit
C:\Config.Msi\e592991.rbs

Filesize
10KB

MD5
ef54c970553b95ecdc71e5588844a56e

SHA1
0ff3df51f89e7d8b3e4ba98a41d496c3ad629bf0

SHA256
1f967d25ed92b1b5936a0d3f5a8625cd35d3c74a1c03b5b7f8094cb9fb754f5f

SHA512
f1c000b89aab549f846c0bf1fd86f458e299aa988ecc84fe1b90a98affa92838ee7bdc1bee613999b4861cabd4b83fbe6de82a446efc94494a41887420a3b41f

Download Submit
C:\Config.Msi\e592995.rbs

Filesize
87KB

MD5
dc9dd1cb65d9e87b9b61bbd1443d68fe

SHA1
47662899b6456d661d95d51c993eb2842dfa8930

SHA256
ac786f5d828cd47d10ec0f0f0f036563416f9bd63c28397a51bf4608f1175637

SHA512
f8c8376c87b75a6270eff22688729993c821cfef9d6e5a73ab0a18a2b64ecad501da558c1de146266723757d7f75752cce4dcbedfc5bad22a65a60a38c247f02

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
425e83cc5a7b1f8edfbec7d986058b01

SHA1
432a90a25e714c618ff30631d9fdbe3606b0d0df

SHA256
060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd

SHA512
4bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
5b83ea62684d85b4e5234f5abad0a7e6

SHA1
68000a249ef519ebf95ae1223a10486c9b599a46

SHA256
0cc4a3f4254851f15b5c379e50cf6eab12bd6d68ce59e70a0af8875cdaee9dbd

SHA512
15b9aa2903da8bb5987fc76629ed821f5cdaeb518308458b6bf6c662b26e0c95b75a9c862a3ff35f086ed0fd837d4356e3a873645a832b892657f5573272eebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
5983da17e65ed4ab1ce768293bc7aa28

SHA1
cb6aa877ba38fcf194f2a34f1ad3b2b8aa65707e

SHA256
607db999c343ce80bbfb066f87bfc061e5891986b33c27192e008c5236137547

SHA512
82bcd10ccb07510388677678a4252b73af1cbd3b1bd057d8ed792541a463356c41c7726d17045113b6636b2f3bce58866dbf5a8fc846c7fefe5eb03b2e762c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
b189eb77d4cf33df1bb180ec114d1952

SHA1
c9ee13362c2ce869b351e374abeb499083d0e191

SHA256
6cf8ba5dc97b3788f38561c6f8d86bd3c27fbcb32741e64f6e553d28fa0bee6e

SHA512
16e710d851a79ac43612450fd161bc5740636ce7c8bea27a8cf8bd19f92df8a7ec1d5c0391a162179fb8f6f67730bdc3960faf1150d34b7244327a6213ed04d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3804be56df71817ab6122b6631e62608

SHA1
de4d87d54144640adb909bd2e444513ac01bf091

SHA256
781d9bc4c421d2f93550f716ac083bd53a2a7de01a9bdc5832f051f13146948e

SHA512
10abbb7dde4a11f848119e3997ad027c3b0643fb5d89151f2d0dfa852408d15a4692428cb3b42317c623bee77d47d0d7b3532440615dab14a69888d67886ae1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b08e50c8e9cddc2b0ff0db698b97803

SHA1
95bd2798d2a31d531a838b6b88ce2aabca262ac2

SHA256
747e91c114ceb5efef040abfd401d6e6696dd97d703ae5ff5405cd713411115a

SHA512
f58cd6d0c20fd5851f812394e92cc21742d6768e902a183da40a1c9d12acdf54a8f2153064b04fe8e01267600b4a56bff326e04d88bffc03aa793f7d13da08f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
8e4a4ffdfe3b16f32cccff5ab9f90af6

SHA1
dd0c6e000c7a2ef1b342a9c8d99fd287c37fa2c2

SHA256
a3892763b292d9d9c0ddefb80a82b8fdcad4b95e5fd67f2cc1c052121990f9d5

SHA512
796479a2680a127b542d374e93ae4266e03e8e7db0861808650e05fd7f55fec194c7f70c984f81076e3a8ddee6c65e8134be0e452a891cd3b1460037cf06b0a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
46301515ff5887a6a9e81a9814f6e44f

SHA1
fd78136e9f6046ef8dc4f35eb4d352cc901bfab6

SHA256
c9b059a7d99b7ae03049fdab9fbebb13f0c2e1189efaa4381023bfc5a939823c

SHA512
45406b6747d4ae1edc5afec5b74337b00f9daa00e08905f71786d2c17218070f129998f2e78694c313b06c6eca69ce022b29e399a93ddd54822afd57768a75cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a19a75b85d65e2539bda6b48dc8934ee

SHA1
1dc147a7473944565e74afbd8e1800f440143f31

SHA256
a89b1823e4d9dbda74eca8c9bc28428c4811191f784bc16e083843ce1c8104c7

SHA512
fee9b44606ff921f7d75a06372b60f5cec084f81eb8c285a55564fdfa7fa2ecd5a432ac6061f6628d2b8af0ccd36fd184939f67e2ee42a8413bfcf0ea0984ea7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13c9fb078cbfd34723d4903ac1682f44

SHA1
6afba727a1171593b970d1e90904a53be821b9c8

SHA256
f4c17e4ff4871768a84a65b912affa0dc6df02ba5cf8bcebe121f52ffffd6ebf

SHA512
8eafa3b42be69bb17a02723bed44102857725df7d93b1e362aaad2d068cfbcb1661129196434b69900b031bb0c71c7503ea1a478ac73bf733c7a07c6e0347c05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d53ac35ab3976e67caeed75c4d44ffc1

SHA1
c139ab66d75dc06f98ada34b5baf4d5693266176

SHA256
647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437

SHA512
391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
17ddc990c9b570dd6ba880b103edc3d0

SHA1
d9de5ae65dc63f7c4a57c55488acfe9ab5d1f938

SHA256
23a0dce0b7c9f948b8ca3a539a9b100b1d764d2dbd070b9e61403db704faff83

SHA512
edd3e2d14c9ad437badb9d3e063e4e8d9f1aa7eace5dcec0cf34edd8619b3e51b21ab4f4a119280ec03be01563fa5581ce05699258136577f6847e0828675c14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
e3699480bc79796371cd4815d093445e

SHA1
88c424d85f8d3f19b6c74529d178f9d8f908bdbd

SHA256
9805571a8a0d63803a5342480d5d88de95ce326be8503cd81900f0d19d473627

SHA512
05c3c127c6f0e8628ff529662e6b2bd16168cc55d9277e3c0d0c786942f43f82d781d7fb2fd981ea529d7d70a200a8cb52a76770ec664439e3315044f0e01195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
b8cb807263c8f18f847eff3396cf31a9

SHA1
ac41223a71b5c6da2ba15c7be4f57399330ef238

SHA256
82834052794658d478d1600a00e934e177733f9905090f8ff97be9db259c2f0f

SHA512
c05fafaad91223fca9a9f99c0e0027003bfa595707063a6106d6fee4cb8b1973ab4355abf7df481560a2812c831e304850ad9371ce6847631409dbf83ad51043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
82f10761366654283c477479d0fd74d2

SHA1
361245c1bb8539baf40542d32e4c25b32de1ed4c

SHA256
99893262372d8ff8fd72cbca7c50c07defe5da899f16e509ad00fdad5c45ff0d

SHA512
31b05f1b812460cf71840c9e126386146093cb29007e45e1c1c4c3f5bc4549cb9b938e09796a95abd88938e36c87d2ff201c77d7485defe584bf5be51d6a373b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
90f37c96455cdbb2a9d9f8313a9ea272

SHA1
f198eaf999ffb00e91b8a5bacc136d354306fb8a

SHA256
e1108d5a789dd50a2b74fae620bda60a6e0518b46dc7b125a0b99404cceeae88

SHA512
93ed1910863f96b953bfaac17709bc3a464715331b3e30ed7bb6f99debd27a02619c641c72cd4efb84b29a3eac4a771b62e6a6ae0c576a0e9f602f17da20b9fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
8c5aa3a75d79e1fd65fa6e89cbc7774a

SHA1
45d7af63d86fa364eab8b5889be7b5f59964d9bf

SHA256
9d98b8006233ad9afbb6a65d1823a5dd4cdd4397b3fbbe401b71e3e013b1ca22

SHA512
cadd228680fd1eadc77e7e22571ba94d1a055ce71f11f4d04189dfb09d52684f5a563f65ecbef799afa99be42dc884aee7fd4ab990fe1acca41ec2bb6355022a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
095bf025b2072a158badcac3911a49d4

SHA1
ca4d606dfe68a4c918e76b9547c9b462ce839d73

SHA256
f1ac53b8e14041e689bd0b5899b7015e839ddab82bea7c579a336ebe0dfd9afd

SHA512
61419cd218d2ae3990c746da368bfad6043c58e79191f8fc17c0104e21df6fde91958d2c2ec45fdb799b12b9dc28a0d7f240317a68a9d685b3ae379ce017099e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
70379714bb5b251d6a4dd261824f99ae

SHA1
26a2c0109a3c5c1066c133e2052c25d42dee5934

SHA256
75136767dfe8100754db22ae4ac231c0b9284e7eea6b446da13b2d4157ad10d9

SHA512
fdeedfeaf1dd7ce789cfa961fa9b8defee5587a24a35e83aaf18c89842ec08c2856c1be7a0e841cb4a891365e9c67a71ebef3f9a7233b17f4892cfcb431b7675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5796e1.TMP

Filesize
704B

MD5
5607e3f58700c2cb28a39fe265dce1e8

SHA1
5de1e9fb664458a03f5a8bad524a25cf993d53b2

SHA256
375e22c93a0c5d3a3d0195ad3cdf9e28f477b0f23cc2b750da70d10abd4afae1

SHA512
ba3279827853c59bb8adf9da74356cc21a13f01fab7c8af77462788ac415728ab10ca280dec6495a76c444066a9a6a090c06765838ac7bf3610c182576e9997f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
6c4e4d255dff0f4f0aef97f7333ef4c6

SHA1
d1bb9ff62aad57450a84001baed54d2ac2df483f

SHA256
85240481218b7ba8a9e142273347872d515d14f47d82c1e036b33ba2fa7021ba

SHA512
f0942d27cbe732b9dd9a10c3ad625553a1091732e941d542afab84c8aa7777657204c8eb7b3f467ca50850de37e72c9154dd35dd97f4df657786be0e909bd4d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
a5f292b5c295ec2d49e428e3d644b830

SHA1
4c28b0dc6434e1e8ae843c6f44377f572bc7a778

SHA256
363957154ad2f960ffd24b43b649766b509607f59c3e29b4a31297a1632314be

SHA512
86693459e009f788b06b3a6e9d443a7f6bc7d243d661494ddb5dcc2d2fcc784171bb41188388fa4523b166d702273e66a36ba5f33eb073d24b036dd1e2735be8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1267e6ee0cc55b4972c9478710b8fe3a

SHA1
ab8e5a6775fc972f5e1e36fe9029284966ca284a

SHA256
d1d143255a8557b3d2eb7a6c29b8a700bd33dd8ddd28808934527c55f3767c86

SHA512
c6b9b7d2198195b01469ea8ce8b184de1d1401acd5e938d721e04db94e94227a0fcfc4fbe48319988a1a6e6936817a16b4821a27c67c1f3cbeb49fd9307cbb57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a7c08e267007a98baf917256f5696065

SHA1
cb00bfc612eb294589f0ffec3b2d6cc6ab0d41f0

SHA256
6547ef5ada7bf964e63cdc83394d8704796fa6cebd5d8e0f616adb544661278c

SHA512
bc94b8206d0496d7baacde673ad0d8de1e97c0b6de8dd5bf3267366bceee17ca2daa415bce1cd06984608dba6e39e0e6f08756552aedbe7ffca929b0031deb77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
88e90f4f26015a8aa8bd1217ba962a13

SHA1
78536b026233e3f443dde70749efa7712bdde7be

SHA256
6719b3d9637091245aa85db1209220385f9fe0c2e4a021bd542e21de3b4f6dbf

SHA512
6c478645eb044e35567cdab2116acbdf0b6a97f37c3c6f7d1598e721af802bf2d1791fbe90bc26444c5c62c2d08a978774684edbf4564ec34beb7aa962ff2316

Download Submit
C:\Users\Admin\AppData\Local\Nova\Launcher\NovaLauncher.exe

Filesize
152KB

MD5
e9053a363fbe510e63555643f45c57d6

SHA1
b0ba255e5fabbb71ad43282138ba431a47ee5d3d

SHA256
c1372e02d59db8421d05878d0c9c0c9d0458d7876a28dce8300e47d4d78bf77a

SHA512
e95e5d942c14c868ce6fe75d05183b19c9b1ea877a3c38bd4c317e26473f630e8c9220885168ada2f8602238221506a2736e2dd0708000978d670864ad4ab00d

Download Submit
C:\Users\Admin\AppData\Local\Nova\Launcher\NovaLauncher.exe

Filesize
152KB

MD5
e9053a363fbe510e63555643f45c57d6

SHA1
b0ba255e5fabbb71ad43282138ba431a47ee5d3d

SHA256
c1372e02d59db8421d05878d0c9c0c9d0458d7876a28dce8300e47d4d78bf77a

SHA512
e95e5d942c14c868ce6fe75d05183b19c9b1ea877a3c38bd4c317e26473f630e8c9220885168ada2f8602238221506a2736e2dd0708000978d670864ad4ab00d

Download Submit
C:\Users\Admin\AppData\Local\Nova\Launcher\NovaLauncher.exe

Filesize
152KB

MD5
e9053a363fbe510e63555643f45c57d6

SHA1
b0ba255e5fabbb71ad43282138ba431a47ee5d3d

SHA256
c1372e02d59db8421d05878d0c9c0c9d0458d7876a28dce8300e47d4d78bf77a

SHA512
e95e5d942c14c868ce6fe75d05183b19c9b1ea877a3c38bd4c317e26473f630e8c9220885168ada2f8602238221506a2736e2dd0708000978d670864ad4ab00d

Download Submit
C:\Users\Admin\AppData\Local\Nova\NovaInstaller.exe

Filesize
649KB

MD5
ef1f55617f1ed1e96fb2cd2c37c2680c

SHA1
78f32266ca4b265789fa0f8962815d462110d7d4

SHA256
677445f18f2c744ca6f287b668bb172e7074382fd61e803ff312b9df09f2c449

SHA512
a092be5e56f5247e8c5dc09b1bc8a60c63a009fa553319b71bd999908475c6077d51ef134192050a152342d7af85b5a1d48b06b539c6e40fc9281c805897b54b

Download Submit
C:\Users\Admin\AppData\Local\Nova\NovaInstaller.exe

Filesize
649KB

MD5
ef1f55617f1ed1e96fb2cd2c37c2680c

SHA1
78f32266ca4b265789fa0f8962815d462110d7d4

SHA256
677445f18f2c744ca6f287b668bb172e7074382fd61e803ff312b9df09f2c449

SHA512
a092be5e56f5247e8c5dc09b1bc8a60c63a009fa553319b71bd999908475c6077d51ef134192050a152342d7af85b5a1d48b06b539c6e40fc9281c805897b54b

Download Submit
C:\Users\Admin\AppData\Local\Nova\NovaInstaller.exe

Filesize
649KB

MD5
ef1f55617f1ed1e96fb2cd2c37c2680c

SHA1
78f32266ca4b265789fa0f8962815d462110d7d4

SHA256
677445f18f2c744ca6f287b668bb172e7074382fd61e803ff312b9df09f2c449

SHA512
a092be5e56f5247e8c5dc09b1bc8a60c63a009fa553319b71bd999908475c6077d51ef134192050a152342d7af85b5a1d48b06b539c6e40fc9281c805897b54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.15_(x64)_20230331051327_000_dotnet_runtime_6.0.15_win_x64.msi.log

Filesize
2KB

MD5
ec08c6697f518fe48da5b05327559fc8

SHA1
60ba5d045fae7d8f6e086599ebefd0b844402d79

SHA256
467bb12b0586e651145a609967e62dfc47818f60b83bc39f1fc56eb9120db3c3

SHA512
475ff7412c2b54fcb8e630f2f1f62059b8a2b63de11ce09cb7a5b940b58d3bb0787646a88bebbf317127a0ce966aceb1ec6b96a39098786b3c0d36e931790b19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.15_(x64)_20230331051327_001_dotnet_hostfxr_6.0.15_win_x64.msi.log

Filesize
2KB

MD5
4f48088a3ebc33f287bbc1467cb4360d

SHA1
6172624282a48a57619cbea5e2377c77d4d7aeb9

SHA256
098fe991ce0e9e303409e2230083685dd961f70fc0e6e5a8abf649ebc8a6f305

SHA512
8453572775ae74cb5b4e0e46a7620b9a6bf7143b4074281519f39c9c1b51f7fd16ce55ecd6cba6f759efc3e7464a3900a573202a3921302d885047371b586407

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.15_(x64)_20230331051327_002_dotnet_host_6.0.15_win_x64.msi.log

Filesize
2KB

MD5
3767611e4a4a6c663b1a610f7a9226fa

SHA1
105d5ccace13b33a41c140411bde131f2a5253d1

SHA256
1782884936264c4b10a7a679d366d0ba421fc87ff04f1219fdd8b2123fe512de

SHA512
c4d8814bba3d1fe3998b27dc3a5cdadffb10ee603df76075ae8a47568b57ca4bd2ec3c55b98b959c9f9536f76e72d8ab4d62e1df3685c88a3630433a604f8745

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.15_(x64)_20230331051327_003_windowsdesktop_runtime_6.0.15_win_x64.msi.log

Filesize
2KB

MD5
c60e674d562d13a3fd295edfadbc798d

SHA1
97714b8688815b8a2273e456e90768de84a30194

SHA256
31782229ed9734f53d3ee57d62eb0a2f7910493e19e5cd82b7e780cecaba4e7e

SHA512
9365a440340fd4b09c67b04af219a4bb6dbb2489f521a4e9da2ee679a47dfecd79ab3aeedef79138f950ecdaeb366ceed6e496abda15acf2291b5f14a44505c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tbwrhcrv.kha.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
186638527c42c8257431c75018b5e9e3

SHA1
0ab7cd1ea154b5f44a0b1d855111f2e315ce8adf

SHA256
a857a52a374ffbe610f1b58842b297400ae7ec64a43ef561086460826a748ae0

SHA512
0837e635a594d66bfff955bf0a24ab6002e626bec3ee31c24e1a7c96a90df89d0fc21560434c5a153aa39000786611ffe88435e2877789d5f3838ed9f23a7e53

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
54.7MB

MD5
9cb18d6037386c8c5aa035aacd89ec37

SHA1
21b22ad2b8afe5340367f87657125ab2246e96a2

SHA256
29bd24988adfa726b19aa55d02dc8201b9616f0928a0ef8bc80372680d797f04

SHA512
62412c45ba5ebf89b0ea2c3d9dcce3a7f05198d4db368f63956f7ae58b368baa059343a2de39d24e20ffe126145f31c72131914cb2793f002921a975e69c3bb4

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
54.7MB

MD5
9cb18d6037386c8c5aa035aacd89ec37

SHA1
21b22ad2b8afe5340367f87657125ab2246e96a2

SHA256
29bd24988adfa726b19aa55d02dc8201b9616f0928a0ef8bc80372680d797f04

SHA512
62412c45ba5ebf89b0ea2c3d9dcce3a7f05198d4db368f63956f7ae58b368baa059343a2de39d24e20ffe126145f31c72131914cb2793f002921a975e69c3bb4

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
54.7MB

MD5
9cb18d6037386c8c5aa035aacd89ec37

SHA1
21b22ad2b8afe5340367f87657125ab2246e96a2

SHA256
29bd24988adfa726b19aa55d02dc8201b9616f0928a0ef8bc80372680d797f04

SHA512
62412c45ba5ebf89b0ea2c3d9dcce3a7f05198d4db368f63956f7ae58b368baa059343a2de39d24e20ffe126145f31c72131914cb2793f002921a975e69c3bb4

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
54.7MB

MD5
9cb18d6037386c8c5aa035aacd89ec37

SHA1
21b22ad2b8afe5340367f87657125ab2246e96a2

SHA256
29bd24988adfa726b19aa55d02dc8201b9616f0928a0ef8bc80372680d797f04

SHA512
62412c45ba5ebf89b0ea2c3d9dcce3a7f05198d4db368f63956f7ae58b368baa059343a2de39d24e20ffe126145f31c72131914cb2793f002921a975e69c3bb4

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
54.7MB

MD5
9cb18d6037386c8c5aa035aacd89ec37

SHA1
21b22ad2b8afe5340367f87657125ab2246e96a2

SHA256
29bd24988adfa726b19aa55d02dc8201b9616f0928a0ef8bc80372680d797f04

SHA512
62412c45ba5ebf89b0ea2c3d9dcce3a7f05198d4db368f63956f7ae58b368baa059343a2de39d24e20ffe126145f31c72131914cb2793f002921a975e69c3bb4

Download Submit
C:\Windows\Installer\MSI3A7F.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI3A7F.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI4D2E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI4D2E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI52BD.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI52BD.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI52BD.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5A50.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5A50.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5E39.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5E39.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI64D3.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI64D3.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI6800.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI6800.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI80AB.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI80AB.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\e59298a.msi

Filesize
25.8MB

MD5
1b50507ea7a40bfe042910047a18ed43

SHA1
fbe6fd882ce86479510a34328206610cbdd89d69

SHA256
5ac01aa1ed6d52befab6b87fa6555cc17e86dca4329b07234f619eda6374e024

SHA512
f26321979e9e4b8dd8cabba095d9c6b52915013703297387ad59e921a7bb6e089f3205ef22adacce44d2012ad30083844afc20bb461e7e1a3fbeb29a13f353b4

Download Submit
C:\Windows\Installer\e59298b.msi

Filesize
804KB

MD5
ef1b6e9aeb319d35105e3e08703f36b7

SHA1
e071debe8fe93b58bebf79dbb7f14611b5aba0e7

SHA256
23e2fdf1dc8903c668bc8f536c7c14c60fe482e1435901c857c312b91d42831a

SHA512
6cee0c562c4f3b5e263ccd4797ba7320a864449047040746999fb82d240706824027cb787dfa17567e62a70bbc295f5a5eb4a92eb9df373f2afbf3f285137c8f

Download Submit
C:\Windows\Installer\e592996.msi

Filesize
28.5MB

MD5
6782f20a63e467a1fc257a2ffbc96a38

SHA1
3f717a1711522bbf6e721f3cbeac47c55d5883cd

SHA256
df1b548286fd396f7e457e97421a908ef2f0833647d74012da22cad611bf4941

SHA512
47263fc8121815f35da696421e016ee05b6afb830f4688a53d6f4b35b92652006fa18e486e2886d41bb3a433dea5d8d47ea97832f9ae9fca6f4fdeb848ac1b21

Download Submit
C:\Windows\Temp\{2C229BEE-F37C-4DD6-BD92-4D472B7E8622}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
063b737d9ee3148788fe0120bc9b21b0

SHA1
8135283911833182b1dba6eb983da907927c5bc8

SHA256
9ac9e5a1fee76222cc277f02de51354364afdea63b013436a69e07674a1c5aa3

SHA512
68fa3180e3414d01458631659a1df11aa7e28a1fb8b24cd5f740ddf87b2bfd30ceb8f1d2f9759ec058b5aaaed30468c972869a95c79bd57a3ec54b23a5d5c1c3

Download Submit
C:\Windows\Temp\{2C229BEE-F37C-4DD6-BD92-4D472B7E8622}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
063b737d9ee3148788fe0120bc9b21b0

SHA1
8135283911833182b1dba6eb983da907927c5bc8

SHA256
9ac9e5a1fee76222cc277f02de51354364afdea63b013436a69e07674a1c5aa3

SHA512
68fa3180e3414d01458631659a1df11aa7e28a1fb8b24cd5f740ddf87b2bfd30ceb8f1d2f9759ec058b5aaaed30468c972869a95c79bd57a3ec54b23a5d5c1c3

Download Submit
C:\Windows\Temp\{2DF837CD-1F37-4A8B-B19E-721782799096}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
063b737d9ee3148788fe0120bc9b21b0

SHA1
8135283911833182b1dba6eb983da907927c5bc8

SHA256
9ac9e5a1fee76222cc277f02de51354364afdea63b013436a69e07674a1c5aa3

SHA512
68fa3180e3414d01458631659a1df11aa7e28a1fb8b24cd5f740ddf87b2bfd30ceb8f1d2f9759ec058b5aaaed30468c972869a95c79bd57a3ec54b23a5d5c1c3

Download Submit
C:\Windows\Temp\{2DF837CD-1F37-4A8B-B19E-721782799096}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
063b737d9ee3148788fe0120bc9b21b0

SHA1
8135283911833182b1dba6eb983da907927c5bc8

SHA256
9ac9e5a1fee76222cc277f02de51354364afdea63b013436a69e07674a1c5aa3

SHA512
68fa3180e3414d01458631659a1df11aa7e28a1fb8b24cd5f740ddf87b2bfd30ceb8f1d2f9759ec058b5aaaed30468c972869a95c79bd57a3ec54b23a5d5c1c3

Download Submit
C:\Windows\Temp\{A7959577-C20D-4EC3-803C-F0A099992017}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{A7959577-C20D-4EC3-803C-F0A099992017}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{A7959577-C20D-4EC3-803C-F0A099992017}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{AE16D4F5-EF20-442C-94DD-D108B47637E1}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{AE16D4F5-EF20-442C-94DD-D108B47637E1}\.be\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
063b737d9ee3148788fe0120bc9b21b0

SHA1
8135283911833182b1dba6eb983da907927c5bc8

SHA256
9ac9e5a1fee76222cc277f02de51354364afdea63b013436a69e07674a1c5aa3

SHA512
68fa3180e3414d01458631659a1df11aa7e28a1fb8b24cd5f740ddf87b2bfd30ceb8f1d2f9759ec058b5aaaed30468c972869a95c79bd57a3ec54b23a5d5c1c3

Download Submit
C:\Windows\Temp\{AE16D4F5-EF20-442C-94DD-D108B47637E1}\.be\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
063b737d9ee3148788fe0120bc9b21b0

SHA1
8135283911833182b1dba6eb983da907927c5bc8

SHA256
9ac9e5a1fee76222cc277f02de51354364afdea63b013436a69e07674a1c5aa3

SHA512
68fa3180e3414d01458631659a1df11aa7e28a1fb8b24cd5f740ddf87b2bfd30ceb8f1d2f9759ec058b5aaaed30468c972869a95c79bd57a3ec54b23a5d5c1c3

Download Submit
C:\Windows\Temp\{AE16D4F5-EF20-442C-94DD-D108B47637E1}\dotnet_host_6.0.15_win_x64.msi

Filesize
736KB

MD5
c4b7d3a30699b54be5ff6c677d76db0a

SHA1
67efa5531478f5da9df9eaf6e18a3c4c40379e26

SHA256
da361b16db3de6f7339f8445b4d789b041921e8de87c64d36c423363c75e6bee

SHA512
1781b6050dac6a52ca898624446c465fbb29e7677aa55a11f1b67197af6e6d4e69da576927aaf8c78fd0245283f1a6a24cf5f232f62c2174090409970920accb

Download Submit
C:\Windows\Temp\{AE16D4F5-EF20-442C-94DD-D108B47637E1}\dotnet_hostfxr_6.0.15_win_x64.msi

Filesize
804KB

MD5
ef1b6e9aeb319d35105e3e08703f36b7

SHA1
e071debe8fe93b58bebf79dbb7f14611b5aba0e7

SHA256
23e2fdf1dc8903c668bc8f536c7c14c60fe482e1435901c857c312b91d42831a

SHA512
6cee0c562c4f3b5e263ccd4797ba7320a864449047040746999fb82d240706824027cb787dfa17567e62a70bbc295f5a5eb4a92eb9df373f2afbf3f285137c8f

Download Submit
C:\Windows\Temp\{AE16D4F5-EF20-442C-94DD-D108B47637E1}\dotnet_runtime_6.0.15_win_x64.msi

Filesize
25.8MB

MD5
1b50507ea7a40bfe042910047a18ed43

SHA1
fbe6fd882ce86479510a34328206610cbdd89d69

SHA256
5ac01aa1ed6d52befab6b87fa6555cc17e86dca4329b07234f619eda6374e024

SHA512
f26321979e9e4b8dd8cabba095d9c6b52915013703297387ad59e921a7bb6e089f3205ef22adacce44d2012ad30083844afc20bb461e7e1a3fbeb29a13f353b4

Download Submit
C:\Windows\Temp\{AE16D4F5-EF20-442C-94DD-D108B47637E1}\windowsdesktop_runtime_6.0.15_win_x64.msi

Filesize
28.5MB

MD5
6782f20a63e467a1fc257a2ffbc96a38

SHA1
3f717a1711522bbf6e721f3cbeac47c55d5883cd

SHA256
df1b548286fd396f7e457e97421a908ef2f0833647d74012da22cad611bf4941

SHA512
47263fc8121815f35da696421e016ee05b6afb830f4688a53d6f4b35b92652006fa18e486e2886d41bb3a433dea5d8d47ea97832f9ae9fca6f4fdeb848ac1b21

Download Submit
C:\Windows\Temp\{D4F3DBC7-8FF2-4E69-8FA8-E90C625984F5}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
063b737d9ee3148788fe0120bc9b21b0

SHA1
8135283911833182b1dba6eb983da907927c5bc8

SHA256
9ac9e5a1fee76222cc277f02de51354364afdea63b013436a69e07674a1c5aa3

SHA512
68fa3180e3414d01458631659a1df11aa7e28a1fb8b24cd5f740ddf87b2bfd30ceb8f1d2f9759ec058b5aaaed30468c972869a95c79bd57a3ec54b23a5d5c1c3

Download Submit
C:\Windows\Temp\{D4F3DBC7-8FF2-4E69-8FA8-E90C625984F5}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
063b737d9ee3148788fe0120bc9b21b0

SHA1
8135283911833182b1dba6eb983da907927c5bc8

SHA256
9ac9e5a1fee76222cc277f02de51354364afdea63b013436a69e07674a1c5aa3

SHA512
68fa3180e3414d01458631659a1df11aa7e28a1fb8b24cd5f740ddf87b2bfd30ceb8f1d2f9759ec058b5aaaed30468c972869a95c79bd57a3ec54b23a5d5c1c3

Download Submit
C:\Windows\Temp\{D4F3DBC7-8FF2-4E69-8FA8-E90C625984F5}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
063b737d9ee3148788fe0120bc9b21b0

SHA1
8135283911833182b1dba6eb983da907927c5bc8

SHA256
9ac9e5a1fee76222cc277f02de51354364afdea63b013436a69e07674a1c5aa3

SHA512
68fa3180e3414d01458631659a1df11aa7e28a1fb8b24cd5f740ddf87b2bfd30ceb8f1d2f9759ec058b5aaaed30468c972869a95c79bd57a3ec54b23a5d5c1c3

Download Submit
C:\Windows\Temp\{FE9DD78F-DA2E-4871-A622-A10AFD2E416E}\.ba\BootstrapperApplicationData.xml

Filesize
7KB

MD5
56b0b19d6865e7fbf71ea4d0190d1c02

SHA1
7214e00472a14dfd2c0623a8dc7364d6990e0a16

SHA256
5083cd62f91dc78f5b08afe2a68dd217e5f76d9a5114ff0a02a588b135e80cd1

SHA512
23471b8c0556a88cdc51f5aad6c5fe8055d6a90f7c076775f7a948b6c4a66242d5868f554f6122c89cc2ea4796678d80e27ddbbf59b05c661100bcce36222026

Download Submit
C:\Windows\Temp\{FE9DD78F-DA2E-4871-A622-A10AFD2E416E}\.ba\thm.wxl

Filesize
5KB

MD5
d5070cb3387a0a22b7046ae5ab53f371

SHA1
bc9da146a42bbf9496de059ac576869004702a97

SHA256
81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a

SHA512
8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3

Download Submit
C:\Windows\Temp\{FE9DD78F-DA2E-4871-A622-A10AFD2E416E}\.ba\thm.xml

Filesize
11KB

MD5
302563a713b142ee41b59e3eeac53a90

SHA1
1340e90cc3c6c5fc19a7feb61d7779f4a4f0fdb5

SHA256
83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63

SHA512
c9d4dfc20802bb542178300d1044bb94b35593b834ab0b50875a32953f890e48da456199128500e2c1fee26eaaf8c2c4fcaffb308b37914215f900cdd5c4cbc8

Download Submit
C:\Windows\Temp\{FE9DD78F-DA2E-4871-A622-A10AFD2E416E}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
memory/2752-200-0x00000000079E0000-0x00000000079EE000-memory.dmp

Filesize
56KB

Download
memory/2752-199-0x0000000007A30000-0x0000000007AC6000-memory.dmp

Filesize
600KB

Download
memory/2752-202-0x0000000007AD0000-0x0000000007AD8000-memory.dmp

Filesize
32KB

Download
memory/2752-201-0x0000000007AF0000-0x0000000007B0A000-memory.dmp

Filesize
104KB

Download
memory/2752-162-0x00000000064B0000-0x00000000064CE000-memory.dmp

Filesize
120KB

Download
memory/2752-143-0x0000000004F50000-0x0000000004F86000-memory.dmp

Filesize
216KB

Download
memory/2752-161-0x0000000002B40000-0x0000000002B50000-memory.dmp

Filesize
64KB

Download
memory/2752-181-0x0000000002B40000-0x0000000002B50000-memory.dmp

Filesize
64KB

Download
memory/2752-144-0x00000000055C0000-0x0000000005BE8000-memory.dmp

Filesize
6.2MB

Download
memory/2752-157-0x0000000002B40000-0x0000000002B50000-memory.dmp

Filesize
64KB

Download
memory/2752-183-0x0000000007460000-0x0000000007492000-memory.dmp

Filesize
200KB

Download
memory/2752-184-0x000000006B5B0000-0x000000006B5FC000-memory.dmp

Filesize
304KB

Download
memory/2752-194-0x0000000006A80000-0x0000000006A9E000-memory.dmp

Filesize
120KB

Download
memory/2752-195-0x0000000007DF0000-0x000000000846A000-memory.dmp

Filesize
6.5MB

Download
memory/2752-152-0x0000000005E60000-0x0000000005EC6000-memory.dmp

Filesize
408KB

Download
memory/2752-196-0x00000000077B0000-0x00000000077CA000-memory.dmp

Filesize
104KB

Download
memory/2752-197-0x000000007F340000-0x000000007F350000-memory.dmp

Filesize
64KB

Download
memory/2752-151-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Filesize
408KB

Download
memory/2752-198-0x0000000007820000-0x000000000782A000-memory.dmp

Filesize
40KB

Download
memory/2752-145-0x0000000005C20000-0x0000000005C42000-memory.dmp

Filesize
136KB

Download
memory/3336-209-0x00000000079D0000-0x00000000079E2000-memory.dmp

Filesize
72KB

Download
memory/3336-182-0x0000000005520000-0x0000000005530000-memory.dmp

Filesize
64KB

Download
memory/3336-180-0x00000000053E0000-0x00000000053EA000-memory.dmp

Filesize
40KB

Download
memory/3336-178-0x0000000005AE0000-0x0000000006084000-memory.dmp

Filesize
5.6MB

Download
memory/3336-179-0x0000000005420000-0x00000000054B2000-memory.dmp

Filesize
584KB

Download
memory/3336-177-0x0000000000AB0000-0x0000000000B58000-memory.dmp

Filesize
672KB

Download
memory/3336-206-0x0000000007BF0000-0x0000000007BFA000-memory.dmp

Filesize
40KB

Download
memory/5096-142-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/5096-203-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/5096-133-0x0000000000730000-0x0000000000B5A000-memory.dmp

Filesize
4.2MB

Download
memory/5096-139-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/5096-207-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/5096-138-0x000000000C900000-0x000000000C90E000-memory.dmp

Filesize
56KB

Download
memory/5096-137-0x000000000CBD0000-0x000000000CC08000-memory.dmp

Filesize
224KB

Download
memory/5096-136-0x0000000008910000-0x00000000089CA000-memory.dmp

Filesize
744KB

Download
memory/5096-135-0x0000000005440000-0x0000000005441000-memory.dmp

Filesize
4KB

Download
memory/5096-134-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download