4d6264b174f113fe920e4ab21c29de760b15b4be85be64411496a21e4bd8a5b5

Analysis

max time kernel
279s
max time network
282s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
08-06-2023 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08-06-2023_JfQRvhu7DHVU7Bq.zip
Size

161KB
MD5

ff762cdcc2a52346b3e7a75456d631fb
SHA1

ea6be42ec2b18015210ef9f840ef8819dbbd56fd
SHA256

4d6264b174f113fe920e4ab21c29de760b15b4be85be64411496a21e4bd8a5b5
SHA512

357032d9b0c56711177e2c641da0d0867d93ba3448b04108d9a3796838248a381ee24d46c6c42fe58daea0ecb74580c7c7ee28ad66fefdf4d0ad327107ea1407
SSDEEP

3072:Q4YKu/XGQnjo+nQ7wHYB3tLZc0Pk61XOLJcc4cvYSnfngWoH5I+Si0d3Q:5uPGQjo7l3tJJ+LWXcJfgWOIz7y

Score

8^/10

microsoft discovery persistence phishing

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SoT_Helper.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Control Panel\International\Geo\Nation	SoT_Helper.exe

Executes dropped EXE 5 IoCs

Processes:

SoT_Helper.exewindowsdesktop-runtime-6.0.16-win-x64.exewindowsdesktop-runtime-6.0.16-win-x64.exewindowsdesktop-runtime-6.0.16-win-x64.exeSoT_Helper.exe

pid	process
2644	SoT_Helper.exe
1556	windowsdesktop-runtime-6.0.16-win-x64.exe
4840	windowsdesktop-runtime-6.0.16-win-x64.exe
4160	windowsdesktop-runtime-6.0.16-win-x64.exe
2868	SoT_Helper.exe

Loads dropped DLL 10 IoCs

Processes:

windowsdesktop-runtime-6.0.16-win-x64.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeSoT_Helper.exe

pid	process
4840	windowsdesktop-runtime-6.0.16-win-x64.exe
4616	MsiExec.exe
4616	MsiExec.exe
1716	MsiExec.exe
1716	MsiExec.exe
3440	MsiExec.exe
3440	MsiExec.exe
4408	MsiExec.exe
4408	MsiExec.exe
2868	SoT_Helper.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

windowsdesktop-runtime-6.0.16-win-x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	windowsdesktop-runtime-6.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{8d173101-98c1-4e92-97c6-47c6840745a7} = "\"C:\\ProgramData\\Package Cache\\{8d173101-98c1-4e92-97c6-47c6840745a7}\\windowsdesktop-runtime-6.0.16-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.16-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\pl\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\System.Diagnostics.EventLog.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\api-ms-win-crt-private-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\tr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\it\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\ko\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Threading.Tasks.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\api-ms-win-crt-utility-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Runtime.CompilerServices.VisualC.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Transactions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Runtime.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\UIAutomationProvider.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\ko\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\ja\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Diagnostics.FileVersionInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\ko\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\api-ms-win-core-memory-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Configuration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\ja\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Xml.XPath.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\UIAutomationClient.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\it\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\DirectWriteForwarder.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\zh-Hans\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Drawing.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\fr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\api-ms-win-core-util-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\Microsoft.CSharp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\fr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\es\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\it\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\pt-BR\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Security.SecureString.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\it\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\LICENSE.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\es\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\ja\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\tr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\pt-BR\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Reflection.Emit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\api-ms-win-core-handle-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\de\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.16\System.Reflection.Metadata.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\ru\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\pl\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\pt-BR\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.16\PresentationFramework-SystemData.dll	msiexec.exe

Drops file in Windows directory 34 IoCs

Processes:

msiexec.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\Installer\e58ad8c.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C71E93D2-B8B4-4858-B2A1-4C967DBC1C5F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE4C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ad85.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF195.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC976.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ad88.msi	msiexec.exe
File created	C:\Windows\Installer\e58ad90.msi	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\Installer\e58ad89.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI19B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ad8d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{805626FF-2BC9-4567-A71E-A76A470D000A}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF71.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1D0AC7F1-2B34-44AF-91F6-88757D768DA7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC58.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF959.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ad8d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2861.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\e58ad81.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC203.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B8537ACA-B210-4DF5-B928-E41CEB76723D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1043.tmp	msiexec.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\Installer\e58ad81.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ad89.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI90E.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e58ad84.msi	msiexec.exe
File created	C:\Windows\Installer\e58ad85.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF3F9.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exemsiexec.exeMicrosoftEdgeCP.exeMicrosoftEdge.exewindowsdesktop-runtime-6.0.16-win-x64.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ACA7358B012B5FD49B824EC1BE6727D3\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\625B322328E5A9E441D3BF234C1BF330	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF6265089CB276547AE17AA674D000A0\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Packa = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1F7CA0D143B2FA44196F8857D767D87A\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{1D0AC7F1-2B34-44AF-91F6-88757D768DA7}v48.67.58427\\"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ec6de799369ad901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{8d173101-98c1-4e92-97c6-47c6840745a7}\Dependents\{8d173101-98c1-4e92-97c6-47c6840745a7}	windowsdesktop-runtime-6.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1F7CA0D143B2FA44196F8857D767D87A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.67.58484_x64\ = "{805626FF-2BC9-4567-A71E-A76A470D000A}"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\dotnet.microsoft.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 5078dca9369ad901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{F76AFC58-C4E4-482B-AFA6-C58169FCDB2 = "\\\\?\\Volume{B2C2C2D8-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\windowsdesktop-runtime-6.0.16-win-x64.exe"	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdoma = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ACA7358B012B5FD49B824EC1BE6727D3\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF6265089CB276547AE17AA674D000A0\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 0100000000187c7cc25612c9fe67448855d3ffc5c0b8481c7584ac265fadb5ece78e2c84b3d6b0f55d3a3addb15b958b7814b3c73f96b293db0c706bd1b4bec33c987f24a75ae96f75cf7f04cb3d585f638ea24a79c8ec7ff6956ff35fb9073b3baa24b01ac3b18cfeb4b5a4d32cb8f80de161fb9c6fed38efbfe2a5f6da40cde165682e2031a6d6638ba4349a489d54f5ace2c0e4ab5e72172b3f2a173908412e6ab30fe9c322b845f37f5fd9b166b7eb9104f61f9d90957a77d0d335f5feedf557e562879b3bbe9e8b5c369d8713c5a32fe42f3563fa702144c89aa32d99c728ce61ad49d8182d19f5b973f0eaef0ae826c991fd1ef8308f32f12616036644816d1545409a81e603d0d1ccbafa005ee116c7b774efb8ae8de164ecb1952b089ed5df3f2601db9bc2bb3754a5d7dd0b1e9f8f2821f4770eacf186524705256932a799f0ef2cc7536e5820efb9a1e67e04618160f74e32a75303d6f2dc719dbdca81ecf9be3d543fb44546d49f784cb836fc2d65b91d94434ab5a0dd44fb3e7e530555e51353f6dcd624d21eb97c8f9b48101fec2682b6ac59a800fbcbf9b37beea07d3118c0924878f0	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.67.58427_x64\Dependents\{8d173101-98c1-4e92-97c6-47c6840745a7}	windowsdesktop-runtime-6.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{8d173101-98c1-4e92-97c6-47c6840745a7}\Version = "6.0.16.32327"	windowsdesktop-runtime-6.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.67.58427_x64\DisplayName = "Microsoft .NET Runtime - 6.0.16 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ACA7358B012B5FD49B824EC1BE6727D3\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.67.58427_x64	windowsdesktop-runtime-6.0.16-win-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ACA7358B012B5FD49B824EC1BE6727D3\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{B8537ACA-B210-4DF5-B928-E41CEB76723D}v48.67.58427\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 53ea2d94369ad901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{6AC4A4F8-C0FD-4A44-9A34-03872C69D346}"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.67.58427_x64\ = "{C71E93D2-B8B4-4858-B2A1-4C967DBC1C5F}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dotnet.microsoft.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "393062279"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF6265089CB276547AE17AA674D000A0\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.67.58484_x64\Dependents	windowsdesktop-runtime-6.0.16-win-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6F98984198254DE7F564FBBD8C2E1EE1	msiexec.exe

NTFS ADS 1 IoCs

Processes:

browser_broker.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.16-win-x64.exe.5zyh00x.partial:Zone.Identifier	browser_broker.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msiexec.exe

pid process

4864 msiexec.exe
4864 msiexec.exe
4864 msiexec.exe
4864 msiexec.exe
4864 msiexec.exe
4864 msiexec.exe
4864 msiexec.exe
4864 msiexec.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

3400 MicrosoftEdgeCP.exe
3400 MicrosoftEdgeCP.exe

pid	process
4864	msiexec.exe
4864	msiexec.exe
4864	msiexec.exe
4864	msiexec.exe
4864	msiexec.exe
4864	msiexec.exe
4864	msiexec.exe
4864	msiexec.exe

pid	process
3400	MicrosoftEdgeCP.exe
3400	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zG.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exewindowsdesktop-runtime-6.0.16-win-x64.exemsiexec.exe

description	pid	process
Token: SeRestorePrivilege	460	7zG.exe
Token: 35	460	7zG.exe
Token: SeSecurityPrivilege	460	7zG.exe
Token: SeSecurityPrivilege	460	7zG.exe
Token: SeDebugPrivilege	2632	MicrosoftEdge.exe
Token: SeDebugPrivilege	2632	MicrosoftEdge.exe
Token: SeDebugPrivilege	2632	MicrosoftEdge.exe
Token: SeDebugPrivilege	2632	MicrosoftEdge.exe
Token: SeDebugPrivilege	4916	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4916	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4916	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4916	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1584	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1584	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2632	MicrosoftEdge.exe
Token: SeShutdownPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeSecurityPrivilege	4864	msiexec.exe
Token: SeCreateTokenPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeLockMemoryPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeMachineAccountPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeTcbPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeSecurityPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeTakeOwnershipPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeLoadDriverPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeSystemProfilePrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeSystemtimePrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeProfSingleProcessPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeIncBasePriorityPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeCreatePagefilePrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeCreatePermanentPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeBackupPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeRestorePrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeShutdownPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeDebugPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeAuditPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeSystemEnvironmentPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeChangeNotifyPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeRemoteShutdownPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeUndockPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeSyncAgentPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeEnableDelegationPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeManageVolumePrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeImpersonatePrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeCreateGlobalPrivilege	4160	windowsdesktop-runtime-6.0.16-win-x64.exe
Token: SeRestorePrivilege	4864	msiexec.exe
Token: SeTakeOwnershipPrivilege	4864	msiexec.exe
Token: SeRestorePrivilege	4864	msiexec.exe
Token: SeTakeOwnershipPrivilege	4864	msiexec.exe
Token: SeRestorePrivilege	4864	msiexec.exe
Token: SeTakeOwnershipPrivilege	4864	msiexec.exe
Token: SeRestorePrivilege	4864	msiexec.exe
Token: SeTakeOwnershipPrivilege	4864	msiexec.exe
Token: SeRestorePrivilege	4864	msiexec.exe
Token: SeTakeOwnershipPrivilege	4864	msiexec.exe
Token: SeRestorePrivilege	4864	msiexec.exe
Token: SeTakeOwnershipPrivilege	4864	msiexec.exe
Token: SeRestorePrivilege	4864	msiexec.exe
Token: SeTakeOwnershipPrivilege	4864	msiexec.exe
Token: SeRestorePrivilege	4864	msiexec.exe
Token: SeTakeOwnershipPrivilege	4864	msiexec.exe
Token: SeRestorePrivilege	4864	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zG.exewindowsdesktop-runtime-6.0.16-win-x64.exe

pid process

460 7zG.exe
4840 windowsdesktop-runtime-6.0.16-win-x64.exe

pid	process
460	7zG.exe
4840	windowsdesktop-runtime-6.0.16-win-x64.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeOpenWith.exe

pid	process
2632	MicrosoftEdge.exe
3400	MicrosoftEdgeCP.exe
3400	MicrosoftEdgeCP.exe
2448	OpenWith.exe
2448	OpenWith.exe
2448	OpenWith.exe
2448	OpenWith.exe
2448	OpenWith.exe
2448	OpenWith.exe
2448	OpenWith.exe
2448	OpenWith.exe
2448	OpenWith.exe
2448	OpenWith.exe
2448	OpenWith.exe
2448	OpenWith.exe
2448	OpenWith.exe
2448	OpenWith.exe
2448	OpenWith.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

MicrosoftEdgeCP.exebrowser_broker.exewindowsdesktop-runtime-6.0.16-win-x64.exewindowsdesktop-runtime-6.0.16-win-x64.exemsiexec.exeOpenWith.exe

description	pid	process	target process
PID 3400 wrote to memory of 4916	3400	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3400 wrote to memory of 4916	3400	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3400 wrote to memory of 4916	3400	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3400 wrote to memory of 4916	3400	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3400 wrote to memory of 4916	3400	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3400 wrote to memory of 4916	3400	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3400 wrote to memory of 4916	3400	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3400 wrote to memory of 4916	3400	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3400 wrote to memory of 4916	3400	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3400 wrote to memory of 4916	3400	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2892 wrote to memory of 1556	2892	browser_broker.exe	windowsdesktop-runtime-6.0.16-win-x64.exe
PID 2892 wrote to memory of 1556	2892	browser_broker.exe	windowsdesktop-runtime-6.0.16-win-x64.exe
PID 2892 wrote to memory of 1556	2892	browser_broker.exe	windowsdesktop-runtime-6.0.16-win-x64.exe
PID 1556 wrote to memory of 4840	1556	windowsdesktop-runtime-6.0.16-win-x64.exe	windowsdesktop-runtime-6.0.16-win-x64.exe
PID 1556 wrote to memory of 4840	1556	windowsdesktop-runtime-6.0.16-win-x64.exe	windowsdesktop-runtime-6.0.16-win-x64.exe
PID 1556 wrote to memory of 4840	1556	windowsdesktop-runtime-6.0.16-win-x64.exe	windowsdesktop-runtime-6.0.16-win-x64.exe
PID 4840 wrote to memory of 4160	4840	windowsdesktop-runtime-6.0.16-win-x64.exe	windowsdesktop-runtime-6.0.16-win-x64.exe
PID 4840 wrote to memory of 4160	4840	windowsdesktop-runtime-6.0.16-win-x64.exe	windowsdesktop-runtime-6.0.16-win-x64.exe
PID 4840 wrote to memory of 4160	4840	windowsdesktop-runtime-6.0.16-win-x64.exe	windowsdesktop-runtime-6.0.16-win-x64.exe
PID 4864 wrote to memory of 4616	4864	msiexec.exe	MsiExec.exe
PID 4864 wrote to memory of 4616	4864	msiexec.exe	MsiExec.exe
PID 4864 wrote to memory of 4616	4864	msiexec.exe	MsiExec.exe
PID 4864 wrote to memory of 1716	4864	msiexec.exe	MsiExec.exe
PID 4864 wrote to memory of 1716	4864	msiexec.exe	MsiExec.exe
PID 4864 wrote to memory of 1716	4864	msiexec.exe	MsiExec.exe
PID 4864 wrote to memory of 3440	4864	msiexec.exe	MsiExec.exe
PID 4864 wrote to memory of 3440	4864	msiexec.exe	MsiExec.exe
PID 4864 wrote to memory of 3440	4864	msiexec.exe	MsiExec.exe
PID 4864 wrote to memory of 4408	4864	msiexec.exe	MsiExec.exe
PID 4864 wrote to memory of 4408	4864	msiexec.exe	MsiExec.exe
PID 4864 wrote to memory of 4408	4864	msiexec.exe	MsiExec.exe
PID 2448 wrote to memory of 3708	2448	OpenWith.exe	NOTEPAD.EXE
PID 2448 wrote to memory of 3708	2448	OpenWith.exe	NOTEPAD.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\08-06-2023_JfQRvhu7DHVU7Bq.zip
1⤵
PID:2012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2680

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\" -an -ai#7zMap27175:132:7zEvent16612
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:460

C:\Users\Admin\AppData\Local\Temp\SoT_Helper 1.6\SoT_Helper\SoT_Helper.exe
"C:\Users\Admin\AppData\Local\Temp\SoT_Helper 1.6\SoT_Helper\SoT_Helper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2644

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2632

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2892

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.16-win-x64.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.16-win-x64.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\Temp\{45F13BB9-F8C3-4885-94B1-E5B9F23B0B50}\.cr\windowsdesktop-runtime-6.0.16-win-x64.exe
"C:\Windows\Temp\{45F13BB9-F8C3-4885-94B1-E5B9F23B0B50}\.cr\windowsdesktop-runtime-6.0.16-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.16-win-x64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=532
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4840

C:\Windows\Temp\{6FD4EE15-02EC-4D44-ABB5-14F3D5A1E707}\.be\windowsdesktop-runtime-6.0.16-win-x64.exe
"C:\Windows\Temp\{6FD4EE15-02EC-4D44-ABB5-14F3D5A1E707}\.be\windowsdesktop-runtime-6.0.16-win-x64.exe" -q -burn.elevated BurnPipe.{62219AA8-155A-489A-8BEF-DBDD7F82D5AF} {0749B22B-1CBA-4ED9-8E72-A8CA17FB472F} 4840
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1580

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1328

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding E21BABB89509BDEBD9A69BD221CA4E07
2⤵
- Loads dropped DLL
PID:4616

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 1CC998B8BA31D2C94A291AB29D40AF01
2⤵
- Loads dropped DLL
PID:1716

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A17EAC7D1878F87FB0D896C09AEFE6BD
2⤵
- Loads dropped DLL
PID:3440

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding CB6E71B09DBFC621176B728598C4A088
2⤵
- Loads dropped DLL
PID:4408

C:\Users\Admin\AppData\Local\Temp\SoT_Helper 1.6\SoT_Helper\SoT_Helper.exe
"C:\Users\Admin\AppData\Local\Temp\SoT_Helper 1.6\SoT_Helper\SoT_Helper.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\SoT_Helper 1.6\SoT_Helper\actors.json
2⤵
PID:3708

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58ad83.rbs
Filesize
55KB

MD5
96e62d5329cacfc53178869c6a1cc904

SHA1
fe14bea399ea8caa9ab7b85416f84376a57c455e

SHA256
971ce1a6e78873a1ee12f4e74c614ba9542c1b82753799bacd35e1704dcc81d9

SHA512
0b5786ff708ea18a8c80e8364fcb1aadaa8e6c885f572cf3438f8b404c7d7a00a87dc6292ca93828e511ad4f78338ee95722b9618b97b0a23087ee81388849af

Download Submit
C:\Config.Msi\e58ad87.rbs
Filesize
8KB

MD5
a2218584e4ed3ca0bfa69e62ef45e2a9

SHA1
058e7cc9b9ca1987196e3f2843d5c97c610b2444

SHA256
b3a553088756aad9ee220e856324ab50457cdd4707e59c6b6728b7a476e15ed5

SHA512
68cbc9bab0dd1c3d5263dbacaf7a19e95870b11189ae49bb428308aef2dad7534f1b3037119b463034776d888bccec73593785d6e3d5b0523a58fdd3bc369315

Download Submit
C:\Config.Msi\e58ad8b.rbs
Filesize
9KB

MD5
df4c0ef2562d92a699f7a3403e1315ef

SHA1
00c478b7ded95cecde21a8944f8753766c64e075

SHA256
12f7e5399b0592dbe8571a0ec158544346bd2840a375a72f71d44682dcf8a09f

SHA512
8efa8f78ca79f42935c34a796b12199d32321aea6a529c24de5fdc10b9266df3a7aeda94b76d31cd0224b01b36db55ffa97e350fd6911b3e930e2bb3921af38c

Download Submit
C:\Config.Msi\e58ad8f.rbs
Filesize
86KB

MD5
b736cc933ae4b3c3677c882d9cdb5214

SHA1
5946f695056ec53d0b400dd94fb47853f550b093

SHA256
218bce9db5f76901479656e9b2f7270ead1c9c8d22c2e00a77e87419c72c1823

SHA512
9881ac8c95ca52e66c60b2e9f004a3d1f77b9b88cee81d30567302474a0bb7c1185ec76d9c12e7c88ec51a6a9b56826cd13dbce5442aa0636ef66607478e09c7

Download Submit
C:\Program Files\dotnet\LICENSE.txt
Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt
Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\Program Files\dotnet\host\fxr\6.0.16\hostfxr.dll
Filesize
366KB

MD5
9d9e3a7a63d7d26df86b3874ae7d52c1

SHA1
efca7ccebffcb5bf07beb6f7862bb65a36bb09f7

SHA256
0d4d5ae03c87092bb55af28b0808feaea884a1873760fba127c6894f92c59388

SHA512
dc8db106d0c07a2aceaae130341c9a6ccc38cde72faea3ad700082e13a498c049024db457c0ccbf36675cf7cdd22923bc4f27867c3044e0486ef27debb17a962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize
4KB

MD5
f7dcb24540769805e5bb30d193944dce

SHA1
e26c583c562293356794937d9e2e6155d15449ee

SHA256
6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

SHA512
cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IV9H23MJ\edgecompatviewlist[1].xml
Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\WADKGOKQ\dotnet.microsoft[1].xml
Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\RA55XPW2\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\WJ5PNM5W\favicon[1].ico
Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk
Filesize
8KB

MD5
a4bf4064cb5d12585a78cf929381dcee

SHA1
0f4a0e6ef76adb5f6c07eca3b71eed2267399905

SHA256
1cc0a348d7f940a966242f07c680b2ee9020bce129daa39a69628566bf027fe3

SHA512
d6b1c785e83f15b45882c74555d0a95491909d59b4bca412cb241d34a802ed3947e5f670a488cd99f901b729a4a84d2f8333fe2cde9e90898b333aa291a93577

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\rwudikf\imagestore.dat
Filesize
17KB

MD5
76f6476798c98f0911f46f4cf1dd5ae2

SHA1
de43916d24435aaf0ddf6755069a81f3867fe425

SHA256
3c2618efeaf225295088f2d04e17185cd500e791d1d1c0581ad3553ed08ae5bc

SHA512
c6fb1405e851b91af78fa44e87522dfa275ccbd16bcb864b6fc7f8960cde044e1904e9816367cd473b77e7f091eac3fe70a8f9d3c658764ca98e92d14a04481b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2219095117.pri
Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.16-win-x64.exe
Filesize
54.8MB

MD5
32acae733a473abb73467865fbd55ed0

SHA1
b5158efdf04bc521d4d4f061882bccb8ae6bbbea

SHA256
1c1e90c6732a6389c9ebddd73bdca565d2f35671c2e7113e1704cb0a183e744a

SHA512
2bc06b086a7189ad3e2cd0e57158b720c617878a0bd6cf97b510ce37e0b2eeb24463d4b74b0f17ced8b3b606ebbaf860a124517243639072def90a3f0034e35f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.16-win-x64.exe
Filesize
54.8MB

MD5
32acae733a473abb73467865fbd55ed0

SHA1
b5158efdf04bc521d4d4f061882bccb8ae6bbbea

SHA256
1c1e90c6732a6389c9ebddd73bdca565d2f35671c2e7113e1704cb0a183e744a

SHA512
2bc06b086a7189ad3e2cd0e57158b720c617878a0bd6cf97b510ce37e0b2eeb24463d4b74b0f17ced8b3b606ebbaf860a124517243639072def90a3f0034e35f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.16-win-x64.exe
Filesize
54.8MB

MD5
32acae733a473abb73467865fbd55ed0

SHA1
b5158efdf04bc521d4d4f061882bccb8ae6bbbea

SHA256
1c1e90c6732a6389c9ebddd73bdca565d2f35671c2e7113e1704cb0a183e744a

SHA512
2bc06b086a7189ad3e2cd0e57158b720c617878a0bd6cf97b510ce37e0b2eeb24463d4b74b0f17ced8b3b606ebbaf860a124517243639072def90a3f0034e35f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.16-win-x64.exe.5zyh00x.partial
Filesize
54.8MB

MD5
32acae733a473abb73467865fbd55ed0

SHA1
b5158efdf04bc521d4d4f061882bccb8ae6bbbea

SHA256
1c1e90c6732a6389c9ebddd73bdca565d2f35671c2e7113e1704cb0a183e744a

SHA512
2bc06b086a7189ad3e2cd0e57158b720c617878a0bd6cf97b510ce37e0b2eeb24463d4b74b0f17ced8b3b606ebbaf860a124517243639072def90a3f0034e35f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\26X86R4B\windowsdesktop-runtime-6.0.16-win-x64[1].exe
Filesize
32KB

MD5
b564371626d5cd002a926e49f7f20003

SHA1
cafea26ee7392111bc8492cd20b3fd48f3dd5488

SHA256
c6311fb0b296661a897185260a9f66feb644ccd3753e92323ef1e89c318c44c2

SHA512
e2f3c1cc32d7cbe832be76ce03447d34cefdf07c7f61aed93d94662c30ed8a490c958b78f1ee40267061de9f6714645fbc6c76481dede3e69c308e63a1c73282

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.16_(x64)_20230608182630_000_dotnet_runtime_6.0.16_win_x64.msi.log
Filesize
2KB

MD5
9a021c35d61a8dd427d387d8f4663cb8

SHA1
36ea9e82fe7c56cc4887058467187bbb5dbe45e7

SHA256
af5fde2d3e7f13fbfa0653e5692a0c27fe1cf3974bf74651e735925f19bf7ceb

SHA512
ff13edfb48accbf7ff0e6fbe66db794a7bd2cb1a195b33953e7bb558375440dad27fb185d7ffd874b594fa5f664c1c247a939f3d07f33125ac94e40705ecc5c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.16_(x64)_20230608182630_001_dotnet_hostfxr_6.0.16_win_x64.msi.log
Filesize
2KB

MD5
968b21e87b671a709c23d0fea355c5c0

SHA1
35ee7a96174ab8d28cd3671fa619f2c8ab29193a

SHA256
b480d7bd583d692f4626659e87fdf8b9b4da9def04102d621f01dd68ffdb8763

SHA512
83ce973c3a9f2a0392e186b8365d7ddcbcd19987f8ad4f86efb752e6f9e7479f8de99f7098253c24cb74740b7c34c093141e84b0ba7e0fa7c75f0d9069433ab8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.16_(x64)_20230608182630_002_dotnet_host_6.0.16_win_x64.msi.log
Filesize
2KB

MD5
744a0a979caae80d792e6b46f303e75c

SHA1
d467214573d6ade2737853e49937bdf697664289

SHA256
cb6c6029305a622dc972f83012b727ef6a7096fbc343dc6e166cd29efe08ad21

SHA512
63a5c9db94e0cd1c37b72eb3ffef3fc360b34428bde0336acf94712ebdd65f4fd56fe9f4f4c941b8b7fd8a22399072d79390710df11048afe3eaf57124c3c874

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.16_(x64)_20230608182630_003_windowsdesktop_runtime_6.0.16_win_x64.msi.log
Filesize
2KB

MD5
2dae7c5b73488619e08888d50a3f3262

SHA1
67fb3f44e6b5607595a845eccf4a4feaf6f9eecc

SHA256
f6fc14921c19c0c1babd217d0253d9d74d9349c7ace2067dc18cfed2d381364d

SHA512
f401a286e5414b2a3d8752754ccd8aef429fb4888c7917cd8e0dc013008a121b747769b5c427bdedb676402ac9a0c44fb0a05004b2e354022460f89b24863417

Download Submit
C:\Users\Admin\AppData\Local\Temp\SoT_Helper 1.6\SoT_Helper\SoT_Helper.deps.json
Filesize
1KB

MD5
1f3845aa87168bd3b3bfb6fbb4e1ee65

SHA1
acbb9eeca7b3c8505a3e8b4b55313127f7e3550a

SHA256
5a8236225c2b6e772270a34cef82ab4ff750f44d3b1b06790a2bc53439ab16b3

SHA512
28d75e9861566cc20fd33bc48532d16e4d5c994ed507f1f8dffb1aeba6ba6b7c46c9f7a1ba19089b9e2e7998c84354a7b3ba5359938a463a937f26097bf90cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\SoT_Helper 1.6\SoT_Helper\SoT_Helper.exe
Filesize
144KB

MD5
99ab38f668174477da4ad0bf216b4eb8

SHA1
7f7a4051b6b68360c5ca091369d0650cae38afa5

SHA256
1e7304b9dc0d3e430e4d54c3fb8270aeea28db6b574af1b77e5c792f15281ea9

SHA512
6d61c19c4ec0d54d7f33aecb5a617f15dd7f2405605ffa6816564e04d8c08814f17a0da398ae6b3d00801b9affd05916606167d9dc066157e1c4064cf226a7db

Download Submit
C:\Users\Admin\AppData\Local\Temp\SoT_Helper 1.6\SoT_Helper\SoT_Helper.exe
Filesize
144KB

MD5
99ab38f668174477da4ad0bf216b4eb8

SHA1
7f7a4051b6b68360c5ca091369d0650cae38afa5

SHA256
1e7304b9dc0d3e430e4d54c3fb8270aeea28db6b574af1b77e5c792f15281ea9

SHA512
6d61c19c4ec0d54d7f33aecb5a617f15dd7f2405605ffa6816564e04d8c08814f17a0da398ae6b3d00801b9affd05916606167d9dc066157e1c4064cf226a7db

Download Submit
C:\Users\Admin\AppData\Local\Temp\SoT_Helper 1.6\SoT_Helper\SoT_Helper.exe
Filesize
144KB

MD5
99ab38f668174477da4ad0bf216b4eb8

SHA1
7f7a4051b6b68360c5ca091369d0650cae38afa5

SHA256
1e7304b9dc0d3e430e4d54c3fb8270aeea28db6b574af1b77e5c792f15281ea9

SHA512
6d61c19c4ec0d54d7f33aecb5a617f15dd7f2405605ffa6816564e04d8c08814f17a0da398ae6b3d00801b9affd05916606167d9dc066157e1c4064cf226a7db

Download Submit
C:\Users\Admin\AppData\Local\Temp\SoT_Helper 1.6\SoT_Helper\actors.json
Filesize
20KB

MD5
b6002d4b8fc3509ea5d5c87d035b7809

SHA1
92af8045e317544be660ad3dcdc0364bd7270127

SHA256
6a671aea543b6dc09c2829957ba3356124a89dbf72a81e77d346c07e0663c146

SHA512
a468cbd9838ca107f915fd00dad18eb4daea6805ec6d90210c43c4a1eb45512cb2735d507b35a826bc6ca6d18c70eb937e3c7962927cc51e43feef2309388f64

Download Submit
C:\Windows\Installer\MSI19B.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI2861.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI90E.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIC203.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIE4C2.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIEF71.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIEF71.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIF3F9.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIF959.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\e58ad84.msi
Filesize
25.8MB

MD5
b6f9471c1ab4fd07c986a91bc65a0329

SHA1
cfc949bcfbc8662bc6468032efd14ec1b9e8e29d

SHA256
49ce2934548dcee0a3f149d0db727930b0a66dd9bc02279d73db201bf6405b3d

SHA512
1e94a5e3c1f4c80549880903a5b8399e9dd342c34b47c0d7bb3a5f08702d04be167c8b6d9101f28a04fbccdc3431a602c9417767897d1331de52092f9de890cd

Download Submit
C:\Windows\Installer\e58ad85.msi
Filesize
804KB

MD5
1bcae1f2ef5e32b7c81a1e986f1b478d

SHA1
6879e1ab80f94025ba76b6667d4515c387b238e7

SHA256
ad2092b5c89cf336388cfab9b8e7f8d9585e6bdf0545f6cbf124256eaadce1ce

SHA512
d4e0b09d6474613b521edcec7d479f4f34d2479e893a3311a07610c340e3ecf5251e512d101f4188387eec0d21d090e84f94f65278d6173a02dd0ae588513c60

Download Submit
C:\Windows\Installer\e58ad90.msi
Filesize
28.6MB

MD5
14a6cdb9879cb02b7a95900c3882fc39

SHA1
34c80595cb897f470b7e85071495285ad9c26e58

SHA256
d80c99407063c50e10d4ce944710c839c373320652a7cb5a24a93510a307225f

SHA512
afc0bb2317e42d8e545c1daf3a382cad82f653455da55b5b987c544229c0fbc29796614988d224bf03b066a2a87f59d545cb76a873bd7223c3836420cf77bee0

Download Submit
C:\Windows\Temp\{45F13BB9-F8C3-4885-94B1-E5B9F23B0B50}\.cr\windowsdesktop-runtime-6.0.16-win-x64.exe
Filesize
610KB

MD5
1a35556a9539eb7b2c36bfee284e85fe

SHA1
436fb73ba2627da041dd31b03b1c5a1de79973f2

SHA256
b2e1b2dbecc4e3a9179ef0e8c43e20d60e53fd676528391acba8a779bddbf957

SHA512
86b677d90f3d4878d525fbefada2d353b1687f8df72682895ca34e1905aad606f749ad9556280690720a5c2faab6b2c27949e4a58ad8a8f5b5802942a56bc9ee

Download Submit
C:\Windows\Temp\{45F13BB9-F8C3-4885-94B1-E5B9F23B0B50}\.cr\windowsdesktop-runtime-6.0.16-win-x64.exe
Filesize
610KB

MD5
1a35556a9539eb7b2c36bfee284e85fe

SHA1
436fb73ba2627da041dd31b03b1c5a1de79973f2

SHA256
b2e1b2dbecc4e3a9179ef0e8c43e20d60e53fd676528391acba8a779bddbf957

SHA512
86b677d90f3d4878d525fbefada2d353b1687f8df72682895ca34e1905aad606f749ad9556280690720a5c2faab6b2c27949e4a58ad8a8f5b5802942a56bc9ee

Download Submit
C:\Windows\Temp\{6FD4EE15-02EC-4D44-ABB5-14F3D5A1E707}\.ba\bg.png
Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{6FD4EE15-02EC-4D44-ABB5-14F3D5A1E707}\.be\windowsdesktop-runtime-6.0.16-win-x64.exe
Filesize
610KB

MD5
1a35556a9539eb7b2c36bfee284e85fe

SHA1
436fb73ba2627da041dd31b03b1c5a1de79973f2

SHA256
b2e1b2dbecc4e3a9179ef0e8c43e20d60e53fd676528391acba8a779bddbf957

SHA512
86b677d90f3d4878d525fbefada2d353b1687f8df72682895ca34e1905aad606f749ad9556280690720a5c2faab6b2c27949e4a58ad8a8f5b5802942a56bc9ee

Download Submit
C:\Windows\Temp\{6FD4EE15-02EC-4D44-ABB5-14F3D5A1E707}\.be\windowsdesktop-runtime-6.0.16-win-x64.exe
Filesize
610KB

MD5
1a35556a9539eb7b2c36bfee284e85fe

SHA1
436fb73ba2627da041dd31b03b1c5a1de79973f2

SHA256
b2e1b2dbecc4e3a9179ef0e8c43e20d60e53fd676528391acba8a779bddbf957

SHA512
86b677d90f3d4878d525fbefada2d353b1687f8df72682895ca34e1905aad606f749ad9556280690720a5c2faab6b2c27949e4a58ad8a8f5b5802942a56bc9ee

Download Submit
C:\Windows\Temp\{6FD4EE15-02EC-4D44-ABB5-14F3D5A1E707}\.be\windowsdesktop-runtime-6.0.16-win-x64.exe
Filesize
610KB

MD5
1a35556a9539eb7b2c36bfee284e85fe

SHA1
436fb73ba2627da041dd31b03b1c5a1de79973f2

SHA256
b2e1b2dbecc4e3a9179ef0e8c43e20d60e53fd676528391acba8a779bddbf957

SHA512
86b677d90f3d4878d525fbefada2d353b1687f8df72682895ca34e1905aad606f749ad9556280690720a5c2faab6b2c27949e4a58ad8a8f5b5802942a56bc9ee

Download Submit
C:\Windows\Temp\{6FD4EE15-02EC-4D44-ABB5-14F3D5A1E707}\dotnet_host_6.0.16_win_x64.msi
Filesize
736KB

MD5
3187185af82a439a50f9eefebd4d430a

SHA1
dd7bd2e3f6586fbfe5e576d7cab159a7033cdf67

SHA256
7378a203b11b1fe53dedbf31d58403b74e380c5348b1b087d3729d8503810485

SHA512
77b1d8ca2815d8063d7a2ca9abfee617b3ef87342e188c6295d7e6f02a8a3b029f9149492cd48a6ffb85293c175a2e86494e5ee061bec18033379aa6cee8719e

Download Submit
C:\Windows\Temp\{6FD4EE15-02EC-4D44-ABB5-14F3D5A1E707}\dotnet_hostfxr_6.0.16_win_x64.msi
Filesize
804KB

MD5
1bcae1f2ef5e32b7c81a1e986f1b478d

SHA1
6879e1ab80f94025ba76b6667d4515c387b238e7

SHA256
ad2092b5c89cf336388cfab9b8e7f8d9585e6bdf0545f6cbf124256eaadce1ce

SHA512
d4e0b09d6474613b521edcec7d479f4f34d2479e893a3311a07610c340e3ecf5251e512d101f4188387eec0d21d090e84f94f65278d6173a02dd0ae588513c60

Download Submit
C:\Windows\Temp\{6FD4EE15-02EC-4D44-ABB5-14F3D5A1E707}\dotnet_runtime_6.0.16_win_x64.msi
Filesize
25.8MB

MD5
b6f9471c1ab4fd07c986a91bc65a0329

SHA1
cfc949bcfbc8662bc6468032efd14ec1b9e8e29d

SHA256
49ce2934548dcee0a3f149d0db727930b0a66dd9bc02279d73db201bf6405b3d

SHA512
1e94a5e3c1f4c80549880903a5b8399e9dd342c34b47c0d7bb3a5f08702d04be167c8b6d9101f28a04fbccdc3431a602c9417767897d1331de52092f9de890cd

Download Submit
C:\Windows\Temp\{6FD4EE15-02EC-4D44-ABB5-14F3D5A1E707}\windowsdesktop_runtime_6.0.16_win_x64.msi
Filesize
28.6MB

MD5
14a6cdb9879cb02b7a95900c3882fc39

SHA1
34c80595cb897f470b7e85071495285ad9c26e58

SHA256
d80c99407063c50e10d4ce944710c839c373320652a7cb5a24a93510a307225f

SHA512
afc0bb2317e42d8e545c1daf3a382cad82f653455da55b5b987c544229c0fbc29796614988d224bf03b066a2a87f59d545cb76a873bd7223c3836420cf77bee0

Download Submit
\Program Files\dotnet\host\fxr\6.0.16\hostfxr.dll
Filesize
366KB

MD5
9d9e3a7a63d7d26df86b3874ae7d52c1

SHA1
efca7ccebffcb5bf07beb6f7862bb65a36bb09f7

SHA256
0d4d5ae03c87092bb55af28b0808feaea884a1873760fba127c6894f92c59388

SHA512
dc8db106d0c07a2aceaae130341c9a6ccc38cde72faea3ad700082e13a498c049024db457c0ccbf36675cf7cdd22923bc4f27867c3044e0486ef27debb17a962

Download Submit
\Windows\Installer\MSI19B.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI2861.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI90E.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSIC203.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSIE4C2.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSIEF71.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSIF3F9.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSIF959.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Temp\{6FD4EE15-02EC-4D44-ABB5-14F3D5A1E707}\.ba\wixstdba.dll
Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
memory/2632-176-0x000001CE742F0000-0x000001CE742F1000-memory.dmp

Filesize
4KB

Download
memory/2632-390-0x000001CE7B650000-0x000001CE7B651000-memory.dmp

Filesize
4KB

Download
memory/2632-139-0x000001CE75120000-0x000001CE75130000-memory.dmp

Filesize
64KB

Download
memory/2632-157-0x000001CE75600000-0x000001CE75610000-memory.dmp

Filesize
64KB

Download
memory/2632-178-0x000001CE758E0000-0x000001CE758E2000-memory.dmp

Filesize
8KB

Download
memory/2632-180-0x000001CE79C30000-0x000001CE79C32000-memory.dmp

Filesize
8KB

Download
memory/2632-181-0x000001CE79C80000-0x000001CE79C82000-memory.dmp

Filesize
8KB

Download
memory/2632-391-0x000001CE7B660000-0x000001CE7B661000-memory.dmp

Filesize
4KB

Download
memory/4916-277-0x00000221D67F0000-0x00000221D67F2000-memory.dmp

Filesize
8KB

Download
memory/4916-460-0x00000221DCE00000-0x00000221DCF00000-memory.dmp

Filesize
1024KB

Download
memory/4916-280-0x00000221D9AF0000-0x00000221D9AF2000-memory.dmp

Filesize
8KB

Download
memory/4916-274-0x00000221D5C00000-0x00000221D5C02000-memory.dmp

Filesize
8KB

Download
memory/4916-200-0x00000221C4BC0000-0x00000221C4BC2000-memory.dmp

Filesize
8KB

Download
memory/4916-283-0x00000221DADB0000-0x00000221DADB2000-memory.dmp

Filesize
8KB

Download
memory/4916-198-0x00000221C4BA0000-0x00000221C4BA2000-memory.dmp

Filesize
8KB

Download
memory/4916-195-0x00000221C4B60000-0x00000221C4B62000-memory.dmp

Filesize
8KB

Download
memory/4916-419-0x00000221D6240000-0x00000221D6260000-memory.dmp

Filesize
128KB

Download
memory/4916-285-0x00000221DADC0000-0x00000221DADC2000-memory.dmp

Filesize
8KB

Download
memory/4916-358-0x00000221D61E0000-0x00000221D6200000-memory.dmp

Filesize
128KB

Download
memory/4916-287-0x00000221DADD0000-0x00000221DADD2000-memory.dmp

Filesize
8KB

Download
memory/4916-432-0x00000221DC700000-0x00000221DC800000-memory.dmp

Filesize
1024KB

Download
memory/4916-325-0x00000221D6A00000-0x00000221D6B00000-memory.dmp

Filesize
1024KB

Download
memory/4916-289-0x00000221DADF0000-0x00000221DADF2000-memory.dmp

Filesize
8KB

Download
memory/4916-1339-0x00000221DB800000-0x00000221DB900000-memory.dmp

Filesize
1024KB

Download
memory/4916-1344-0x00000221C4B70000-0x00000221C4B80000-memory.dmp

Filesize
64KB

Download
memory/4916-1345-0x00000221C4B70000-0x00000221C4B80000-memory.dmp

Filesize
64KB

Download
memory/4916-1346-0x00000221C4B70000-0x00000221C4B80000-memory.dmp

Filesize
64KB

Download
memory/4916-1347-0x00000221C4B70000-0x00000221C4B80000-memory.dmp

Filesize
64KB

Download
memory/4916-1350-0x00000221C4B70000-0x00000221C4B80000-memory.dmp

Filesize
64KB

Download
memory/4916-1351-0x00000221C4B70000-0x00000221C4B80000-memory.dmp

Filesize
64KB

Download
memory/4916-1352-0x00000221C4B70000-0x00000221C4B80000-memory.dmp

Filesize
64KB

Download
memory/4916-1353-0x00000221C4B70000-0x00000221C4B80000-memory.dmp

Filesize
64KB

Download
memory/4916-1354-0x00000221C4B70000-0x00000221C4B80000-memory.dmp

Filesize
64KB

Download
memory/4916-342-0x00000221DB900000-0x00000221DBA00000-memory.dmp

Filesize
1024KB

Download