hxxps://nightly[.]link/SourMesen/Mesen2/workflows/build/master/Mesen%20%28Windows%29[.]zip

Analysis

max time kernel
303s
max time network
250s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07-07-2023 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://nightly.link/SourMesen/Mesen2/workflows/build/master/Mesen%20%28Windows%29.zip

Score

9^/10

coreentity discovery persistence

Malware Config

Signatures

CoreEntity .NET Packer 3 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Mesen (Windows)\Mesen.exe	coreentity
C:\Users\Admin\Downloads\Mesen (Windows)\Mesen.exe	coreentity
C:\Users\Admin\Downloads\Mesen (Windows)\Mesen.exe	coreentity

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

windowsdesktop-runtime-6.0.19-win-x64.exeMesen.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-6.0.19-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation	Mesen.exe

Executes dropped EXE 6 IoCs

Processes:

Mesen.exewindowsdesktop-runtime-6.0.19-win-x64.exewindowsdesktop-runtime-6.0.19-win-x64.exewindowsdesktop-runtime-6.0.19-win-x64.exeMesen.exeMesen.exe

pid	process
3396	Mesen.exe
4080	windowsdesktop-runtime-6.0.19-win-x64.exe
668	windowsdesktop-runtime-6.0.19-win-x64.exe
1988	windowsdesktop-runtime-6.0.19-win-x64.exe
2232	Mesen.exe
4272	Mesen.exe

Loads dropped DLL 64 IoCs

Processes:

windowsdesktop-runtime-6.0.19-win-x64.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMesen.exeMesen.exe

pid	process
668	windowsdesktop-runtime-6.0.19-win-x64.exe
1200	MsiExec.exe
1200	MsiExec.exe
4164	MsiExec.exe
4164	MsiExec.exe
2736	MsiExec.exe
2736	MsiExec.exe
2704	MsiExec.exe
2704	MsiExec.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
2232	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe
4272	Mesen.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

windowsdesktop-runtime-6.0.19-win-x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{9a14ddc6-3a4a-420b-a304-ae5cf6579d20} = "\"C:\\ProgramData\\Package Cache\\{9a14ddc6-3a4a-420b-a304-ae5cf6579d20}\\windowsdesktop-runtime-6.0.19-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.19-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	windowsdesktop-runtime-6.0.19-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\cs\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\PresentationFramework.Aero.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\System.Windows.Forms.Design.Editors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\ko\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\fr\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\pl\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\api-ms-win-crt-process-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\.version	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\System.Windows.Controls.Ribbon.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\ko\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\tr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\es\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\pl\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\api-ms-win-crt-math-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\ru\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.Runtime.Serialization.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\ru\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\cs\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\ru\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\it\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.Xml.XmlSerializer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\zh-Hans\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.Transactions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.ComponentModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\PresentationFramework.Royale.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.Threading.ThreadPool.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.Reflection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\de\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\ru\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.Runtime.CompilerServices.VisualC.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\hostpolicy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\pt-BR\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\zh-Hans\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\de\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\tr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\de\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\UIAutomationClient.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\ja\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.IO.MemoryMappedFiles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.Net.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\zh-Hant\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\tr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\fr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\pt-BR\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\fr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\System.Drawing.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.19\pt-BR\PresentationCore.resources.dll	msiexec.exe

Drops file in Windows directory 31 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI657E.tmp	msiexec.exe
File created	C:\Windows\Installer\e59339d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI55AA.tmp	msiexec.exe
File created	C:\Windows\Installer\e5933a3.msi	msiexec.exe
File created	C:\Windows\Installer\e5933a7.msi	msiexec.exe
File created	C:\Windows\Installer\e5933a8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e593399.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI83A8.tmp	msiexec.exe
File created	C:\Windows\Installer\e5933a2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI60B9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5933a3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI68BB.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FCBEAAD5-3ADE-4A2C-B176-2C2346ED007F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7290.tmp	msiexec.exe
File created	C:\Windows\Installer\e593399.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5DF9.tmp	msiexec.exe
File created	C:\Windows\Installer\e5933ac.msi	msiexec.exe
File created	C:\Windows\Installer\e59339e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59339e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C62.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{72A2E084-E9B7-4E0A-BDF2-6E5A429E40F3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4472.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3CC763AD-93B3-41EF-ABF8-CFE63A1DC3A6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI63E6.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{66CBA69D-480E-4879-8498-3279A1C548BB}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5933a8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6CD3.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

Processes:

chrome.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133332071596121202"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exewindowsdesktop-runtime-6.0.19-win-x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.79.63142_x64\DisplayName = "Microsoft .NET Host FX Resolver - 6.0.19 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5DAAEBCFEDA3C2A41B67C23264DE00F7\PackageCode = "4A3A614980903354F94A542E7DA96246"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DA367CC33B39FE14BA8FFC6EA3D13C6A\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.79.63142_x64\Dependents\{9a14ddc6-3a4a-420b-a304-ae5cf6579d20}	windowsdesktop-runtime-6.0.19-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5DAAEBCFEDA3C2A41B67C23264DE00F7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DA367CC33B39FE14BA8FFC6EA3D13C6A\SourceList\PackageName = "dotnet-runtime-6.0.19-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.79.63142_x64\Dependents	windowsdesktop-runtime-6.0.19-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DA367CC33B39FE14BA8FFC6EA3D13C6A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5DAAEBCFEDA3C2A41B67C23264DE00F7\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5DAAEBCFEDA3C2A41B67C23264DE00F7\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DA367CC33B39FE14BA8FFC6EA3D13C6A\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.79.63142_x64\DisplayName = "Microsoft .NET Runtime - 6.0.19 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5DAAEBCFEDA3C2A41B67C23264DE00F7\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{FCBEAAD5-3ADE-4A2C-B176-2C2346ED007F}v48.79.63137\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.79.63137_x64\Dependents	windowsdesktop-runtime-6.0.19-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\480E2A277B9EA0E4DB2FE6A524E9043F\SourceList\PackageName = "dotnet-hostfxr-6.0.19-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96ABC66E0849784488923971A5C84BB\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96ABC66E0849784488923971A5C84BB\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96ABC66E0849784488923971A5C84BB\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5DAAEBCFEDA3C2A41B67C23264DE00F7\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9a14ddc6-3a4a-420b-a304-ae5cf6579d20}\ = "{9a14ddc6-3a4a-420b-a304-ae5cf6579d20}"	windowsdesktop-runtime-6.0.19-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DA367CC33B39FE14BA8FFC6EA3D13C6A\ProductName = "Microsoft .NET Runtime - 6.0.19 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\Version = "48.79.63142"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\DisplayName = "Microsoft .NET Host - 6.0.19 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\480E2A277B9EA0E4DB2FE6A524E9043F\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\480E2A277B9EA0E4DB2FE6A524E9043F\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{72A2E084-E9B7-4E0A-BDF2-6E5A429E40F3}v48.79.63142\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\094F9C7997352096B7082D27C35AD959	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DA367CC33B39FE14BA8FFC6EA3D13C6A\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\480E2A277B9EA0E4DB2FE6A524E9043F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\480E2A277B9EA0E4DB2FE6A524E9043F\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.79.63137_x64\Version = "48.79.63137"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9a14ddc6-3a4a-420b-a304-ae5cf6579d20}\Version = "6.0.19.32618"	windowsdesktop-runtime-6.0.19-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9a14ddc6-3a4a-420b-a304-ae5cf6579d20}\Dependents\{9a14ddc6-3a4a-420b-a304-ae5cf6579d20}	windowsdesktop-runtime-6.0.19-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.79.63142_x64\Version = "48.79.63142"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5DAAEBCFEDA3C2A41B67C23264DE00F7\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BCDAE57980E52446130E1F347EF5D1BD	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.79.63137_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9a14ddc6-3a4a-420b-a304-ae5cf6579d20}\Dependents	windowsdesktop-runtime-6.0.19-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DA367CC33B39FE14BA8FFC6EA3D13C6A\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DA367CC33B39FE14BA8FFC6EA3D13C6A\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D96ABC66E0849784488923971A5C84BB	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96ABC66E0849784488923971A5C84BB\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5DAAEBCFEDA3C2A41B67C23264DE00F7\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{FCBEAAD5-3ADE-4A2C-B176-2C2346ED007F}v48.79.63137\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DA367CC33B39FE14BA8FFC6EA3D13C6A\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DA367CC33B39FE14BA8FFC6EA3D13C6A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\480E2A277B9EA0E4DB2FE6A524E9043F\ProductName = "Microsoft .NET Host FX Resolver - 6.0.19 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\480E2A277B9EA0E4DB2FE6A524E9043F\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\094F9C7997352096B7082D27C35AD959\D96ABC66E0849784488923971A5C84BB	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6D924F6CCC756BE721D7B5D73B0EF1D6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\480E2A277B9EA0E4DB2FE6A524E9043F\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96ABC66E0849784488923971A5C84BB\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96ABC66E0849784488923971A5C84BB\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96ABC66E0849784488923971A5C84BB\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DA367CC33B39FE14BA8FFC6EA3D13C6A\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.79.63142_x64	windowsdesktop-runtime-6.0.19-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\480E2A277B9EA0E4DB2FE6A524E9043F\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\480E2A277B9EA0E4DB2FE6A524E9043F\Language = "1033"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\480E2A277B9EA0E4DB2FE6A524E9043F\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5DAAEBCFEDA3C2A41B67C23264DE00F7\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.79.63142_x64\Dependents	windowsdesktop-runtime-6.0.19-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\ = "{66CBA69D-480E-4879-8498-3279A1C548BB}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96ABC66E0849784488923971A5C84BB\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96ABC66E0849784488923971A5C84BB\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\Dependents	windowsdesktop-runtime-6.0.19-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\480E2A277B9EA0E4DB2FE6A524E9043F\SourceList	msiexec.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 989073.crdownload:SmartScreen msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 989073.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

chrome.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsiexec.exechrome.exe

pid	process
3964	chrome.exe
3964	chrome.exe
2260	msedge.exe
2260	msedge.exe
4244	msedge.exe
4244	msedge.exe
1464	identity_helper.exe
1464	identity_helper.exe
444	msedge.exe
444	msedge.exe
5088	msiexec.exe
5088	msiexec.exe
5088	msiexec.exe
5088	msiexec.exe
5088	msiexec.exe
5088	msiexec.exe
5088	msiexec.exe
5088	msiexec.exe
3324	chrome.exe
3324	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Mesen.exe

pid process

4272 Mesen.exe

pid	process
4272	Mesen.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

chrome.exemsedge.exe

pid	process
3964	chrome.exe
3964	chrome.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe7zG.exe

description	pid	process
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeRestorePrivilege	3136	7zG.exe
Token: 35	3136	7zG.exe
Token: SeSecurityPrivilege	3136	7zG.exe
Token: SeSecurityPrivilege	3136	7zG.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe7zG.exemsedge.exe

pid	process
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3136	7zG.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

chrome.exemsedge.exe

pid	process
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Mesen.exe

pid process

4272 Mesen.exe
4272 Mesen.exe

pid	process
4272	Mesen.exe
4272	Mesen.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3964 wrote to memory of 1572	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1572	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 1936	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2928	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2928	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe
PID 3964 wrote to memory of 2084	3964	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://nightly.link/SourMesen/Mesen2/workflows/build/master/Mesen%20%28Windows%29.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff929419758,0x7ff929419768,0x7ff929419778
2⤵
PID:1572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1892,i,4876531533712932061,7312415995345017321,131072 /prefetch:2
2⤵
PID:1936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1892,i,4876531533712932061,7312415995345017321,131072 /prefetch:8
2⤵
PID:2084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1892,i,4876531533712932061,7312415995345017321,131072 /prefetch:1
2⤵
PID:1996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1892,i,4876531533712932061,7312415995345017321,131072 /prefetch:1
2⤵
PID:3364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1892,i,4876531533712932061,7312415995345017321,131072 /prefetch:8
2⤵
PID:2928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 --field-trial-handle=1892,i,4876531533712932061,7312415995345017321,131072 /prefetch:8
2⤵
PID:3584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5148 --field-trial-handle=1892,i,4876531533712932061,7312415995345017321,131072 /prefetch:8
2⤵
PID:4628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 --field-trial-handle=1892,i,4876531533712932061,7312415995345017321,131072 /prefetch:8
2⤵
PID:3184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 --field-trial-handle=1892,i,4876531533712932061,7312415995345017321,131072 /prefetch:8
2⤵
PID:3140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3832 --field-trial-handle=1892,i,4876531533712932061,7312415995345017321,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3324

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2820

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3580

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Mesen (Windows)\" -spe -an -ai#7zMap27767:92:7zEvent86
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3136

C:\Users\Admin\Downloads\Mesen (Windows)\Mesen.exe
"C:\Users\Admin\Downloads\Mesen (Windows)\Mesen.exe"
1⤵
- Executes dropped EXE
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.18&gui=true
2⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7ff91ad246f8,0x7ff91ad24708,0x7ff91ad24718
3⤵
PID:332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
3⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
3⤵
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
3⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
3⤵
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
3⤵
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3768 /prefetch:8
3⤵
PID:2200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
3⤵
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5484 /prefetch:8
3⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
3⤵
PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
3⤵
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2160 /prefetch:1
3⤵
PID:744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
3⤵
PID:444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
3⤵
PID:960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
3⤵
PID:2180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,17410936335264687480,4925838714369058608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:444

C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.19-win-x64.exe
"C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.19-win-x64.exe"
3⤵
- Executes dropped EXE
PID:4080

C:\Windows\Temp\{B7743E6A-4B42-4E36-8E50-23399C0AC944}\.cr\windowsdesktop-runtime-6.0.19-win-x64.exe
"C:\Windows\Temp\{B7743E6A-4B42-4E36-8E50-23399C0AC944}\.cr\windowsdesktop-runtime-6.0.19-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.19-win-x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=576
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:668

C:\Windows\Temp\{383D8688-B8B1-404D-81DF-64E3DC602E9F}\.be\windowsdesktop-runtime-6.0.19-win-x64.exe
"C:\Windows\Temp\{383D8688-B8B1-404D-81DF-64E3DC602E9F}\.be\windowsdesktop-runtime-6.0.19-win-x64.exe" -q -burn.elevated BurnPipe.{A43867A5-39C5-471A-A3B0-98D9D0480BD6} {F52BF96D-BE19-462F-9297-4A35AE55BA7A} 668
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2392

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5088

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7AF2205FCD64054B03A3F17B3B12114D
2⤵
- Loads dropped DLL
PID:1200

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding D081F8643430818B4C4DCD882FC8C140
2⤵
- Loads dropped DLL
PID:4164

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 059956E95454B5F23D3301288ADB9182
2⤵
- Loads dropped DLL
PID:2736

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 00463408D9A137FD7910AB9678814BAA
2⤵
- Loads dropped DLL
PID:2704

C:\Users\Admin\Downloads\Mesen (Windows)\Mesen.exe
"C:\Users\Admin\Downloads\Mesen (Windows)\Mesen.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232

C:\Users\Admin\Downloads\Mesen (Windows)\Mesen.exe
"C:\Users\Admin\Downloads\Mesen (Windows)\Mesen.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4272

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e59339c.rbs
Filesize
56KB

MD5
be48f36603c2c322eb369a5575fa34de

SHA1
728890f4829c25a0a1f23b5c826bd2cc52d46740

SHA256
b53b19abc3cf2ee97ef96fa4eae02cb6fb79bca5947a3948579ce647f17204f2

SHA512
366e86d02608d9ff7bc9e3ce0ed1f09048b98017e7328138c18f1be261fec650285765d6828de1ac5b973d9603f647875ccf3ba7e1db1a332f87daeef23ffd4d

Download Submit
C:\Config.Msi\e5933a1.rbs
Filesize
8KB

MD5
de12df65b295676d803bced48e180eb5

SHA1
cbdeb04da25e020dc718e8d432805d99118d8d48

SHA256
e1f16d30413736cacd3c4302e081d2a1caab6e7c3a5b34f2d3062515357ae9e3

SHA512
338198c922f076981370e038c7a6e29516e96ce5609c04f304f97d4ce40007264e92c49758cf543322753fcbfe6d9058f7aa53918d2ee7d41a9c002a1f5b9422

Download Submit
C:\Config.Msi\e5933a6.rbs
Filesize
10KB

MD5
b9a865293baf80b4902a7de34e44e71b

SHA1
43c62ed9ef8e0c046ca3cac364c0fc1d3f2207fe

SHA256
abcbb432179c1bc6132429afdefab5a816f3a129c511d84f32c9c30da0d4b160

SHA512
1a2fc4af0a50cb55bcff781b625ebb2327a9001f4c21d37243e3958f77500bbfdef6a038406f535f7d7653660949aa61e462f882db7557d974c69c3b5f40967c

Download Submit
C:\Config.Msi\e5933ab.rbs
Filesize
86KB

MD5
20e56232cb1735479235757e37601e99

SHA1
41bd288c94386d2bff75703333ba56f580c724c5

SHA256
dfb5e5e310c702c6aaec99ad751b81355f47016ee5c16b2527deecfef3bc2a84

SHA512
1db513c9e9bf2bf28286f78aa2b99b85dd0b77409d27487420bbe2d659cb2f495085eef05d4206cc95088448ed23696fd0a997f6c8e0f89225fe4a80d53cc2fd

Download Submit
C:\Program Files\dotnet\LICENSE.txt
Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt
Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\Program Files\dotnet\host\fxr\6.0.19\hostfxr.dll
Filesize
366KB

MD5
859d280f300e6251d821192d4dbf568e

SHA1
c6e676b77cda044e708d9e749632e304a9334654

SHA256
3e044f24dced4efb78dc82b9fe81c1a1eb624b7421970b9c294b83bbfb0fb031

SHA512
8c0ffdf29447793960eaf004ed4f3aa4729354668332dfae4f431083f8f48ba5f53d932671f759c808966877a77bf2b8c8c17cf3eaef551bda06af49d98b67fc

Download Submit
C:\Program Files\dotnet\host\fxr\6.0.19\hostfxr.dll
Filesize
366KB

MD5
859d280f300e6251d821192d4dbf568e

SHA1
c6e676b77cda044e708d9e749632e304a9334654

SHA256
3e044f24dced4efb78dc82b9fe81c1a1eb624b7421970b9c294b83bbfb0fb031

SHA512
8c0ffdf29447793960eaf004ed4f3aa4729354668332dfae4f431083f8f48ba5f53d932671f759c808966877a77bf2b8c8c17cf3eaef551bda06af49d98b67fc

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\Microsoft.NETCore.App.deps.json
Filesize
32KB

MD5
e5ebcb6ff561698436c6ff22e40bf4e1

SHA1
d6be06d23709afe98c13dc7630176908e4cdda67

SHA256
c7d8fdce6d3798b590a98e4bd7a48fabff3d34e6369cdc5a96c9acd750533620

SHA512
d16fd67f85bf2f1be0c502cdc3c05e3555327651ad98d772973313a8d82ace0d8912d9c5c6c2475046d66fdcf7deb1f41c973c735dcbc338951cd6891d44df2c

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.19\Microsoft.NETCore.App.runtimeconfig.json
Filesize
159B

MD5
3fbd84a952d4bab02e11fec7b2bbc90e

SHA1
e92de794f3c8d5a5a1a0b75318be9d5fb528d07d

SHA256
1b7aa545d9d3216979a9efe8d72967f6e559a9c6a22288d14444d6c5c4c15738

SHA512
c97c1da7ae94847d4edf11625dc5b5085838c3842a550310cca5c70ba54be907ff454ca1e0080ba451eacfc5954c3f778f8b4e26c0933e55c121c86c9a24400b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
31cbaf625e5e2fe2f53f0bc9fe5e3d50

SHA1
64d1fb65676ef86fa152a8f0a492d2035d8fd961

SHA256
0f03a22565009086c57e3d0bd0b043aa415fdad9a7b3bc7852236d7ebfb43a64

SHA512
2db57fb438c3191133695f13da167203478f021f34ccc14077dcaeffa6b127f25f20816a4b32e2ea0da0506e99c5068c5d08a5cbb532c00b669cc9758c776d63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
539B

MD5
c33def360ec568d8ec76433d936344e6

SHA1
686cd754a40f24f700187cc1cc58f2745f72f10e

SHA256
3e628f4629b9db3ab2ac8b2db4bac17b221b498a9f55dc941d57b2bb017c7f21

SHA512
23fc3b9295b3719d4b40344d7832e940c5b0c8ebcbaed1f259445e7b2b68a3ed28f871d3acd3ca9e418b3bb7113813d05f49965260baabf8e295c493b042c70e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
020968d472a46dbd9d52e4cb0f4186a9

SHA1
5759a4942bbc28ef812f1084740fa53fbcd3502f

SHA256
3d06c3b0dee6c3732ad3c1eadb59653a9f7499a99695bd8b247a56a4744a2b0d

SHA512
fc4e9e75f0949332ec6e99a4476b41f5ce9e84a2224a0b7a3b8df7c55ee2c387caf4b97bb09b42f3a64f56cc71a73f57628d436cf5209667a80945728ef308c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
674aec21c66a3832183dc903c4758541

SHA1
10759352125eb4bf92f4a5c17456d2fd85de2e5c

SHA256
bb3870454a4b4f958547cf89bec148e18498cd3a1e4f0a630c80bd8938c35906

SHA512
ada0987e6ef5ed3421127edae0dd68ccda962d78553e2066477108c89be3a9479a51217b3de07bc4b86efd8154b169786cab7efe886ae074e97dfbf9a7b6d3a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
172KB

MD5
01c58706b08b34250668b1107035fa77

SHA1
af0b5acd3ac7da4134336e19e08bb002529ed449

SHA256
3412c34af6ba8777651d5b96eb82b6d72035e4b58122220d4337874296138d66

SHA512
3f77fc375f04f42dd190d159b30b3c83003706851ecd323ec06105ab120b3377beea269f884a1727be255f436b4cf7f6d4ea1e424561dc740911c10b51910f0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
45665ed1be9b53b2bef938c8d689b5eb

SHA1
32498de1bff99e92b7acc9cac3e565f92049475f

SHA256
46b0efb212c8f4d3172cbe4d950d8da1c8eda1509b19c0bb00b81de47791a108

SHA512
79f35568a0b098284bf6a62f5eb058f31da3595c4b52553deed12285098477337abb0ea2f10ba343ff88a30ed1db7f0f1ef6f372985eda76ecae991b04e604f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
839B

MD5
7e63d165e8fe691ec6b1160b21bc12e9

SHA1
549ce6bbe3b1f39f294424a0bd41b9b7fa93ef70

SHA256
c57a86a023c33069a218e66a92aeac6f76d1ccff4f8f31af45c0608e98210dc6

SHA512
cf0f93d0b5975816da78bd5f4351fa3c9569d204e504438d376439ff95830eb1b97b44bc1b245f8cab52ce71c3f7cec16a639afe41bd9cdf88b66833d286099e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
739B

MD5
724a61cf68f2fdab0b36cee1429e17b1

SHA1
4d2852873fb6dec9e664697d9be5fb3b7d8235e5

SHA256
395fc4e43c41d308e3a5fe3d52940a511c9be4615eebf9313b9fd12f7dbc60e1

SHA512
6cc47a9d1bb3656fa3fbf4c3fa284a84e69fe445324c426568e586c2723d527501e72c950c112b423549bfd14071f1a7a6380930e43c3a697d30b63e681a1bc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
5a99103f355af3618104d019df208347

SHA1
e8084b9136186693fd803d58c8e740ca54136162

SHA256
205e25a18d1f2f54b89444348a4d33834d26789cc60ffcc0a499faaef3e4de26

SHA512
575eacaa552f8eab2d84564d698509c1412f20a21c9bea2a5950314dc04377b9efd46408e55462d4aec35667e30b970ef7b8f6e5757f09875a927bfd75b585ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
14f4c59db6bf6ab33a2356af45f72a42

SHA1
dc59034161134da509011ef069293cd03c5bf434

SHA256
d2551bc3eddafafaa3a22a8c5f510298502e7375fc9704c1db11139c0ab852ed

SHA512
eeaad4bcba7699cb43ec2bf0eaf24c2342fbf534078970c38a74567e9be66b0dfc5bda8ba2ba3e480745e6649c2e2cce18c40d570ef406e2fd4fd98b90754df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
823005971a990777945cee67d7229f75

SHA1
d9793f47357d255a5de0d13d66283cc5bacad531

SHA256
543d086aefdffdc708294e1be56ad243b63723f8f71feeb5f95e2a863479e2a7

SHA512
abfae3f1483eb9ba3cf7ba4597f2cd903f6150b3477456ddf7e71d83eac90f0a41c583921b4fbe19e65206e09487a90f067678adc5d2aaf54c089fbcd3dac4a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
29213338df67d29d6454ee5d61ad3970

SHA1
8c69ca76a2e639060d5ce835a9600e6ea3764a83

SHA256
d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51

SHA512
14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
707B

MD5
4f4e3e28139b5bcbb98a869b5fa9e779

SHA1
e9bd6bbf1c66903e9e51eb040405ab6f6608bbbf

SHA256
9d7997c0df0ed957f672af0e696de552854053dcb89a5008b6ab220d2905553e

SHA512
4bf3dcd045bb63ba6d33a9cfb6e0291fff4bce1521314e98b93e71c691a43c0626a3cd22cc4995c98c800901f13aa7d47fbc141164da49431a2ffba1ee954502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe599e3a.TMP
Filesize
539B

MD5
2987c064b082b09c1e2cf87038812294

SHA1
67d94026856667fa27e0204954a7e28f6084a605

SHA256
5ff0906305955b0293c221102e3512faf211a2d9658ec7e36cb6bf9551379174

SHA512
508159653fbce65ef0b1ebbc08ad2da40c3410e247f093694091080990a7f7fce91138cf500f3beb333498676b8484162ea4f5b086ef57f41830fed560d4d519

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
626440d421a001732ed4b70bdabe4548

SHA1
24f1b4578a34630844fcc31460810e568a1216e3

SHA256
72f9e075c1fc4b8ee20ed2dcd305ce105eb0b60e1f567c159a20582cb3a4dc5e

SHA512
56064fbefc3423cf69ac42f2b9499a6b5a59e70f560b936039a5c1809074ff541e4015f747c914c6e5a846d9d7637c48d61ec4ae8bfd2fb5ac54cdb2893bae69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
ae620bbbab94b1e9307808d2f49e2004

SHA1
b4e688fe6f07c62e2a183834321d105330338630

SHA256
87f4007877833da4f3ca3bb050d25de0fbf34d30f75d33c2b7c7be7656c78b58

SHA512
167b112aeb2ea4a3384dce4a702d4c363464af01c810aec80505614b7192e31c38b4f45c2aa08e34da277393f734c0008aecd0299dc1f1e77f65a9e650dda9ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
b64dfe946916f8a66fb497219034f648

SHA1
9f7fddf60e218b29a4c3010b2244321da27b2c1a

SHA256
edbb67a0169e9ba74e44e242e8a9a02d91016d93e3bfacd4188ca4954baf19ce

SHA512
53978545887cdc2f4f9166e6b2db46e0fb3d95eefddf0f3ebc9025eff8d2fdce8233fa3a60c2f78c7ef338b799c18250d3cc3ed01b56ac2bed661c1c9130dff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
b2eb486200ba224d84996a5253dabfcd

SHA1
8750ffc278be1bdda53e48ac00477ef891eb67e1

SHA256
c3a9d7cda554b093dd7cfac11ad0e7b554fc7374f7c9bad85487e48cf0c692b4

SHA512
9ac4b7a9ee9c9b58d4e2f8964f5446cc0b969e3c1a8e11cbcd177ad8bd88dfbc258ca2caa34bcc1ee060f250478dec988429aa787bb2c4cd69f1d19eb4171a95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.19_(x64)_20230707124036_000_dotnet_runtime_6.0.19_win_x64.msi.log
Filesize
3KB

MD5
5b71de17b69288e90b69d9f13b73d7c5

SHA1
3399c06e438e9273e78eaaf1f9b8c0fcafcd8e5c

SHA256
8bedcfeb1267678dd1d2607ad2b4c2e0518b3ad929b6d469b51e4fe46aff14e1

SHA512
ac14c63ba01279fa7b8edb8b1f99766024a39ff2057f9a1af9b7c16e0bd4d40c4c63fb863dd1fc5ea2b6b7759e2645ae6fa1c0b981a8f808f8ff8f0e1c61fea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.19_(x64)_20230707124036_001_dotnet_hostfxr_6.0.19_win_x64.msi.log
Filesize
2KB

MD5
9fbc4da24e7c6109199d21432a498bb7

SHA1
f366d897e5a7db07372ec767b8329a3d8e826e80

SHA256
1d736e34958e0a3d7b0c3597d668c5faf58f1a506714c9ff4cee0a57d8056b9c

SHA512
9fefb88a033467196cc04b4b1528a3392a6fab01c7440df1172f356e48ac4695925a487666b3143feea7efcfb8defd678dac49e8049ad93f192a6c8d4ea9b440

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.19_(x64)_20230707124036_002_dotnet_host_6.0.19_win_x64.msi.log
Filesize
2KB

MD5
03cde4c1852860d99e2ad4cc802fb061

SHA1
c3b0b681ad96cfe3a342afeefd2b558f79f3fd4e

SHA256
8035d1e8afab44216891e6c031429c146bd54ae169c7bc263306d18e5ab67ce6

SHA512
1c46444b1a641909ff186aa82b17038d18f12d3f2177619e5f7707e776e3f9eb7c065c6928c1bb6cb46d8e81227af64316618cbc3126c67ff1bb99dd4d77c9a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.19_(x64)_20230707124036_003_windowsdesktop_runtime_6.0.19_win_x64.msi.log
Filesize
2KB

MD5
c57124d1bc8e71731998a5891c384f7b

SHA1
bedfa42a15e2652407cdcc5e34e0701dfa572a14

SHA256
5546f13ed67f3a10a35ed6da0a1a02f8043e3c2795c0e32ff77dcff823cd5d74

SHA512
fbfd0ff9e9c6818c4e5c7485c9e4e154a53a6417ff70edcfacb5579b5e94e68862a98cd85c38f6e3b9d8420ca2cfc02ae71feade164f7bbd213470507b35a05f

Download Submit
C:\Users\Admin\Downloads\Mesen (Windows).zip
Filesize
15.8MB

MD5
98b3c3448f5bf01110c3362e1d6a71c0

SHA1
beb2fc370cc17d25855bdad6d2916d209be4d570

SHA256
b7ca9b7137d6b404bfd6b19c9b715851d070a9b999377318c1e86b5be19bf7b0

SHA512
91916d851a60eab023b945532a1d05de80123fea0046f330488c689e71dd067e3dda122708c363f5f09db89455efd6615a24e99c9552a7eb41896f43f0ecb460

Download Submit
C:\Users\Admin\Downloads\Mesen (Windows)\Mesen.exe
Filesize
32.6MB

MD5
a6706ffcc32dcbf6c02324b4b7ec813a

SHA1
910c3c7229ccf6d60b5278abf3e406a4657521e5

SHA256
caa16465e8b280aca118bcfbee524572ea6bd8cf0d7b1a8cff09b79194832265

SHA512
7a1f325c37c5573530a831a242b6abf74d9b45c67eaa9b0cd7e87650a7b03ae9602a8811ece9c07b887958b10eedcecf76ecdff1f6dc50205ee314f88804aa05

Download Submit
C:\Users\Admin\Downloads\Mesen (Windows)\Mesen.exe
Filesize
32.6MB

MD5
a6706ffcc32dcbf6c02324b4b7ec813a

SHA1
910c3c7229ccf6d60b5278abf3e406a4657521e5

SHA256
caa16465e8b280aca118bcfbee524572ea6bd8cf0d7b1a8cff09b79194832265

SHA512
7a1f325c37c5573530a831a242b6abf74d9b45c67eaa9b0cd7e87650a7b03ae9602a8811ece9c07b887958b10eedcecf76ecdff1f6dc50205ee314f88804aa05

Download Submit
C:\Users\Admin\Downloads\Mesen (Windows)\Mesen.exe
Filesize
32.6MB

MD5
a6706ffcc32dcbf6c02324b4b7ec813a

SHA1
910c3c7229ccf6d60b5278abf3e406a4657521e5

SHA256
caa16465e8b280aca118bcfbee524572ea6bd8cf0d7b1a8cff09b79194832265

SHA512
7a1f325c37c5573530a831a242b6abf74d9b45c67eaa9b0cd7e87650a7b03ae9602a8811ece9c07b887958b10eedcecf76ecdff1f6dc50205ee314f88804aa05

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.19-win-x64.exe
Filesize
54.5MB

MD5
a9c3fb5a551ea4bdfc9b4fbd48afa943

SHA1
b55044d27d8d5d06350c1016c4019882c57d42fa

SHA256
f95017731cd35fe71b27aa904fb64242b16f390c52ad6f9d464ddfe8c11325c9

SHA512
ee214705a57e0da2f31dfb4a4ce2368898eef10bbe024f2e0b05889a85d472d3acba9cd935fba5391b84463c1245f641bcc3cbeb9a48334fb6d41e7b3a2a9d61

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.19-win-x64.exe
Filesize
54.5MB

MD5
a9c3fb5a551ea4bdfc9b4fbd48afa943

SHA1
b55044d27d8d5d06350c1016c4019882c57d42fa

SHA256
f95017731cd35fe71b27aa904fb64242b16f390c52ad6f9d464ddfe8c11325c9

SHA512
ee214705a57e0da2f31dfb4a4ce2368898eef10bbe024f2e0b05889a85d472d3acba9cd935fba5391b84463c1245f641bcc3cbeb9a48334fb6d41e7b3a2a9d61

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.19-win-x64.exe
Filesize
54.5MB

MD5
a9c3fb5a551ea4bdfc9b4fbd48afa943

SHA1
b55044d27d8d5d06350c1016c4019882c57d42fa

SHA256
f95017731cd35fe71b27aa904fb64242b16f390c52ad6f9d464ddfe8c11325c9

SHA512
ee214705a57e0da2f31dfb4a4ce2368898eef10bbe024f2e0b05889a85d472d3acba9cd935fba5391b84463c1245f641bcc3cbeb9a48334fb6d41e7b3a2a9d61

Download Submit
C:\Windows\Installer\MSI4472.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI4472.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI55AA.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI55AA.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5C62.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5C62.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5C62.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI60B9.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI60B9.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI63E6.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI63E6.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI68BB.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI68BB.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI6CD3.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI6CD3.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI83A8.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI83A8.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\e59339d.msi
Filesize
25.6MB

MD5
1aab26b98337da9a21e000410e3d9168

SHA1
4c088ece6b87257d6bb13022c87cb689c6585859

SHA256
ae118dce820c51ede46f5a62dbfc2a73e51316369d0ec1e31dede724516b8df9

SHA512
6c5b79ec1d0ca3e94fd8734a0df857e639f4576cca6c47de7f091dad50ef99678c3210dcc29bbc2ad9c16e416704cd3db2c717fcf0588563707b445834b921c9

Download Submit
C:\Windows\Installer\e5933a2.msi
Filesize
804KB

MD5
e61bdf946b7f41ec2ce0cb132a4a75d5

SHA1
b7c806e801b0b49957bc5f000bec3e7d2b5a6d5a

SHA256
24a97c16d62636ce084f59db7486ddb6d8d00d5a8ae4b14e18fcb14fb0106a64

SHA512
8388e3acf02566c5c19d580ee7356d21e3e468ad47237f792bab8e4a49aef3d55bd1368d10faf05ffc0fef260a31cde9c6e238cc22566fac398d898befb62a80

Download Submit
C:\Windows\Installer\e5933ac.msi
Filesize
28.5MB

MD5
68108c8cd204f4018216a49189146181

SHA1
60c0eb9342c21c73f6f5d9ce86bdc284e54b68f7

SHA256
0f292e58c3b9f70b486fd83a541431c1bc0f723a101587c9234a887e5be3eefb

SHA512
2e54d0852dd1df37f8f3a3ed1d2da866243e0411e13dac182af9284953e1c0bf03cabe556e34fec4cf5dc1f6fd41494f4b92e661c03631cd61929420ab95fcdb

Download Submit
C:\Windows\Temp\{383D8688-B8B1-404D-81DF-64E3DC602E9F}\.ba\bg.png
Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{383D8688-B8B1-404D-81DF-64E3DC602E9F}\.ba\wixstdba.dll
Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{383D8688-B8B1-404D-81DF-64E3DC602E9F}\.be\windowsdesktop-runtime-6.0.19-win-x64.exe
Filesize
610KB

MD5
4d8cbb7b094d33ef5c7ad4f876b81613

SHA1
212249a468d4daac4f502be8d03d12cdc8abaff3

SHA256
91c791afd0c5aae805570e7276355bddb150f6480dcc3839c5f3d24069c1d93b

SHA512
bd6c368be1518bfacc12f571f80ede8e93dc3648a6535c6d6581c5dc5977a5296223a546d692ed3e1511c64b4ac9d5fa4a9070086e2b43ec0cd9b57b73c5d363

Download Submit
C:\Windows\Temp\{383D8688-B8B1-404D-81DF-64E3DC602E9F}\.be\windowsdesktop-runtime-6.0.19-win-x64.exe
Filesize
610KB

MD5
4d8cbb7b094d33ef5c7ad4f876b81613

SHA1
212249a468d4daac4f502be8d03d12cdc8abaff3

SHA256
91c791afd0c5aae805570e7276355bddb150f6480dcc3839c5f3d24069c1d93b

SHA512
bd6c368be1518bfacc12f571f80ede8e93dc3648a6535c6d6581c5dc5977a5296223a546d692ed3e1511c64b4ac9d5fa4a9070086e2b43ec0cd9b57b73c5d363

Download Submit
C:\Windows\Temp\{383D8688-B8B1-404D-81DF-64E3DC602E9F}\.be\windowsdesktop-runtime-6.0.19-win-x64.exe
Filesize
610KB

MD5
4d8cbb7b094d33ef5c7ad4f876b81613

SHA1
212249a468d4daac4f502be8d03d12cdc8abaff3

SHA256
91c791afd0c5aae805570e7276355bddb150f6480dcc3839c5f3d24069c1d93b

SHA512
bd6c368be1518bfacc12f571f80ede8e93dc3648a6535c6d6581c5dc5977a5296223a546d692ed3e1511c64b4ac9d5fa4a9070086e2b43ec0cd9b57b73c5d363

Download Submit
C:\Windows\Temp\{383D8688-B8B1-404D-81DF-64E3DC602E9F}\dotnet_host_6.0.19_win_x64.msi
Filesize
736KB

MD5
581f8dbf037bd386cee6afb28a096f67

SHA1
284fedd1573436b851b42dfbc05f34d5c45b7510

SHA256
221a3ad1e29c4bc9485220ede569ce80a10d75962ee2cdbdf6d324ac1dccb3d5

SHA512
b7145a49992a053473fc526039c93d78d21c0747e8ddb5cc62316134b0332680b5712fdda5ceb1daa69279b55ff5f02eb0bc4f1e8b03f4c5c16040b8030ec164

Download Submit
C:\Windows\Temp\{383D8688-B8B1-404D-81DF-64E3DC602E9F}\dotnet_hostfxr_6.0.19_win_x64.msi
Filesize
804KB

MD5
e61bdf946b7f41ec2ce0cb132a4a75d5

SHA1
b7c806e801b0b49957bc5f000bec3e7d2b5a6d5a

SHA256
24a97c16d62636ce084f59db7486ddb6d8d00d5a8ae4b14e18fcb14fb0106a64

SHA512
8388e3acf02566c5c19d580ee7356d21e3e468ad47237f792bab8e4a49aef3d55bd1368d10faf05ffc0fef260a31cde9c6e238cc22566fac398d898befb62a80

Download Submit
C:\Windows\Temp\{383D8688-B8B1-404D-81DF-64E3DC602E9F}\dotnet_runtime_6.0.19_win_x64.msi
Filesize
25.6MB

MD5
1aab26b98337da9a21e000410e3d9168

SHA1
4c088ece6b87257d6bb13022c87cb689c6585859

SHA256
ae118dce820c51ede46f5a62dbfc2a73e51316369d0ec1e31dede724516b8df9

SHA512
6c5b79ec1d0ca3e94fd8734a0df857e639f4576cca6c47de7f091dad50ef99678c3210dcc29bbc2ad9c16e416704cd3db2c717fcf0588563707b445834b921c9

Download Submit
C:\Windows\Temp\{383D8688-B8B1-404D-81DF-64E3DC602E9F}\windowsdesktop_runtime_6.0.19_win_x64.msi
Filesize
28.5MB

MD5
68108c8cd204f4018216a49189146181

SHA1
60c0eb9342c21c73f6f5d9ce86bdc284e54b68f7

SHA256
0f292e58c3b9f70b486fd83a541431c1bc0f723a101587c9234a887e5be3eefb

SHA512
2e54d0852dd1df37f8f3a3ed1d2da866243e0411e13dac182af9284953e1c0bf03cabe556e34fec4cf5dc1f6fd41494f4b92e661c03631cd61929420ab95fcdb

Download Submit
C:\Windows\Temp\{B7743E6A-4B42-4E36-8E50-23399C0AC944}\.cr\windowsdesktop-runtime-6.0.19-win-x64.exe
Filesize
610KB

MD5
4d8cbb7b094d33ef5c7ad4f876b81613

SHA1
212249a468d4daac4f502be8d03d12cdc8abaff3

SHA256
91c791afd0c5aae805570e7276355bddb150f6480dcc3839c5f3d24069c1d93b

SHA512
bd6c368be1518bfacc12f571f80ede8e93dc3648a6535c6d6581c5dc5977a5296223a546d692ed3e1511c64b4ac9d5fa4a9070086e2b43ec0cd9b57b73c5d363

Download Submit
C:\Windows\Temp\{B7743E6A-4B42-4E36-8E50-23399C0AC944}\.cr\windowsdesktop-runtime-6.0.19-win-x64.exe
Filesize
610KB

MD5
4d8cbb7b094d33ef5c7ad4f876b81613

SHA1
212249a468d4daac4f502be8d03d12cdc8abaff3

SHA256
91c791afd0c5aae805570e7276355bddb150f6480dcc3839c5f3d24069c1d93b

SHA512
bd6c368be1518bfacc12f571f80ede8e93dc3648a6535c6d6581c5dc5977a5296223a546d692ed3e1511c64b4ac9d5fa4a9070086e2b43ec0cd9b57b73c5d363

Download Submit
\??\pipe\LOCAL\crashpad_4244_WAFYOFAKYUPKCQKF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_3964_MWDQGDEHTDXTPCWO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit