0f9765f58fc4389dcd7541172a4454c0f646dbec174e828a64abc9aa19de4990

Resubmissions

22-08-2023 00:47

230822-a5b3csah3y 8

22-08-2023 00:45

230822-a4e3mahb92 8

Analysis

max time kernel
264s
max time network
273s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
22-08-2023 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Muse_Hub.exe
Size

38.2MB
MD5

113b0b7cfcaf7b11d541d6860534ce2c
SHA1

443a0f24974652fd2d081b952061a5e0f386e71a
SHA256

0f9765f58fc4389dcd7541172a4454c0f646dbec174e828a64abc9aa19de4990
SHA512

78f09c46d202d73194f7c648effd03c250a20dc280e07bddb9380128c6077ce86d78da1ce22be1fcc14024a09aa35bd23f9288f1a650d66233b21ddaaa93c9e4
SSDEEP

786432:mt+ooIxXSZFxfPfRLtX630iml6R/YwsNnoPv7pAMVUZ4HG04Rgrk:mt+ooIJsxn1tq30iu6R/vsNnCVUZ4Hl4

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{569b351b-451b-48db-a2c7-7beb63411666} = "\"C:\\ProgramData\\Package Cache\\{569b351b-451b-48db-a2c7-7beb63411666}\\windowsdesktop-runtime-6.0.9-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.9-win-x64.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Muse.Service\Muse.Service_Url_zmbqaeottvmi12bkaynsf5cuhyatvbia\jf5e0wkx.tmp	Muse.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Muse.Service\Muse.Service_Url_zmbqaeottvmi12bkaynsf5cuhyatvbia\jf5e0wkx.newcfg	Muse.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\AppCenter\2fc1dd14-f3d8-4d94-8541-6f72f2fea592\Logs.db	Muse.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\AppCenter\2fc1dd14-f3d8-4d94-8541-6f72f2fea592\Logs.db-journal	Muse.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\pt-BR\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\ko\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\de\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-core-console-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\zh-Hans\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-crt-utility-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Threading.ThreadPool.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\ru\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\pt-BR\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\ko\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.ServiceProcess.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Text.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\es\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\pt-BR\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\tr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.9\hostfxr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\de\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Reflection.DispatchProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\fr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\UIAutomationClientSideProviders.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\es\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\pt-BR\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\ru\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\PresentationFramework.AeroLite.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\ja\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\tr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\System.Printing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\tr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\System.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\System.Windows.Forms.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\tr\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\UIAutomationTypes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Net.WebHeaderCollection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-core-file-l2-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\cs\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\de\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\zh-Hant\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Buffers.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Runtime.Loader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\ja\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-core-libraryloader-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\ko\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\zh-Hans\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.9\ja\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Net.WebSockets.dll	msiexec.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FD10B803-97FD-4867-9753-8784BC35D2F8}	msiexec.exe
File created	C:\Windows\Installer\e584466.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e584466.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0B4F742D-2D47-4E95-B756-402822D31C48}	msiexec.exe
File created	C:\Windows\Installer\e58445c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58445c.msi	msiexec.exe
File created	C:\Windows\Installer\e584461.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C30ABA3F-32C0-43D1-B3B8-9AEFD58A15D9}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB78.tmp	msiexec.exe
File created	C:\Windows\Installer\e584465.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA6D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C1CD2FC1-92E6-4DE2-89D8-6D309881856F}	msiexec.exe
File created	C:\Windows\Installer\e58446a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI48BC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C71.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e584461.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E25.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA26C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6F2.tmp	msiexec.exe
File created	C:\Windows\Installer\e584457.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5FB2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4BDA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5800.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA413.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e584457.msi	msiexec.exe
File created	C:\Windows\Installer\e58445b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI75CB.tmp	msiexec.exe
File created	C:\Windows\Installer\e584460.msi	msiexec.exe

Executes dropped EXE 4 IoCs

pid	Process
5084	EXE_NETCORECHECK.EXE
2612	netdesktopruntime.exe
3696	netdesktopruntime.exe
3500	windowsdesktop-runtime-6.0.9-win-x64.exe

Loads dropped DLL 64 IoCs

pid	Process
3696	netdesktopruntime.exe
1600	MsiExec.exe
1600	MsiExec.exe
4916	MsiExec.exe
4916	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe
4104	MsiExec.exe
4104	MsiExec.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
5052	Muse.Service.exe
5052	Muse.Service.exe
5052	Muse.Service.exe
5052	Muse.Service.exe
5052	Muse.Service.exe
4556	Muse.exe
4556	Muse.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4952	4556	WerFault.exe	101
1600	4644	WerFault.exe	110
6592	4008	WerFault.exe	139
4988	3840	WerFault.exe	142

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Muse.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	Muse.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	Muse.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Muse.Service.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	Muse.Service.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.39.47157_x64\DisplayName = "Microsoft .NET Runtime - 6.0.9 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D247F4B074D259E47B650482223DC184\SourceList\PackageName = "dotnet-runtime-6.0.9-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B01DFDF79768479357848CB532D8F\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{FD10B803-97FD-4867-9753-8784BC35D2F8}v48.39.47157\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F3ABA03C0C231D343B8BA9FE5DA8519D\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1CF2DC1C6E292ED4988DD603891858F6\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C1CD2FC1-92E6-4DE2-89D8-6D309881856F}v48.39.47171\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.39.47171_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1CF2DC1C6E292ED4988DD603891858F6\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1CF2DC1C6E292ED4988DD603891858F6\ProductName = "Microsoft Windows Desktop Runtime - 6.0.9 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4E1D4F01B85518B7F304517DA5DADEE0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D247F4B074D259E47B650482223DC184\ProductName = "Microsoft .NET Runtime - 6.0.9 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.39.47157_x64	windowsdesktop-runtime-6.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\Version = "48.39.47157"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1CF2DC1C6E292ED4988DD603891858F6\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.39.47171_x64\Dependents	windowsdesktop-runtime-6.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D247F4B074D259E47B650482223DC184	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B65E377217E5AB676BCDCF1498676AD2	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1CF2DC1C6E292ED4988DD603891858F6\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1CF2DC1C6E292ED4988DD603891858F6\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.39.47157_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\ = "{C30ABA3F-32C0-43D1-B3B8-9AEFD58A15D9}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\SourceList\PackageName = "dotnet-host-6.0.9-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D247F4B074D259E47B650482223DC184	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\308B01DFDF79768479357848CB532D8F\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1CF2DC1C6E292ED4988DD603891858F6\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D247F4B074D259E47B650482223DC184\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D247F4B074D259E47B650482223DC184\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D247F4B074D259E47B650482223DC184\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B914F09030858BB755BF3C9E531A6669	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D247F4B074D259E47B650482223DC184\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\308B01DFDF79768479357848CB532D8F	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B01DFDF79768479357848CB532D8F\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B01DFDF79768479357848CB532D8F\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.39.47157_x64	windowsdesktop-runtime-6.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.39.47157_x64\Dependents\{569b351b-451b-48db-a2c7-7beb63411666}	windowsdesktop-runtime-6.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D247F4B074D259E47B650482223DC184\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{0B4F742D-2D47-4E95-B756-402822D31C48}v48.39.47157\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.39.47157_x64\ = "{FD10B803-97FD-4867-9753-8784BC35D2F8}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.39.47171_x64\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.9 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.39.47157_x64\Dependents	windowsdesktop-runtime-6.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.39.47171_x64	windowsdesktop-runtime-6.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D247F4B074D259E47B650482223DC184\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1CF2DC1C6E292ED4988DD603891858F6\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D247F4B074D259E47B650482223DC184\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B01DFDF79768479357848CB532D8F\PackageCode = "F94C50F07ED1F4A40B1C80F8986CF743"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B01DFDF79768479357848CB532D8F\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F3ABA03C0C231D343B8BA9FE5DA8519D\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D247F4B074D259E47B650482223DC184\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D247F4B074D259E47B650482223DC184\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B01DFDF79768479357848CB532D8F\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B01DFDF79768479357848CB532D8F\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1CF2DC1C6E292ED4988DD603891858F6\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1CF2DC1C6E292ED4988DD603891858F6\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{569b351b-451b-48db-a2c7-7beb63411666}\Version = "6.0.9.31620"	windowsdesktop-runtime-6.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B01DFDF79768479357848CB532D8F\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\094F9C7997352096B7082D27C35AD959\F3ABA03C0C231D343B8BA9FE5DA8519D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1CF2DC1C6E292ED4988DD603891858F6\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1CF2DC1C6E292ED4988DD603891858F6	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\score_0.pdf:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5060	msiexec.exe
5060	msiexec.exe
5060	msiexec.exe
5060	msiexec.exe
5060	msiexec.exe
5060	msiexec.exe
5060	msiexec.exe
5060	msiexec.exe
5052	Muse.Service.exe
5052	Muse.Service.exe
5052	Muse.Service.exe
5052	Muse.Service.exe
5052	Muse.Service.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeSecurityPrivilege	5060	msiexec.exe
Token: SeCreateTokenPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeLockMemoryPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeMachineAccountPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeTcbPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeSecurityPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeTakeOwnershipPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeLoadDriverPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeSystemProfilePrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeSystemtimePrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeProfSingleProcessPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeIncBasePriorityPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeCreatePagefilePrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeCreatePermanentPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeBackupPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeRestorePrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeShutdownPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeDebugPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeAuditPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeSystemEnvironmentPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeChangeNotifyPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeRemoteShutdownPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeUndockPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeSyncAgentPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeEnableDelegationPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeManageVolumePrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeImpersonatePrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeCreateGlobalPrivilege	3500	windowsdesktop-runtime-6.0.9-win-x64.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
4556	Muse.exe
4556	Muse.exe
4556	Muse.exe
4644	Muse.exe
4644	Muse.exe
4644	Muse.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
4008	Muse.exe
4008	Muse.exe
4008	Muse.exe
3840	Muse.exe
3840	Muse.exe
3840	Muse.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
4556	Muse.exe
4556	Muse.exe
4644	Muse.exe
4644	Muse.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
4008	Muse.exe
4008	Muse.exe
3840	Muse.exe
3840	Muse.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 5084	1260	Muse_Hub.exe	80
PID 1260 wrote to memory of 5084	1260	Muse_Hub.exe	80
PID 1260 wrote to memory of 2612	1260	Muse_Hub.exe	91
PID 1260 wrote to memory of 2612	1260	Muse_Hub.exe	91
PID 1260 wrote to memory of 2612	1260	Muse_Hub.exe	91
PID 2612 wrote to memory of 3696	2612	netdesktopruntime.exe	92
PID 2612 wrote to memory of 3696	2612	netdesktopruntime.exe	92
PID 2612 wrote to memory of 3696	2612	netdesktopruntime.exe	92
PID 3696 wrote to memory of 3500	3696	netdesktopruntime.exe	93
PID 3696 wrote to memory of 3500	3696	netdesktopruntime.exe	93
PID 3696 wrote to memory of 3500	3696	netdesktopruntime.exe	93
PID 5060 wrote to memory of 1600	5060	msiexec.exe	96
PID 5060 wrote to memory of 1600	5060	msiexec.exe	96
PID 5060 wrote to memory of 1600	5060	msiexec.exe	96
PID 5060 wrote to memory of 4916	5060	msiexec.exe	97
PID 5060 wrote to memory of 4916	5060	msiexec.exe	97
PID 5060 wrote to memory of 4916	5060	msiexec.exe	97
PID 5060 wrote to memory of 4328	5060	msiexec.exe	98
PID 5060 wrote to memory of 4328	5060	msiexec.exe	98
PID 5060 wrote to memory of 4328	5060	msiexec.exe	98
PID 5060 wrote to memory of 4104	5060	msiexec.exe	99
PID 5060 wrote to memory of 4104	5060	msiexec.exe	99
PID 5060 wrote to memory of 4104	5060	msiexec.exe	99
PID 2512 wrote to memory of 2264	2512	firefox.exe	114
PID 2512 wrote to memory of 2264	2512	firefox.exe	114
PID 2512 wrote to memory of 2264	2512	firefox.exe	114
PID 2512 wrote to memory of 2264	2512	firefox.exe	114
PID 2512 wrote to memory of 2264	2512	firefox.exe	114
PID 2512 wrote to memory of 2264	2512	firefox.exe	114
PID 2512 wrote to memory of 2264	2512	firefox.exe	114
PID 2512 wrote to memory of 2264	2512	firefox.exe	114
PID 2512 wrote to memory of 2264	2512	firefox.exe	114
PID 2512 wrote to memory of 2264	2512	firefox.exe	114
PID 2512 wrote to memory of 2264	2512	firefox.exe	114
PID 2264 wrote to memory of 2272	2264	firefox.exe	115
PID 2264 wrote to memory of 2272	2264	firefox.exe	115
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116
PID 2264 wrote to memory of 3676	2264	firefox.exe	116

C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe
"C:\Users\Admin\AppData\Local\Temp\Muse_Hub.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\EXE_NETCORECHECK.EXE
  -N Microsoft.WindowsDesktop.App -v 6.0.9
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\netdesktopruntime.exe
  /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\Temp\{F2D3B2F8-D4BC-4CDA-89EF-CC3BB181649D}\.cr\netdesktopruntime.exe
    "C:\Windows\Temp\{F2D3B2F8-D4BC-4CDA-89EF-CC3BB181649D}\.cr\netdesktopruntime.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\netdesktopruntime.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Windows\Temp\{DF59881B-BE54-47F5-AD53-6F8E66FA5582}\.be\windowsdesktop-runtime-6.0.9-win-x64.exe
      "C:\Windows\Temp\{DF59881B-BE54-47F5-AD53-6F8E66FA5582}\.be\windowsdesktop-runtime-6.0.9-win-x64.exe" -q -burn.elevated BurnPipe.{87B21258-F2B7-48D9-B299-69D37346888F} {58B4B58A-E2FF-4B2F-BA3D-057F6EC02A9B} 3696
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3500

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 698F0A9F47AB73682739A733D9BA949A
  2⤵
  - Loads dropped DLL
  PID:1600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2501854DB37ABAC445D1352A9DC8BFAF
  2⤵
  - Loads dropped DLL
  PID:4916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 85DBD00DDF84695CFDD57D8712C22DE7
  2⤵
  - Loads dropped DLL
  PID:4328
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 61F8B1D2601F964389ACF41E804B29D2
  2⤵
  - Loads dropped DLL
  PID:4104

C:\Program Files\WindowsApps\Muse.MuseHub_1.0.2.800_x64__rb9pth70m6nz6\Muse.exe
"C:\Program Files\WindowsApps\Muse.MuseHub_1.0.2.800_x64__rb9pth70m6nz6\Muse.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4556
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4556 -s 5116
  2⤵
  - Program crash
  PID:4952

C:\Program Files\WindowsApps\Muse.MuseHub_1.0.2.800_x64__rb9pth70m6nz6\Muse.Service.exe
"C:\Program Files\WindowsApps\Muse.MuseHub_1.0.2.800_x64__rb9pth70m6nz6\Muse.Service.exe"
1⤵
- Drops file in System32 directory
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5052

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 4556 -ip 4556
1⤵
PID:5044

C:\Program Files\WindowsApps\Muse.MuseHub_1.0.2.800_x64__rb9pth70m6nz6\Muse.exe
"C:\Program Files\WindowsApps\Muse.MuseHub_1.0.2.800_x64__rb9pth70m6nz6\Muse.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4644
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4644 -s 5080
  2⤵
  - Program crash
  PID:1600

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 480 -p 4644 -ip 4644
1⤵
PID:3716

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.0.1229329191\920841194" -parentBuildID 20221007134813 -prefsHandle 1904 -prefMapHandle 1656 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e830e144-5f02-4de0-89dd-410ae82fa8ab} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 1980 1a7856d4458 gpu
    3⤵
    PID:2272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.1.2139827482\2029756992" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aca78b95-e274-46c2-94d1-8773892e81e1} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 2380 1a7854fa558 socket
    3⤵
    PID:3676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.2.1095817726\1046942204" -childID 1 -isForBrowser -prefsHandle 3040 -prefMapHandle 2920 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a635bb3a-676e-48f4-9a62-3291fffdbcb4} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 3028 1a7897f0c58 tab
    3⤵
    PID:4144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.3.55995074\1657968835" -childID 2 -isForBrowser -prefsHandle 3576 -prefMapHandle 3572 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74f4678d-602e-4bf8-9a18-230db9eed24c} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 3588 1a78a64ec58 tab
    3⤵
    PID:3680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.4.940587879\762860655" -childID 3 -isForBrowser -prefsHandle 4028 -prefMapHandle 4024 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e9736fc-fa7c-4191-ae8a-884075d71ee9} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 1704 1a7856d3858 tab
    3⤵
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.7.249463756\826949418" -childID 6 -isForBrowser -prefsHandle 5404 -prefMapHandle 5408 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63aa2909-3b12-4e0f-8af9-3a254370fee9} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 5396 1a78bbe1b58 tab
    3⤵
    PID:3880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.6.24841374\1765505112" -childID 5 -isForBrowser -prefsHandle 5212 -prefMapHandle 5216 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab58409f-b5bf-4f05-b7b2-4c3ca26c837d} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 5204 1a78bbe0c58 tab
    3⤵
    PID:568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.5.1345843120\1295250509" -childID 4 -isForBrowser -prefsHandle 5076 -prefMapHandle 5072 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38d5def0-fe1f-4337-bb5a-caf19909fcae} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 5084 1a78bbe0058 tab
    3⤵
    PID:1536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.9.692720732\558466482" -childID 8 -isForBrowser -prefsHandle 5904 -prefMapHandle 5908 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ee39a81-7a16-4d42-a590-3e499b9237aa} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 5896 1a78d3a1358 tab
    3⤵
    PID:2044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.8.1519788299\622309798" -childID 7 -isForBrowser -prefsHandle 5764 -prefMapHandle 2824 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5352d3ab-73f2-4519-b15c-7115854de9e0} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 5772 1a7859de858 tab
    3⤵
    PID:2168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.10.1228837183\1529981998" -childID 9 -isForBrowser -prefsHandle 9996 -prefMapHandle 10000 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65ae12d2-22ab-41b6-960e-4939db3fc0e6} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 9976 1a78e7b1458 tab
    3⤵
    PID:5836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.11.1981081575\1550517497" -childID 10 -isForBrowser -prefsHandle 9528 -prefMapHandle 9520 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcc7c00b-336a-40ea-94ad-4bb94afa0fc4} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 9672 1a78f5fc758 tab
    3⤵
    PID:2060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.12.472400249\1126248617" -childID 11 -isForBrowser -prefsHandle 9196 -prefMapHandle 9188 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46f61c43-ec89-4313-a52e-3d7a9eaa092f} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 9252 1a78f81ee58 tab
    3⤵
    PID:5560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.14.1319409506\1708529617" -childID 13 -isForBrowser -prefsHandle 8860 -prefMapHandle 8856 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {652725c1-1a30-4633-b17b-3fee253c7581} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 8868 1a78f927e58 tab
    3⤵
    PID:5588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.13.526787443\568260901" -childID 12 -isForBrowser -prefsHandle 9096 -prefMapHandle 9092 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccf1b24c-aecb-454a-bcea-8de88d3e29ed} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 9104 1a78f924258 tab
    3⤵
    PID:5568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.15.1803362606\773145164" -childID 14 -isForBrowser -prefsHandle 8480 -prefMapHandle 8488 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2af66ddb-740c-49a6-9db9-d81241328b5a} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 8412 1a78ffe0f58 tab
    3⤵
    PID:6116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.16.401918721\887847929" -childID 15 -isForBrowser -prefsHandle 8372 -prefMapHandle 8368 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e9834ee-63d3-4614-9c23-9951c077ce58} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 8284 1a7904fd658 tab
    3⤵
    PID:6056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.17.1605660193\1974334057" -childID 16 -isForBrowser -prefsHandle 8128 -prefMapHandle 8132 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f43d159-e21a-49e2-811d-d46d5f68c07a} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 8072 1a7904fbb58 tab
    3⤵
    PID:1272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.18.532898511\1535841690" -childID 17 -isForBrowser -prefsHandle 8156 -prefMapHandle 8164 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a6eca22-2e12-4c70-9ec3-dab91cde5764} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 8396 1a78fca6458 tab
    3⤵
    PID:5476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.19.1282489650\1229628255" -childID 18 -isForBrowser -prefsHandle 7784 -prefMapHandle 7780 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6394c909-4c87-4e23-8473-6c50e0ca04c6} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 7764 1a790845158 tab
    3⤵
    PID:5976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.22.1614706794\778062270" -childID 21 -isForBrowser -prefsHandle 7224 -prefMapHandle 7220 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3daf0f1-498d-4aee-b63f-8bfb2d8d86ec} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 7232 1a78fb86e58 tab
    3⤵
    PID:6748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.21.1749926959\1795109798" -childID 20 -isForBrowser -prefsHandle 7420 -prefMapHandle 7416 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee8ca478-e261-415c-8d73-995a98c6abcc} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 7428 1a78fb83258 tab
    3⤵
    PID:6740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.20.494416782\1505186613" -childID 19 -isForBrowser -prefsHandle 7552 -prefMapHandle 7560 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {744ef488-f182-42a3-9576-bdc18331c1c9} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 7584 1a78e892258 tab
    3⤵
    PID:6732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.23.1269830374\1131888913" -childID 22 -isForBrowser -prefsHandle 6896 -prefMapHandle 6876 -prefsLen 27136 -prefMapSize 232675 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {484eccf8-6ead-4357-99b1-b713b629ba72} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 3524 1a789f79058 tab
    3⤵
    PID:6620

C:\Program Files\WindowsApps\Muse.MuseHub_1.0.2.800_x64__rb9pth70m6nz6\Muse.exe
"C:\Program Files\WindowsApps\Muse.MuseHub_1.0.2.800_x64__rb9pth70m6nz6\Muse.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4008 -s 5036
  2⤵
  - Program crash
  PID:6592

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 532 -p 4008 -ip 4008
1⤵
PID:6264

C:\Program Files\WindowsApps\Muse.MuseHub_1.0.2.800_x64__rb9pth70m6nz6\Muse.exe
"C:\Program Files\WindowsApps\Muse.MuseHub_1.0.2.800_x64__rb9pth70m6nz6\Muse.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3840
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3840 -s 5044
  2⤵
  - Program crash
  PID:4988

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 3840 -ip 3840
1⤵
PID:5444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58445a.rbs

Filesize
55KB

MD5
017b8cbf7d3c245b696bf2922a5b3b51

SHA1
3abcf94ba1e42ef62f3f68a934102c9d6c02d60e

SHA256
90b9cf9640d248235f20cd0bc68b15baddf682d1ad6308d49f862622b15fe61d

SHA512
45f9ee6230bb453a8857043ea56f1b94d9569950ddde4fed0738ce573d418751b66edbe56c798dbb418cab39fc1783b4709636473a6b9ee69808a99f80d14805

Download Submit
C:\Config.Msi\e58445f.rbs

Filesize
8KB

MD5
58aa640993d3790ee36b4e1ad3a67682

SHA1
2a08bbfe96926ac7b8e7219b7eb965b962b089d4

SHA256
0c13f036cdcda275380d40ec5bfe4295d7a9e20b33b7f5968bbb998590f7587e

SHA512
a2a817cbf0b1b61185521a015c87cdd9db250cf1ae81ff670d813104bd71888cf06fcb084739dafbf839384cd1425b39849550b8c7936403def7491d19eb9c49

Download Submit
C:\Config.Msi\e584464.rbs

Filesize
10KB

MD5
68b069266003ae695c9f41bc530a9b7d

SHA1
0418ec01ee7af370c169f854635c26b84bd8e9a2

SHA256
b6f09a03889784aea1e61e5d7190ec8fcde1a09a6064fac61adbf1127300ffff

SHA512
2c077412a2b106fe9885231f7307e12331fd54e70cf2d0159ab7d8deec440edfeccc340200bc081b805ed9c4b9b68b6dcb8dbbcd44e43694090a5bd27a59256d

Download Submit
C:\Config.Msi\e584469.rbs

Filesize
86KB

MD5
3be79be56c635425635b3af189507837

SHA1
2b6ef8325a1c024fefa69e11eb4a8f74d8f8d3c6

SHA256
05cb8222f77dfd775f8f420c926aae368f8da60334d78cab2057684b001ce000

SHA512
84a32f089e5b55c321a2a782988b18f6f050c7bf0329addb689529e260a2767abc9c5eb3b2ec163e9043af3108e17816a58788d3f07338f74f402f34f49c3cf1

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\Program Files\dotnet\host\fxr\6.0.9\hostfxr.dll

Filesize
366KB

MD5
736d792752832677749f2ed372df3410

SHA1
80c2a1ecedf587a6df53bb34cbaca868d839a17a

SHA256
2d61a39cd4cc6b39ef3f9a92b9dd025bbda823f321a1d900165bf8f9cc3a2041

SHA512
4e708ded1d5e8070961cbcb0879ec026e7ca196b3e6b5cfe2df48af2ff1b5c2944d9c9ef73804fc018f2597cc560b4b7585315a96c7eed55a9a8baffe7632cd4

Download Submit
C:\Program Files\dotnet\host\fxr\6.0.9\hostfxr.dll

Filesize
366KB

MD5
736d792752832677749f2ed372df3410

SHA1
80c2a1ecedf587a6df53bb34cbaca868d839a17a

SHA256
2d61a39cd4cc6b39ef3f9a92b9dd025bbda823f321a1d900165bf8f9cc3a2041

SHA512
4e708ded1d5e8070961cbcb0879ec026e7ca196b3e6b5cfe2df48af2ff1b5c2944d9c9ef73804fc018f2597cc560b4b7585315a96c7eed55a9a8baffe7632cd4

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\Microsoft.NETCore.App.deps.json

Filesize
32KB

MD5
96486f8cbec677aa738cb168515e8866

SHA1
27f33bf8409ed2ffda20111b2668def461ddcaea

SHA256
9028e5745a1a0425d2ab3b3ef4888b855a4fa255c554f5ae9e5732ca0edc603f

SHA512
93fe943eff1af832c054757de8b1e441d7f9c335d677a441440f9ddde3d55bfff81b38f0fa17d202cb345d6ee61051c13b3fc9e1c595fbbf36cab38e434e209d

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\Microsoft.NETCore.App.runtimeconfig.json

Filesize
159B

MD5
3fbd84a952d4bab02e11fec7b2bbc90e

SHA1
e92de794f3c8d5a5a1a0b75318be9d5fb528d07d

SHA256
1b7aa545d9d3216979a9efe8d72967f6e559a9c6a22288d14444d6c5c4c15738

SHA512
c97c1da7ae94847d4edf11625dc5b5085838c3842a550310cca5c70ba54be907ff454ca1e0080ba451eacfc5954c3f778f8b4e26c0933e55c121c86c9a24400b

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Collections.Concurrent.dll

Filesize
241KB

MD5
0dec4021bdeae868539d6e45fc2e8f46

SHA1
2d408a6b563c8c1621e968ab0954a99ef46fef77

SHA256
5cbd8b145da27fe2f5e26a62d4d6ac21da676bffcdacfe3200ad56730a19a941

SHA512
e7081e7877bf95d6bb683b4f090ebfd00648000ae7c1639d86ed6b0253da58dad6897533bbf02864650ee4e10b1d887bf295f62b7198f630955d20379b4bd63e

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Collections.Concurrent.dll

Filesize
241KB

MD5
0dec4021bdeae868539d6e45fc2e8f46

SHA1
2d408a6b563c8c1621e968ab0954a99ef46fef77

SHA256
5cbd8b145da27fe2f5e26a62d4d6ac21da676bffcdacfe3200ad56730a19a941

SHA512
e7081e7877bf95d6bb683b4f090ebfd00648000ae7c1639d86ed6b0253da58dad6897533bbf02864650ee4e10b1d887bf295f62b7198f630955d20379b4bd63e

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Collections.dll

Filesize
258KB

MD5
d4c9232f2df4b59e4689ed8982952c65

SHA1
8b51c416ec9d532803fad75563d421cdde2a827e

SHA256
8fce90c3220d6f0cacf6f642e7b3cf6693b4bca6e6c4fa78f5a28692b7ce83f0

SHA512
e45b02e08c50aa8378af0935d395dfb3c829971ce1f95b99a15f5d142b78eec814700c3ab12b0c14731caa8c844bb95c703f743e65a5d5dcc5505b6e2d12ee97

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Collections.dll

Filesize
258KB

MD5
d4c9232f2df4b59e4689ed8982952c65

SHA1
8b51c416ec9d532803fad75563d421cdde2a827e

SHA256
8fce90c3220d6f0cacf6f642e7b3cf6693b4bca6e6c4fa78f5a28692b7ce83f0

SHA512
e45b02e08c50aa8378af0935d395dfb3c829971ce1f95b99a15f5d142b78eec814700c3ab12b0c14731caa8c844bb95c703f743e65a5d5dcc5505b6e2d12ee97

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.ComponentModel.dll

Filesize
18KB

MD5
55b02361835667925fdfcaccda562200

SHA1
6670b9e454b9d012fd6e189d21eba9a382c8fafc

SHA256
d05724c1dfac3df3312debec9af3a5be01ddf3660ab1a4a8f07c37e433c1d50d

SHA512
4ed9a27b28452ccff3619027a04e836f07952aeb239be38f700d83e861c040cbe663da0bb7225124229fbc33e7a6ff2e961b85389e9afb4145d8e2a557134b90

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.ComponentModel.dll

Filesize
18KB

MD5
55b02361835667925fdfcaccda562200

SHA1
6670b9e454b9d012fd6e189d21eba9a382c8fafc

SHA256
d05724c1dfac3df3312debec9af3a5be01ddf3660ab1a4a8f07c37e433c1d50d

SHA512
4ed9a27b28452ccff3619027a04e836f07952aeb239be38f700d83e861c040cbe663da0bb7225124229fbc33e7a6ff2e961b85389e9afb4145d8e2a557134b90

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Numerics.Vectors.dll

Filesize
15KB

MD5
21e2e2a8ca5a0a30fca2307013d945a9

SHA1
ee67cff04e826279ab31404c19a10f102a795ea5

SHA256
da3e1a33cb5b06821e5332bc060d4fa98f97119b7b5a757168dc549eb3d899ea

SHA512
6bb36b4240ba37b1a03ddbc7e452af2ba5f16f39a62e2b573b2177ab9b557cd4d15abc77c61ccadf05c2f303df6b38cacb4f9237d7063f76034c0739c119b6d9

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.ObjectModel.dll

Filesize
88KB

MD5
2d4d33dc8b9d74972ccdc764e360cc90

SHA1
ff9a90b3e57f155e1f8678f3c9776672bdfd0a20

SHA256
081652a984bef6bb5615e9e04b7ebe5443fec53e26bac7635ec618a949c86a32

SHA512
70828a22a3e834298f9d63c412699e2e49915f22f4b6b152023dcafc8db2fe5f4023a49dff9bfb3168f92104cde4586d9d74850ce77266890dfe7964b4ebb748

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.ObjectModel.dll

Filesize
88KB

MD5
2d4d33dc8b9d74972ccdc764e360cc90

SHA1
ff9a90b3e57f155e1f8678f3c9776672bdfd0a20

SHA256
081652a984bef6bb5615e9e04b7ebe5443fec53e26bac7635ec618a949c86a32

SHA512
70828a22a3e834298f9d63c412699e2e49915f22f4b6b152023dcafc8db2fe5f4023a49dff9bfb3168f92104cde4586d9d74850ce77266890dfe7964b4ebb748

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Private.CoreLib.dll

Filesize
10.1MB

MD5
d6cde27b5dec22a34c301764fee272c2

SHA1
5015357bdc0a5991576f015ad2b4185d31230f7f

SHA256
193eeed826cb685572979bd6e49930c7a8379212b22dc02fe82a0efb9b3edd1b

SHA512
430b9b1d226544ae385d3ac09c326a3e70508e0ff19ff1be7765c48d0ce321f65d09ddd072009ef762caee6e253a3da333771b97c94a4656ad273adcf2ee8ee3

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Private.CoreLib.dll

Filesize
10.1MB

MD5
d6cde27b5dec22a34c301764fee272c2

SHA1
5015357bdc0a5991576f015ad2b4185d31230f7f

SHA256
193eeed826cb685572979bd6e49930c7a8379212b22dc02fe82a0efb9b3edd1b

SHA512
430b9b1d226544ae385d3ac09c326a3e70508e0ff19ff1be7765c48d0ce321f65d09ddd072009ef762caee6e253a3da333771b97c94a4656ad273adcf2ee8ee3

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Private.Uri.dll

Filesize
246KB

MD5
258ee89910e7573906bfe3789ce1360a

SHA1
a2dcb6d58e2197a70d67e7e264f5066bdb79be41

SHA256
fceffe2546b1b41ccb8ba9cea5711e668a1b33dc07ac403830ce41200a7e54df

SHA512
1ab061627ab1be108e33d611afe8b192985924ffd477fc628718e4b2bf1ccad291df7164db9deb03972686bd18e606545e5a01338f39014480edd17be0b5aa59

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Private.Uri.dll

Filesize
246KB

MD5
258ee89910e7573906bfe3789ce1360a

SHA1
a2dcb6d58e2197a70d67e7e264f5066bdb79be41

SHA256
fceffe2546b1b41ccb8ba9cea5711e668a1b33dc07ac403830ce41200a7e54df

SHA512
1ab061627ab1be108e33d611afe8b192985924ffd477fc628718e4b2bf1ccad291df7164db9deb03972686bd18e606545e5a01338f39014480edd17be0b5aa59

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Runtime.CompilerServices.Unsafe.dll

Filesize
22KB

MD5
cd695d78208a4945006953ac29eab626

SHA1
fb90c6f21cc46190999241b15be30eac00197bbf

SHA256
d530be30e5427a16ab34a124acfcc00c223d4514e6fece433d898e172ea04928

SHA512
f9878925b25573a7391f017450110e7a3a74aaa5fdbc0745d1f3f9d6abbb507ffb4c4e593b64b9e60d3846ffe61b8b2de1ed2e5f9299036c63d62106a884641c

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Runtime.CompilerServices.Unsafe.dll

Filesize
22KB

MD5
cd695d78208a4945006953ac29eab626

SHA1
fb90c6f21cc46190999241b15be30eac00197bbf

SHA256
d530be30e5427a16ab34a124acfcc00c223d4514e6fece433d898e172ea04928

SHA512
f9878925b25573a7391f017450110e7a3a74aaa5fdbc0745d1f3f9d6abbb507ffb4c4e593b64b9e60d3846ffe61b8b2de1ed2e5f9299036c63d62106a884641c

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Runtime.InteropServices.dll

Filesize
50KB

MD5
66cca2eb08b7949bc99e7b0d13b2f351

SHA1
01b0863f4f90e4bb40d8d0f20a063eba01e396f5

SHA256
07c0115b617db7ea50565b635ffc7f0f64065bbd3854d1ba0453f55c6168206f

SHA512
50f40a4497a9727b67d9e5c15cc419194bf6ff9b5723672bb9ff0ff6a086fa9865ec5380c97ebae82fefbc37b4e2ae10c9d61fb922e9e031bfc9cd4c76841cb0

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Runtime.InteropServices.dll

Filesize
50KB

MD5
66cca2eb08b7949bc99e7b0d13b2f351

SHA1
01b0863f4f90e4bb40d8d0f20a063eba01e396f5

SHA256
07c0115b617db7ea50565b635ffc7f0f64065bbd3854d1ba0453f55c6168206f

SHA512
50f40a4497a9727b67d9e5c15cc419194bf6ff9b5723672bb9ff0ff6a086fa9865ec5380c97ebae82fefbc37b4e2ae10c9d61fb922e9e031bfc9cd4c76841cb0

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Runtime.dll

Filesize
41KB

MD5
04774e38da5e3336556456746b1135b2

SHA1
1613b99808608a151adf589fef3aac8773490cc7

SHA256
0c7b567893dc17efaf04115c11182f109218dc4fcc0413014cac9d47b52b70a5

SHA512
766968c7c6312efcdac1a981c4c6ad53e364344b1157acb57b8ed5e2c8dd6f5337d521b31536c767b9f7f8ce6478f234fe9e12b36a9d6abcab195d637bd290d8

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Threading.dll

Filesize
78KB

MD5
708f4fd8479d1469b102c6b6b4c7da3e

SHA1
85002fb49e9fba9f280ea8ea3f4bf8db02978b45

SHA256
8e0296ae10199b53e87a73355e0faa1eb91c289a7021be55443c8213f278af5f

SHA512
6a9dd794c2e4d5ba7ba6f962f92049aeec2f2bae25f19153e0a83873d90b93509738ca842c1efa4393da810f9f2e62436ac797cc606fa686da6df5e1764aaa91

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Threading.dll

Filesize
78KB

MD5
708f4fd8479d1469b102c6b6b4c7da3e

SHA1
85002fb49e9fba9f280ea8ea3f4bf8db02978b45

SHA256
8e0296ae10199b53e87a73355e0faa1eb91c289a7021be55443c8213f278af5f

SHA512
6a9dd794c2e4d5ba7ba6f962f92049aeec2f2bae25f19153e0a83873d90b93509738ca842c1efa4393da810f9f2e62436ac797cc606fa686da6df5e1764aaa91

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\clrjit.dll

Filesize
1.4MB

MD5
f012a265db26bc38c4573953b6555c25

SHA1
3454ce59fde398757470d0f1ac022b0fc7ca29b5

SHA256
ab935904c0810ea5f7c0b8dcf995186220aae933461a6d04c56150440ebb96b6

SHA512
977d8ae07a9ffb03166a91acbf5b92b1d7c8b8ec51bd55c665eaaab6d7173c95907d1f889ba30860478c08e7599e1991a842ee2517836a52af894002f18ee54e

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\clrjit.dll

Filesize
1.4MB

MD5
f012a265db26bc38c4573953b6555c25

SHA1
3454ce59fde398757470d0f1ac022b0fc7ca29b5

SHA256
ab935904c0810ea5f7c0b8dcf995186220aae933461a6d04c56150440ebb96b6

SHA512
977d8ae07a9ffb03166a91acbf5b92b1d7c8b8ec51bd55c665eaaab6d7173c95907d1f889ba30860478c08e7599e1991a842ee2517836a52af894002f18ee54e

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\coreclr.dll

Filesize
4.9MB

MD5
82d0e2bec26728b69f1c699a55161ed8

SHA1
3b7be85d404df3f73bd010c3b128a2daf99f1cf0

SHA256
e8d2b617904fc9e4c604103335001aee9439685ef4a3ab67e553383f8378687d

SHA512
06892d93fee44b2f785f3c6ad66ef4eec8b9e6451226e0f9366d8da2493cf9c735546b85ccc08c5d7c1aba41cee51734fe6cd10b377fc5715fcc5a444ecbcb5f

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\coreclr.dll

Filesize
4.9MB

MD5
82d0e2bec26728b69f1c699a55161ed8

SHA1
3b7be85d404df3f73bd010c3b128a2daf99f1cf0

SHA256
e8d2b617904fc9e4c604103335001aee9439685ef4a3ab67e553383f8378687d

SHA512
06892d93fee44b2f785f3c6ad66ef4eec8b9e6451226e0f9366d8da2493cf9c735546b85ccc08c5d7c1aba41cee51734fe6cd10b377fc5715fcc5a444ecbcb5f

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\hostpolicy.dll

Filesize
383KB

MD5
892679a90432d91a423749a26dd030cc

SHA1
fdc40d5e8ef4a20f6c3e4464682f1fd4630bdb19

SHA256
89e4e684529f0c069f429b31383f34da6d25e9ae08c80f38cad702dcce12f309

SHA512
8529adadec3a3de8e01a3b3a9df7c4efa0be938fe2a0077ff1e8d6d3a46233eae487a16edb0d9c4cd649a74d3693a98eb3223f9679438e8292d92aac4b514a15

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\hostpolicy.dll

Filesize
383KB

MD5
892679a90432d91a423749a26dd030cc

SHA1
fdc40d5e8ef4a20f6c3e4464682f1fd4630bdb19

SHA256
89e4e684529f0c069f429b31383f34da6d25e9ae08c80f38cad702dcce12f309

SHA512
8529adadec3a3de8e01a3b3a9df7c4efa0be938fe2a0077ff1e8d6d3a46233eae487a16edb0d9c4cd649a74d3693a98eb3223f9679438e8292d92aac4b514a15

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\mscorrc.dll

Filesize
143KB

MD5
ead0c03745c6dcf45b3e8de08d0d53ed

SHA1
4c42f72326d45e8a82b40fc8ceac72a422e72248

SHA256
f20610c0b223f3a8eeda7d1257648d7a1191626427783680cc5d0655d953385a

SHA512
465eab437bdde3cf73eef240cf43749f1c04f2d92692e861121129c1bc64ee47741fa12e229ff13f14d480f7f7415130732e5701ba3e46c61d6f3b4d34389160

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hw21aoqh.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
bcbfec4de29f54be31686f8865656748

SHA1
57b7ac19596b3430a01dda64105f2253a4c5f883

SHA256
2dffff2bccb95e64e796bdc92806ebdc6caca4bc4d2ead0b464a97b8c0f855ce

SHA512
90fc59fefcdcfc71fd62d881b0f9c02264326697d5996bf7424744f9cd90c8b830c86bda55e94f68411deea3cc183e0a461d6b514f87fc3493b132d9276ed41e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hw21aoqh.default-release\cache2\doomed\13675

Filesize
9KB

MD5
2fa43325d58e7d027f16421d4649cd9d

SHA1
d9d5c49fc510a21e6b88f7f03a9ed807b8c4ce9d

SHA256
10dc701893ee291eb4636c8b32caaeaa416e84fc588310d4ff059c4b09c17152

SHA512
3f440464c6d5fb0e04b3c5f2ad49759028b4580690597a59a411fdf37ccdca5c0b803a7dffb99ff1e1d1cda21fd7a104fa14bb1540e614e416907f4f876acc04

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hw21aoqh.default-release\cache2\doomed\16803

Filesize
113KB

MD5
7f9b3cf26f45303fabe7e1355bf0a503

SHA1
c37de4a8b254d86464700906da01b28a41a56629

SHA256
114038c564080719483aa7812e1ceb55d4adaa47a3ba59694feb0efcb5a27b00

SHA512
1cf181e307f5e7b3963b2cbabed34a9f8b20bcc2fb6deff45a3b7bbeaf21560fabd59e3fad9a528539ef0ec43f2301c74849e212f6a92ffe78cd0cd0f82687a2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hw21aoqh.default-release\cache2\doomed\19912

Filesize
10KB

MD5
e1b496c0eac245e9d5e49769f7d88a2a

SHA1
333d89f8ac1c06d00113239459079454f7aebf3e

SHA256
0d6a0ee877a943cc475dff339c4a29a043139cfbfb2d778bfdcb9fd4d566f0d3

SHA512
adc2dc8b698bbdd095ff42f73d99368ce26971703cc3010ed1c9d378df6cdd14b060db461321b0eac9c187b577c6677e9ad71ad66d8176a5a6e4d9b5bcdec963

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hw21aoqh.default-release\cache2\doomed\24311

Filesize
7KB

MD5
050ce2b19248a8e8b9b6ce8aed84ba75

SHA1
cbc89c637e8eef8278ae1c6f4af25977adff6c9a

SHA256
f267f75f58874aca910d12e0a694d621d50b62ab1b84bad84bfebefa4cab1972

SHA512
a6ec0cec7b033be436aa352c239d5c7da38bc5f46dbb6381a4284ba3086f3014bc489e2c7711f33c4897a65091ef532f833f0262fafb5ee9edf79fe3c68c9f56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.9_(x64)_20230822004820_000_dotnet_runtime_6.0.9_win_x64.msi.log

Filesize
2KB

MD5
1294eace0972fcaeeae86f2ebd8ee24a

SHA1
f6d4e99dd3724d62a7eb62388835a11e74120978

SHA256
c672735025ac0219f54f0fca6fcc10c54c24bd12fcd7410a8b7084a769697266

SHA512
e01d1a4cb2bf5baec7b359df9ee070f79a935534cfd5780e67439b7a30d2b2bb1dd612410553fd7a7bbbc376e9e5c1999801db2cc14c5f11fa679f996436d176

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.9_(x64)_20230822004820_001_dotnet_hostfxr_6.0.9_win_x64.msi.log

Filesize
2KB

MD5
78a321c014bb5474953f0b2912d90246

SHA1
0fc177b06bba13019294c61ee2d60a249209bc23

SHA256
a6d1fb97d3391f30423c31b3626d03e3c7fc9ecadb433e565d9237086b7238e5

SHA512
398bd6bcaae71b3da3c1008d783d3e8c3b659d672ffb73747224899cee88a641cecf479635320198b8784e0d14a357448e3e05ca096accde9041f0319ffa4721

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.9_(x64)_20230822004820_002_dotnet_host_6.0.9_win_x64.msi.log

Filesize
2KB

MD5
9abba35557454f6cf79a76a60dc072c7

SHA1
72ee88757a67f80084620ace774282fd22e5d167

SHA256
958dfc2aec438f8452fed97817bd84df31d4db2343a7339721c8548b755c750c

SHA512
ae88ea5ad920eb89d07c5262a6cad55e606859a15c4c46bdfcceddd456f985546b46968ba7dde98d02ec9fa0a30cf5d6666b5ca35794fcf1b41d1fc406021d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.9_(x64)_20230822004820_003_windowsdesktop_runtime_6.0.9_win_x64.msi.log

Filesize
3KB

MD5
94d0724453131713b65fca8ce3955e4b

SHA1
cfccade524462699351d29c39c9a33e00978e5e3

SHA256
fdb4bd51629c1982cb75b1790c04a155eab8cf81e79ab0c4442b52fbd0d5547b

SHA512
da576278c5d7e4c1603074483c2f968474bd5a1331eee7e1a1a15014421201628c8e0d87dbae7dddb348ee8c2f568d1bacb6755a499defb5ddcd53459c5dbaf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\EXE_NETCORECHECK.EXE

Filesize
142KB

MD5
3dd50757e38eed3ac598debec6936915

SHA1
ac54862b4de18850d111fe7e08a075f0e812cc89

SHA256
8d8f90ca3adc53d7862e82c72522674d4fee14d2b08566d378e46371d5db7f2a

SHA512
ff84fddf871f660b2b25e7f3b93ab01140d787a1fb167454cadad4e0eec25fd0789afee6bec3dea09de34343de7d3c4030e1282acddcda02e9f40784eb8aea88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\EXE_NETCORECHECK.EXE

Filesize
142KB

MD5
3dd50757e38eed3ac598debec6936915

SHA1
ac54862b4de18850d111fe7e08a075f0e812cc89

SHA256
8d8f90ca3adc53d7862e82c72522674d4fee14d2b08566d378e46371d5db7f2a

SHA512
ff84fddf871f660b2b25e7f3b93ab01140d787a1fb167454cadad4e0eec25fd0789afee6bec3dea09de34343de7d3c4030e1282acddcda02e9f40784eb8aea88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\netdesktopruntime.exe

Filesize
54.7MB

MD5
0d62098b1ddc2097c3b4055db6e3e314

SHA1
71dd37fb8a5df79f5eee8983d472683f5a01f73c

SHA256
cdc3ecbb47ad9e4e6c7c34435fcf04fed678f16de2dfdc088ae1f32004982d92

SHA512
28cc3d88e6fa54938177937118260e9129967246e30d2140fdb7a4a8e9e393efec689d6282edb6982853fd3ba27701239a8d1ee81a2dd28c93b186f1a3cb1b55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\netdesktopruntime.exe

Filesize
54.7MB

MD5
0d62098b1ddc2097c3b4055db6e3e314

SHA1
71dd37fb8a5df79f5eee8983d472683f5a01f73c

SHA256
cdc3ecbb47ad9e4e6c7c34435fcf04fed678f16de2dfdc088ae1f32004982d92

SHA512
28cc3d88e6fa54938177937118260e9129967246e30d2140fdb7a4a8e9e393efec689d6282edb6982853fd3ba27701239a8d1ee81a2dd28c93b186f1a3cb1b55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Muse Installer Temp\netdesktopruntime.exe

Filesize
54.7MB

MD5
0d62098b1ddc2097c3b4055db6e3e314

SHA1
71dd37fb8a5df79f5eee8983d472683f5a01f73c

SHA256
cdc3ecbb47ad9e4e6c7c34435fcf04fed678f16de2dfdc088ae1f32004982d92

SHA512
28cc3d88e6fa54938177937118260e9129967246e30d2140fdb7a4a8e9e393efec689d6282edb6982853fd3ba27701239a8d1ee81a2dd28c93b186f1a3cb1b55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\prefs-1.js

Filesize
7KB

MD5
4fcc6f63f85d4ea59bebdc7423e2aeb4

SHA1
68a4450e878bd29043eba312ae2980aef2b58d0c

SHA256
b887a6312d830f76e439346e99b23c8b00269d3f09a227883f5533314bd7501d

SHA512
d13199ba0957dbdd141ef7dd758a1f3d30e38ec4bba55c598fceaafb7ebdf4de5c7e354490b3f9a9525a433f4a72c1bcb05dc7eb8fa98835d7825f3c24144365

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\prefs-1.js

Filesize
6KB

MD5
25b5cb0f62357c1eeaf6c6452a5cc5f6

SHA1
17dd99c85653e871fab3fb534b17b507a9f7f6cb

SHA256
74dfac839d13ebe01b9961ac14b08b3a70b5ea6b22a28ce6771d7858a4ccb2f9

SHA512
e56298b735a508af7a180b54f16d12c3f408c6b34c42a86b8a195fcc78fa7542959e95b9db576d7420d5f511bce8fae342a485d2c77f77748b1106732c671c66

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\prefs.js

Filesize
6KB

MD5
ae3eb7060ee1b64beb1691b40922e623

SHA1
0996bee35515d2b40de8ddaddb63c2ae031ad118

SHA256
eecae04a85a35f768d50a96f0db17c2e89996a3b3d249b4ebe2245acfb5166fc

SHA512
9669751ddac9d3fed8b590d61ea152a5736e8a4b8e0a4d708e1f5b237ff0aa0b6f40430ae1d00a591e9c8d09d67ed26383eb0ee4d953743e44df782b219db265

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
323b169bacc9cee50247d3e2171a5801

SHA1
557836fef7469baa98062aa86dd0a6df91be56b4

SHA256
12226167bedb00e4dae4dfcd6e4cf3a012a9b581f17215ac0eab6ef56b4ebf6d

SHA512
8fc04d8d2eb1e196f4b3ae9a7e2cd09a926314ba95a81f22a97a22ccfd4ed81d9fe4e1bc3de2d374f5316a39e0070730699f0cf42677f13bc3685918de4b56e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
61dd7c9bb268ef5ccb2c9d069a12ab05

SHA1
72a4b0b4c518c358f80305cf70590505f79ef076

SHA256
888a5fa323e86e3cfe8819c698995a9042f033b3308a814dc9bc641a897d4c0e

SHA512
471a0bd541ff60c67e1d2390e9af677c9fc312273a44b4f1211e5c7ff86283941cc9918f3118dbe4a92e87065489f6bec1abf7d8397bcf53a873b676ef8a43cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
957284450bb2cae8af91e22f679e4e7b

SHA1
b44c55514da43da884a095a07dad010ed63321be

SHA256
8e224c768444da7e60cdde7664f1b478e1ea143b684a864f6fd15af4762b0ba7

SHA512
e27b175e2a0028fb4ac21bb9af1fbe8010ba12533d7238eae27da3051835e5aaa6b3ceb712c7710360ac5c6cad3ef74d8e78e83a1019be8488572976b400d532

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
e981c122fc8cb512729ef5b395693324

SHA1
c0ac63935d5e7d8f9cd05ae88983e4c8e658312a

SHA256
9cd35d30f1b1ab3c54a5b5ce605c419fd2d98d956e4696909157ed278429d75a

SHA512
84ee0eb218ab3df792cd326fa91d93acd283aa968e1496f1dc6d3e25e8516fbdc740f1432c9d2991ca2c286660e9bb365aaf9650158742de48af3e95114823da

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
f3fd35baf88bd9e6d109cc1d80a3bd83

SHA1
6b4592e3553f6291a294e83af24064e9956c0d7c

SHA256
a8a39f9e2d9df4512b19a97776df7b4a38e2d8f17777f15bb9b829af283810c7

SHA512
f8d26feabb62cc5731470fab2820d4d08763514c7af21fdb956044cfb3fd66f6115129bf4776e5f8bcc089c295ed92460e18a088abbb5ffc041b669e72c23734

Download Submit
C:\Windows\Installer\MSI48BC.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI48BC.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5800.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5800.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5FB2.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5FB2.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI5FB2.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8C71.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8C71.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI9E25.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI9E25.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIA413.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIA413.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIA6F2.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIA6F2.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIBA6D.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIBA6D.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\e58445b.msi

Filesize
25.7MB

MD5
1f7bed49d2624871cf21edf8b12b7566

SHA1
4b777b92b2b59694684afb8ef09db5c71d58dc58

SHA256
97a51823412a43bbc732ee55a599a1d5549b4121bb1064a63a9b8568208c7fb0

SHA512
1f29b2e7a0b028083b56ed75942a347f861220e0c73f711e7c731b4c8e8897c89ab1618e87a1532d10b6300b27beca04826bb47ac20ac316f522e7de7fcdc0ae

Download Submit
C:\Windows\Installer\e58445c.msi

Filesize
804KB

MD5
5a3188e6b652dd98a36a6f767d2e63ca

SHA1
0b4bda83f6c96b517dab0eaaf6dcb85dcbaa9e00

SHA256
08f547fb8e9aa111c1d2d47b1a901580de2be768991c9abb6e2b3e70bc1c0a65

SHA512
9b5f46c0a99d630af3a68ca102f5d47d23bb6065254186b7c3ea6bdd324e0559beb1c5005371c69d105e360cb888566ba5e33c60074661585803e7a748cb1b25

Download Submit
C:\Windows\Installer\e584466.msi

Filesize
28.6MB

MD5
f531da1a719bd1fc02e56e91d4c337cf

SHA1
caebcadcdf115651c22e19dda567f7b5bc1f8a7f

SHA256
bb9921ae0b0ee43c1f4e78cf68ef1ad95898579ed5eb62609aa7e4b9f91891ff

SHA512
60f43dc236a6a4b04824b5d81a931a5947283093d144171eb3fdd6044e9fcd0cfe60b5b93fd52cd22ed3cb4c3f896e71117a6062a7edc863bb1a03f0e83dae58

Download Submit
C:\Windows\Temp\{DF59881B-BE54-47F5-AD53-6F8E66FA5582}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{DF59881B-BE54-47F5-AD53-6F8E66FA5582}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{DF59881B-BE54-47F5-AD53-6F8E66FA5582}\.be\windowsdesktop-runtime-6.0.9-win-x64.exe

Filesize
610KB

MD5
a34f111a49fec320a3305c79f1f2b538

SHA1
916524a5488bfaa8319ef500721160ae09af30d9

SHA256
f91fcf65336f68b91f6aa7b4328e1bd4e0bd5cbe9596561d1d9cf59cf3c14f3f

SHA512
3670fb65f1a7991a4e69b4b5fe902ced7dd4370e643dec65a65a6694cd5cae8db1176ab308c8dc2017637e36844fb6cdec3dadfc8b503d3fb73062598eb6a721

Download Submit
C:\Windows\Temp\{DF59881B-BE54-47F5-AD53-6F8E66FA5582}\.be\windowsdesktop-runtime-6.0.9-win-x64.exe

Filesize
610KB

MD5
a34f111a49fec320a3305c79f1f2b538

SHA1
916524a5488bfaa8319ef500721160ae09af30d9

SHA256
f91fcf65336f68b91f6aa7b4328e1bd4e0bd5cbe9596561d1d9cf59cf3c14f3f

SHA512
3670fb65f1a7991a4e69b4b5fe902ced7dd4370e643dec65a65a6694cd5cae8db1176ab308c8dc2017637e36844fb6cdec3dadfc8b503d3fb73062598eb6a721

Download Submit
C:\Windows\Temp\{DF59881B-BE54-47F5-AD53-6F8E66FA5582}\.be\windowsdesktop-runtime-6.0.9-win-x64.exe

Filesize
610KB

MD5
a34f111a49fec320a3305c79f1f2b538

SHA1
916524a5488bfaa8319ef500721160ae09af30d9

SHA256
f91fcf65336f68b91f6aa7b4328e1bd4e0bd5cbe9596561d1d9cf59cf3c14f3f

SHA512
3670fb65f1a7991a4e69b4b5fe902ced7dd4370e643dec65a65a6694cd5cae8db1176ab308c8dc2017637e36844fb6cdec3dadfc8b503d3fb73062598eb6a721

Download Submit
C:\Windows\Temp\{DF59881B-BE54-47F5-AD53-6F8E66FA5582}\dotnet_host_6.0.9_win_x64.msi

Filesize
736KB

MD5
e5f80f960e2abd43d482a790a2959a9a

SHA1
32652cffdc38ae6db0962c7d57cf4dfa601af35b

SHA256
ab5bf859c7a0ea849d91130e07b3eac67d17cd53b04f3834f687c138cf38a1d1

SHA512
d4a2ddc51ff58d582be6bd04e0afd16dc3aa99fa56e32b74f3f21663168f1f5950b609db66de0257ddccc186c812c327b35159a47587c856cf22a1928c943c56

Download Submit
C:\Windows\Temp\{DF59881B-BE54-47F5-AD53-6F8E66FA5582}\dotnet_hostfxr_6.0.9_win_x64.msi

Filesize
804KB

MD5
5a3188e6b652dd98a36a6f767d2e63ca

SHA1
0b4bda83f6c96b517dab0eaaf6dcb85dcbaa9e00

SHA256
08f547fb8e9aa111c1d2d47b1a901580de2be768991c9abb6e2b3e70bc1c0a65

SHA512
9b5f46c0a99d630af3a68ca102f5d47d23bb6065254186b7c3ea6bdd324e0559beb1c5005371c69d105e360cb888566ba5e33c60074661585803e7a748cb1b25

Download Submit
C:\Windows\Temp\{DF59881B-BE54-47F5-AD53-6F8E66FA5582}\dotnet_runtime_6.0.9_win_x64.msi

Filesize
25.7MB

MD5
1f7bed49d2624871cf21edf8b12b7566

SHA1
4b777b92b2b59694684afb8ef09db5c71d58dc58

SHA256
97a51823412a43bbc732ee55a599a1d5549b4121bb1064a63a9b8568208c7fb0

SHA512
1f29b2e7a0b028083b56ed75942a347f861220e0c73f711e7c731b4c8e8897c89ab1618e87a1532d10b6300b27beca04826bb47ac20ac316f522e7de7fcdc0ae

Download Submit
C:\Windows\Temp\{DF59881B-BE54-47F5-AD53-6F8E66FA5582}\windowsdesktop_runtime_6.0.9_win_x64.msi

Filesize
28.6MB

MD5
f531da1a719bd1fc02e56e91d4c337cf

SHA1
caebcadcdf115651c22e19dda567f7b5bc1f8a7f

SHA256
bb9921ae0b0ee43c1f4e78cf68ef1ad95898579ed5eb62609aa7e4b9f91891ff

SHA512
60f43dc236a6a4b04824b5d81a931a5947283093d144171eb3fdd6044e9fcd0cfe60b5b93fd52cd22ed3cb4c3f896e71117a6062a7edc863bb1a03f0e83dae58

Download Submit
C:\Windows\Temp\{F2D3B2F8-D4BC-4CDA-89EF-CC3BB181649D}\.cr\netdesktopruntime.exe

Filesize
610KB

MD5
a34f111a49fec320a3305c79f1f2b538

SHA1
916524a5488bfaa8319ef500721160ae09af30d9

SHA256
f91fcf65336f68b91f6aa7b4328e1bd4e0bd5cbe9596561d1d9cf59cf3c14f3f

SHA512
3670fb65f1a7991a4e69b4b5fe902ced7dd4370e643dec65a65a6694cd5cae8db1176ab308c8dc2017637e36844fb6cdec3dadfc8b503d3fb73062598eb6a721

Download Submit
C:\Windows\Temp\{F2D3B2F8-D4BC-4CDA-89EF-CC3BB181649D}\.cr\netdesktopruntime.exe

Filesize
610KB

MD5
a34f111a49fec320a3305c79f1f2b538

SHA1
916524a5488bfaa8319ef500721160ae09af30d9

SHA256
f91fcf65336f68b91f6aa7b4328e1bd4e0bd5cbe9596561d1d9cf59cf3c14f3f

SHA512
3670fb65f1a7991a4e69b4b5fe902ced7dd4370e643dec65a65a6694cd5cae8db1176ab308c8dc2017637e36844fb6cdec3dadfc8b503d3fb73062598eb6a721

Download Submit
memory/3840-1567-0x00007FFDA89F0000-0x00007FFDA8EEE000-memory.dmp

Filesize
5.0MB

Download
memory/3840-1572-0x00007FFDA89F0000-0x00007FFDA8EEE000-memory.dmp

Filesize
5.0MB

Download
memory/4008-1545-0x00007FFDA89F0000-0x00007FFDA8EEE000-memory.dmp

Filesize
5.0MB

Download
memory/4008-1551-0x00007FFDA89F0000-0x00007FFDA8EEE000-memory.dmp

Filesize
5.0MB

Download
memory/4556-990-0x00007FFDA89F0000-0x00007FFDA8EEE000-memory.dmp

Filesize
5.0MB

Download
memory/4556-959-0x00007FFDA89F0000-0x00007FFDA8EEE000-memory.dmp

Filesize
5.0MB

Download
memory/4644-995-0x00007FFDA89F0000-0x00007FFDA8EEE000-memory.dmp

Filesize
5.0MB

Download
memory/4644-1004-0x00007FFDA89F0000-0x00007FFDA8EEE000-memory.dmp

Filesize
5.0MB

Download
memory/5052-968-0x00007FFDA89F0000-0x00007FFDA8EEE000-memory.dmp

Filesize
5.0MB

Download
memory/5052-993-0x00007FFDA89F0000-0x00007FFDA8EEE000-memory.dmp

Filesize
5.0MB

Download