423ecb6f566708e142c7be0cbc1cb7475eb1f6c017c00799592a0a5a124ff13e

Analysis

max time kernel
295s
max time network
307s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2023, 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NovaInstaller.exe
Size

152.4MB
MD5

b22a99d3bcaec970a0ff099b095053fc
SHA1

8f3ddffd78e901182382cd56994fab1e85171359
SHA256

423ecb6f566708e142c7be0cbc1cb7475eb1f6c017c00799592a0a5a124ff13e
SHA512

745b56187b4abf7fbf92cca79f85c436600a83caef7a88d9fa4d7870a425ac111e64d2920357d16018e1bdfb36197b155767a9095912367d2b8e1e2b7909188e
SSDEEP

786432:zpj24RRx7jChNQNt/ZYLy/pGyjOy5l7y953zQ3TtLwSTRpf4P1wT1XKTTmBEA/rI:zN2ExfWNQNt/ZL3+jRuBQ

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
2916	windowsdesktop-runtime-6.0.15-win-x64.exe
2216	windowsdesktop-runtime-6.0.15-win-x64.exe
2056	windowsdesktop-runtime-6.0.21-win-x64.exe
2420	vc_redist.x64.exe
1628	vc_redist.x64.exe
224	VC_redist.x64.exe
4484	dotnet-sdk-6.0.405-win-x64.exe
972	dotnet-sdk-6.0.405-win-x64.exe
2468	dotnet-sdk-6.0.413-win-x86.exe

Loads dropped DLL 26 IoCs

pid	Process
1116	NovaInstaller.exe
1116	NovaInstaller.exe
1116	NovaInstaller.exe
2216	windowsdesktop-runtime-6.0.15-win-x64.exe
4664	MsiExec.exe
4664	MsiExec.exe
1360	MsiExec.exe
1360	MsiExec.exe
2092	MsiExec.exe
2092	MsiExec.exe
4504	MsiExec.exe
4504	MsiExec.exe
1628	vc_redist.x64.exe
3136	VC_redist.x64.exe
972	dotnet-sdk-6.0.405-win-x64.exe
3044	MsiExec.exe
2352	MsiExec.exe
2948	MsiExec.exe
3160	MsiExec.exe
4108	MsiExec.exe
3188	MsiExec.exe
4380	MsiExec.exe
680	MsiExec.exe
392	MsiExec.exe
1648	MsiExec.exe
3232	MsiExec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0f39db03-9030-48f3-82ef-5384bed81d85} = "\"C:\\ProgramData\\Package Cache\\{0f39db03-9030-48f3-82ef-5384bed81d85}\\windowsdesktop-runtime-6.0.21-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{8bdfe669-9705-4184-9368-db9ce581e0e7} = "\"C:\\ProgramData\\Package Cache\\{8bdfe669-9705-4184-9368-db9ce581e0e7}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{901a4233-9860-4dd0-bb2d-0d86482fc5bd} = "\"C:\\ProgramData\\Package Cache\\{901a4233-9860-4dd0-bb2d-0d86482fc5bd}\\dotnet-sdk-6.0.413-win-x86.exe\" /burn.runonce"	dotnet-sdk-6.0.413-win-x86.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pt-BR\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\tr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.Compression.Native.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Configuration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-console-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Threading.xml	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Linq.Expressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.WindowsDesktop.App.Ref\6.0.21\ref\net6.0\PresentationFramework.Aero2.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.21\ref\net6.0\Microsoft.Extensions.Configuration.Binder.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\LICENSE.txt	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\analyzers\dotnet\cs\zh-Hans\System.Text.Json.SourceGeneration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\de\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Reflection.DispatchProxy.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\PresentationNative_cor3.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\es\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.21\ref\net6.0\Microsoft.AspNetCore.HttpLogging.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-errorhandling-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\PresentationFramework-SystemData.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.21\ref\net6.0\Microsoft.AspNetCore.Mvc.TagHelpers.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.21\ref\net6.0\Microsoft.Extensions.Options.DataAnnotations.xml	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\UIAutomationClientSideProviders.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pl\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-crt-filesystem-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\analyzers\dotnet\cs\pt-BR\System.Text.Json.SourceGeneration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Security.Claims.xml	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\de\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\tr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.WindowsDesktop.App.Ref\6.0.21\analyzers\dotnet\pt-BR\System.Windows.Forms.Analyzers.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ru\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Security.Cryptography.Cng.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Host.win-x64\6.0.21\runtimes\win-x64\native\libnethost.lib	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\WindowsBase.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Host.win-arm64\6.0.21\runtimes\win-arm64\native\coreclr_delegates.h	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.21\ref\net6.0\Microsoft.AspNetCore.Components.Forms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hans\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\analyzers\dotnet\cs\pl\System.Text.Json.SourceGeneration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\analyzers\dotnet\cs\ru\System.Text.Json.SourceGeneration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\NETStandard.Library.Ref\2.1.0\ref\netstandard2.1\System.Diagnostics.FileVersionInfo.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.21\ref\net6.0\Microsoft.AspNetCore.Cors.xml	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hans\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\de\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.WindowsDesktop.App.Ref\6.0.21\ref\net6.0\System.Configuration.ConfigurationManager.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.AspNetCore.App.Ref\6.0.21\ref\net6.0\Microsoft.AspNetCore.Mvc.RazorPages.xml	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\NETStandard.Library.Ref\2.1.0\ref\netstandard2.1\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Runtime.CompilerServices.VisualC.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\es\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-file-l2-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.MemoryMappedFiles.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e58669f.msi	msiexec.exe
File created	C:\Windows\Installer\e5866a9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5584.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{41F24AC3-858C-4543-9744-6D238471CC6C}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7309.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58669a.msi	msiexec.exe
File created	C:\Windows\Installer\e58672c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9089.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F56.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B8ED272B-5F2D-4FF5-A7CA-C73552D7FB0F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6024.tmp	msiexec.exe
File created	C:\Windows\Installer\e586695.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D16.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14C0.tmp	msiexec.exe
File created	C:\Windows\Installer\e586722.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE80F.tmp	msiexec.exe
File created	C:\Windows\Installer\e586708.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e586736.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC84.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A2B3C614-4907-4D23-A698-FAD5C4CBABCC}	msiexec.exe
File created	C:\Windows\Installer\e58673b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5866bc.msi	msiexec.exe
File created	C:\Windows\Installer\e5866db.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9C95D5DB-290E-4ACF-BC6A-25809D88D002}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B12.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5866ff.msi	msiexec.exe
File created	C:\Windows\Installer\e586718.msi	msiexec.exe
File created	C:\Windows\Installer\e58671c.msi	msiexec.exe
File created	C:\Windows\Installer\e58672b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e586731.msi	msiexec.exe
File created	C:\Windows\Installer\e586717.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B7F00346-0342-42E8-9BD2-0EA9867A6064}	msiexec.exe
File created	C:\Windows\Installer\e58671d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C3B.tmp	msiexec.exe
File created	C:\Windows\Installer\e5866ff.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3994.tmp	msiexec.exe
File created	C:\Windows\Installer\e586699.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5866d7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI52C4.tmp	msiexec.exe
File created	C:\Windows\Installer\e5866ea.msi	msiexec.exe
File created	C:\Windows\Installer\e5866eb.msi	msiexec.exe
File created	C:\Windows\Installer\e586731.msi	msiexec.exe
File created	C:\Windows\Installer\e586736.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58673b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58671d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3359.tmp	msiexec.exe
File created	C:\Windows\Installer\e5866a8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI76DA.tmp	msiexec.exe
File created	C:\Windows\Installer\e5866e6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5866fa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1F7.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1C01505B-88E4-3B6E-9B58-19B566A0EA8E}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1B5E440D-23FB-4AC3-89F6-8C7C2E03D774}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E09.tmp	msiexec.exe
File created	C:\Windows\Installer\e5866a3.msi	msiexec.exe
File created	C:\Windows\Installer\e5866bb.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EF4A37DD-21FE-43E9-89D1-1C699CC197AC}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5866e6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI86AC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A3E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3EE4.tmp	msiexec.exe
File created	C:\Windows\Installer\e586727.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 59 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\38	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\37	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\36	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\39	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3CA42F14C85834547944D6324817CCC6\F_DependencyProvider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD73A4FEEF129E34981DC196C91C79CA\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D75888F3F1051067D02D00B11BF2E2B0\002BA525AC3991642AA78ED27092AEE5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8361F15F9659BD047857A47AECF64DF1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F53FF62BBDAF9C479AD9721D08BE06C\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\NetCore_Templates_6.0_24.7.59894_x86	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B50510C14E88E6B3B985915B660AAEE8\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.NET.Sdk.Maui,6.0.300,x86\Version = "24.78.0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\Version = "811072667"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B272DE8BD2F55FF47AAC7C53257DBFF0\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{B8ED272B-5F2D-4FF5-A7CA-C73552D7FB0F}v48.87.64667\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\416C3B2A709432D46A89AF5D4CBCBACC\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A73DD4971C0B96344843400990C2E6E6\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0879C748FF241264ABE1020CDC77F90F\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\307514C3C04491841B33B644A2610D7C\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{3C415703-440C-4819-B133-6B442A16D0C7}v48.87.64667\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D044E5B1BF323CA4986FC8C7E2307D47\ProductName = "Microsoft.NET.Sdk.macOS.Manifest-6.0.300"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3CA42F14C85834547944D6324817CCC6\SourceList\PackageName = "Microsoft.NET.Sdk.Maui.Manifest-6.0.300.6.0.312-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8361F15F9659BD047857A47AECF64DF1\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8361F15F9659BD047857A47AECF64DF1\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0687864FB1C83BD49BD993E19973B117\SourceList\PackageName = "windowsdesktop-targeting-pack-6.0.21-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\DisplayName = "Microsoft .NET Host - 6.0.21 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\307514C3C04491841B33B644A2610D7C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D044E5B1BF323CA4986FC8C7E2307D47\F_PackageContent	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.87.64723_x86\Dependents\{901a4233-9860-4dd0-bb2d-0d86482fc5bd}	dotnet-sdk-6.0.413-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1CA5A49760BB6094EB1B1D7044B76635\PackageCode = "1D28F34496606544995B130F625071CA"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\416C3B2A709432D46A89AF5D4CBCBACC\Version = "2109711584"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\64300F7B24308E24B92DE09A68A70646\ProductName = "Microsoft.NET.Sdk.iOS.Manifest-6.0.300"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8361F15F9659BD047857A47AECF64DF1\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13E50C477853C52439243293464C6257\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1CA5A49760BB6094EB1B1D7044B76635\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B272DE8BD2F55FF47AAC7C53257DBFF0\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\416C3B2A709432D46A89AF5D4CBCBACC\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E2F8F9A4A3D09D489006F9839E2EC98\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E29CE2D8309552B4496081B2E8AF38F4\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64\Dependents	windowsdesktop-runtime-6.0.21-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\094F9C7997352096B7082D27C35AD959	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.NET.Sdk.MacCatalyst,6.0.300,x86\Dependents	dotnet-sdk-6.0.413-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D044E5B1BF323CA4986FC8C7E2307D47\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E2F8F9A4A3D09D489006F9839E2EC98\ProductName = "Microsoft .NET Host - 6.0.21 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\78FE739DD11F877479C37BE171F8590D\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F53FF62BBDAF9C479AD9721D08BE06C\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\ProductName = "Microsoft Windows Desktop Runtime - 6.0.21 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9F1C0EADB08590B65E92CD14FF703363	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B50510C14E88E6B3B985915B660AAEE8\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0879C748FF241264ABE1020CDC77F90F	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\002BA525AC3991642AA78ED27092AEE5\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1CA5A49760BB6094EB1B1D7044B76635\SourceList\PackageName = "dotnet-60templates-6.0.413-servicing.23367.26-win-x86.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3792749D1323A184990A3A9429451183\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\NetCore_Templates_6.0_24.7.59894_x86\Version = "24.7.59894"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\527B4FA944956476D4A7C20451951DD2\78FE739DD11F877479C37BE171F8590D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D044E5B1BF323CA4986FC8C7E2307D47\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\416C3B2A709432D46A89AF5D4CBCBACC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.87.64667_x86\Dependents\{901a4233-9860-4dd0-bb2d-0d86482fc5bd}	dotnet-sdk-6.0.413-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\Version = "48.87.64667"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe
2820	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	NovaInstaller.exe
Token: SeShutdownPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSecurityPrivilege	2820	msiexec.exe
Token: SeCreateTokenPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeLockMemoryPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeMachineAccountPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeTcbPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSecurityPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeTakeOwnershipPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeLoadDriverPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemProfilePrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemtimePrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeProfSingleProcessPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncBasePriorityPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreatePagefilePrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreatePermanentPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeBackupPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRestorePrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeShutdownPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeDebugPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeAuditPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemEnvironmentPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeChangeNotifyPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRemoteShutdownPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeUndockPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSyncAgentPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeEnableDelegationPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeManageVolumePrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeImpersonatePrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreateGlobalPrivilege	2056	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2916	1116	NovaInstaller.exe	90
PID 1116 wrote to memory of 2916	1116	NovaInstaller.exe	90
PID 1116 wrote to memory of 2916	1116	NovaInstaller.exe	90
PID 2916 wrote to memory of 2216	2916	windowsdesktop-runtime-6.0.15-win-x64.exe	92
PID 2916 wrote to memory of 2216	2916	windowsdesktop-runtime-6.0.15-win-x64.exe	92
PID 2916 wrote to memory of 2216	2916	windowsdesktop-runtime-6.0.15-win-x64.exe	92
PID 2216 wrote to memory of 2056	2216	windowsdesktop-runtime-6.0.15-win-x64.exe	93
PID 2216 wrote to memory of 2056	2216	windowsdesktop-runtime-6.0.15-win-x64.exe	93
PID 2216 wrote to memory of 2056	2216	windowsdesktop-runtime-6.0.15-win-x64.exe	93
PID 2820 wrote to memory of 4664	2820	msiexec.exe	96
PID 2820 wrote to memory of 4664	2820	msiexec.exe	96
PID 2820 wrote to memory of 4664	2820	msiexec.exe	96
PID 2820 wrote to memory of 1360	2820	msiexec.exe	97
PID 2820 wrote to memory of 1360	2820	msiexec.exe	97
PID 2820 wrote to memory of 1360	2820	msiexec.exe	97
PID 2820 wrote to memory of 2092	2820	msiexec.exe	98
PID 2820 wrote to memory of 2092	2820	msiexec.exe	98
PID 2820 wrote to memory of 2092	2820	msiexec.exe	98
PID 2820 wrote to memory of 4504	2820	msiexec.exe	99
PID 2820 wrote to memory of 4504	2820	msiexec.exe	99
PID 2820 wrote to memory of 4504	2820	msiexec.exe	99
PID 1116 wrote to memory of 2420	1116	NovaInstaller.exe	100
PID 1116 wrote to memory of 2420	1116	NovaInstaller.exe	100
PID 1116 wrote to memory of 2420	1116	NovaInstaller.exe	100
PID 2420 wrote to memory of 1628	2420	vc_redist.x64.exe	101
PID 2420 wrote to memory of 1628	2420	vc_redist.x64.exe	101
PID 2420 wrote to memory of 1628	2420	vc_redist.x64.exe	101
PID 1628 wrote to memory of 224	1628	vc_redist.x64.exe	102
PID 1628 wrote to memory of 224	1628	vc_redist.x64.exe	102
PID 1628 wrote to memory of 224	1628	vc_redist.x64.exe	102
PID 224 wrote to memory of 4280	224	VC_redist.x64.exe	109
PID 224 wrote to memory of 4280	224	VC_redist.x64.exe	109
PID 224 wrote to memory of 4280	224	VC_redist.x64.exe	109
PID 4280 wrote to memory of 3136	4280	VC_redist.x64.exe	110
PID 4280 wrote to memory of 3136	4280	VC_redist.x64.exe	110
PID 4280 wrote to memory of 3136	4280	VC_redist.x64.exe	110
PID 3136 wrote to memory of 2796	3136	VC_redist.x64.exe	111
PID 3136 wrote to memory of 2796	3136	VC_redist.x64.exe	111
PID 3136 wrote to memory of 2796	3136	VC_redist.x64.exe	111
PID 1116 wrote to memory of 4484	1116	NovaInstaller.exe	112
PID 1116 wrote to memory of 4484	1116	NovaInstaller.exe	112
PID 1116 wrote to memory of 4484	1116	NovaInstaller.exe	112
PID 4484 wrote to memory of 972	4484	dotnet-sdk-6.0.405-win-x64.exe	113
PID 4484 wrote to memory of 972	4484	dotnet-sdk-6.0.405-win-x64.exe	113
PID 4484 wrote to memory of 972	4484	dotnet-sdk-6.0.405-win-x64.exe	113
PID 972 wrote to memory of 2468	972	dotnet-sdk-6.0.405-win-x64.exe	114
PID 972 wrote to memory of 2468	972	dotnet-sdk-6.0.405-win-x64.exe	114
PID 972 wrote to memory of 2468	972	dotnet-sdk-6.0.405-win-x64.exe	114
PID 2820 wrote to memory of 3044	2820	msiexec.exe	115
PID 2820 wrote to memory of 3044	2820	msiexec.exe	115
PID 2820 wrote to memory of 3044	2820	msiexec.exe	115
PID 2820 wrote to memory of 2352	2820	msiexec.exe	116
PID 2820 wrote to memory of 2352	2820	msiexec.exe	116
PID 2820 wrote to memory of 2352	2820	msiexec.exe	116
PID 2820 wrote to memory of 2948	2820	msiexec.exe	117
PID 2820 wrote to memory of 2948	2820	msiexec.exe	117
PID 2820 wrote to memory of 2948	2820	msiexec.exe	117
PID 2820 wrote to memory of 3160	2820	msiexec.exe	118
PID 2820 wrote to memory of 3160	2820	msiexec.exe	118
PID 2820 wrote to memory of 3160	2820	msiexec.exe	118
PID 2820 wrote to memory of 4108	2820	msiexec.exe	119
PID 2820 wrote to memory of 4108	2820	msiexec.exe	119
PID 2820 wrote to memory of 4108	2820	msiexec.exe	119
PID 2820 wrote to memory of 3188	2820	msiexec.exe	120

C:\Users\Admin\AppData\Local\Temp\NovaInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\NovaInstaller.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.15-win-x64.exe
  "windowsdesktop-runtime-6.0.15-win-x64.exe" /S
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\Temp\{47CB40EA-FCD5-4255-B2B1-13CEED2F36B0}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe
    "C:\Windows\Temp\{47CB40EA-FCD5-4255-B2B1-13CEED2F36B0}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=568 /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Windows\Temp\{B827A4E4-788B-49E6-B286-B3A20FE354AB}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe
      "C:\Windows\Temp\{B827A4E4-788B-49E6-B286-B3A20FE354AB}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe" -q -burn.elevated BurnPipe.{E307F260-64FE-4CD0-B04C-AC699EF1FE4A} {9C51FC7C-35C8-4B76-9F28-7694B8D72843} 2216
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:2056
- C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe
  "vc_redist.x64.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\Temp\{2C1C564D-03D1-439A-B70F-947D58011AAB}\.cr\vc_redist.x64.exe
    "C:\Windows\Temp\{2C1C564D-03D1-439A-B70F-947D58011AAB}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" -burn.filehandle.attached=660 -burn.filehandle.self=688 /install /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\Temp\{31562555-DF1E-4CFE-BAFB-8793E69EE624}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{31562555-DF1E-4CFE-BAFB-8793E69EE624}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7330508C-81A0-4137-9BD5-FC63C23D8383} {8401B103-ED22-4D93-A4C9-4D61DE637D26} 1628
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:224
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1064 -burn.embedded BurnPipe.{54765D4C-D364-49AC-82BE-3B28C5D08130} {B6ACA59B-8915-4E35-A23F-4843801C6C6D} 224
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4280
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1064 -burn.embedded BurnPipe.{54765D4C-D364-49AC-82BE-3B28C5D08130} {B6ACA59B-8915-4E35-A23F-4843801C6C6D} 224
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7D220A42-F4D7-4487-9968-890DCD0F2D04} {974AC300-5D96-4E40-A13A-ED090E57F9CA} 3136
        7⤵
        Modifies registry class
        
        PID:2796
- C:\Users\Admin\AppData\Local\Temp\dotnet-sdk-6.0.405-win-x64.exe
  "dotnet-sdk-6.0.405-win-x64.exe" /install /quiet
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\Temp\{1C2B4AEA-71F0-40DE-93DF-D7A6C8BCE607}\.cr\dotnet-sdk-6.0.405-win-x64.exe
    "C:\Windows\Temp\{1C2B4AEA-71F0-40DE-93DF-D7A6C8BCE607}\.cr\dotnet-sdk-6.0.405-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\dotnet-sdk-6.0.405-win-x64.exe" -burn.filehandle.attached=704 -burn.filehandle.self=708 /install /quiet
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Windows\Temp\{A704A1A3-16DE-4DF7-B7E1-4BC72134BBB8}\.be\dotnet-sdk-6.0.413-win-x86.exe
      "C:\Windows\Temp\{A704A1A3-16DE-4DF7-B7E1-4BC72134BBB8}\.be\dotnet-sdk-6.0.413-win-x86.exe" -q -burn.elevated BurnPipe.{B117458C-C849-47FE-8C7D-3F3B9723FBFE} {AF59CF44-96A9-4425-88D1-D303243B7BF0} 972
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      PID:2468

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0887F7B55BBEA7C02FE66CD6BA17376A
  2⤵
  - Loads dropped DLL
  PID:4664
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 06779F36ED61BFB3AEBCD4217F7CF3EB
  2⤵
  - Loads dropped DLL
  PID:1360
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DEBA708F46D7DEA576AF7CF97B58D109
  2⤵
  - Loads dropped DLL
  PID:2092
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 97656C24D66DD3480F15692B813BD68E
  2⤵
  - Loads dropped DLL
  PID:4504
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1E8D076A4082C3AF5D8A7BCE76E7D157
  2⤵
  - Loads dropped DLL
  PID:3044
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AE9D2B470E8E2FE158DC42D7A983DBD9
  2⤵
  - Loads dropped DLL
  PID:2352
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CC95CE020EFE58C2FA2A456D3821D6A9
  2⤵
  - Loads dropped DLL
  PID:2948
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F3C44D13D2EAAFA8F311C2575C935E9A
  2⤵
  - Loads dropped DLL
  PID:3160
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FACDDA399F005FAE624A4F328B27C5E5
  2⤵
  - Loads dropped DLL
  PID:4108
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C364C7C12825FACBA372BA6719B387C7
  2⤵
  - Loads dropped DLL
  PID:3188
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 472C3C3000B7B20E079C14FC4A9F522E
  2⤵
  - Loads dropped DLL
  PID:4380
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 58EA0B65B5085602A6A6018C842D29B1
  2⤵
  - Loads dropped DLL
  PID:680
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E0D73E6B49BFC3F49389E240B7F62E17
  2⤵
  - Loads dropped DLL
  PID:392
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4F805C475E3F8409894E75B5FC3C2E07
  2⤵
  - Loads dropped DLL
  PID:1648
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 605525EC6118F9E39F724373C171BBEA
  2⤵
  - Loads dropped DLL
  PID:3232

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1072

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e586698.rbs

Filesize
56KB

MD5
c09897c9697714e2e7437d825c796370

SHA1
95b0339db53dd08e66d9f104a0fdddd969ec962a

SHA256
50d28895c5faa96054ae98cc7928331ce7634c590d1b21a00841752b82fd2a77

SHA512
521d35c2c7770b7fe2ea704d5cd9727e5c1f70a1f806cbe34380bd45667b837a9a43ce5fcc758df7f9ea25ac2ecbe36731a1e324dc0774a5da081ba2eb609bf4

Download Submit
C:\Config.Msi\e58669d.rbs

Filesize
8KB

MD5
bbe3770321a0a8b1576858576783d2aa

SHA1
a85233bad02377dbcdfa8aa0d6fa7dd0d3e93fe7

SHA256
9ef9832ebe5582ceb95849616ab70230adf0e44dceadb0d5ea911890eed107f5

SHA512
0b0261107379b5eaccebdf43e5891fbeae0ee84dec05fcf1702189bb44e315c15bcd20e62951bba627f7e62304276f20abb417de978d5f6e3765d77902a4362d

Download Submit
C:\Config.Msi\e5866a2.rbs

Filesize
10KB

MD5
d8c44d33e6840c5159f6a83b6b5668dc

SHA1
6c8888487d2347758de85cbbba96000274182ecf

SHA256
557e0c56794a549989a102568df56fb450de841f34367912248a1fed684b7dae

SHA512
ce0c441eb6444e623730c3b3650ec4c1ea6a2c38afa6133c8db9844cdebf3b12e5a6bd8eb86063bbe5a38fd22b1e02e526bb5bfbc923845e876db33693980c82

Download Submit
C:\Config.Msi\e5866a7.rbs

Filesize
87KB

MD5
4967768f0bd6d359456feb4a4ae3acfe

SHA1
64734998108a49795da5aae9068bc30e0ec6ddf2

SHA256
861b68fe77621d44d5a2e8524f6abca4007faf8f04f9c1914318db356636279e

SHA512
e7699c80fa1d3964cfee91b613e7462d38fc42535e450762ec236786062d0d5f5d484e9c3649cf6c2e08d42381f7e713f4a41e1ef79fb49dbf6c965b223cdd4d

Download Submit
C:\Config.Msi\e5866ae.rbs

Filesize
19KB

MD5
5790a3e4641e9f3375403dc26a8261d3

SHA1
4b3325e9ff38d5423f957f52e8954dd3ed0cf78f

SHA256
bd541a118a2ba6ddfa93f29c634c567c72ffc6e8943bf655b4ac50919fd27c49

SHA512
2102ec76dbc2c64bca1ba32739d121fde59917ca20edeb1138d2123ba44f632089f1dd5d29c6525dfc3bd55afae5853ecd060b87cda127549cb3e759df3bef6f

Download Submit
C:\Config.Msi\e5866ba.rbs

Filesize
19KB

MD5
8ab24a95852b6d14245b0895d13cc55b

SHA1
fc2aa8ddcb9cb9d5989fbd80c6cdbb6eea781be0

SHA256
2878e0256954082f69f812766712678fd62d39f5ae818c025f3f00d0fb1a2d39

SHA512
f696d599b577e7f49972f6181e0241780a47f089130343ed442c658e62644bd844f561b963fdb819ccc27f20509d82f549bf82be60abb27326a8d39a94e7df07

Download Submit
C:\Config.Msi\e5866c1.rbs

Filesize
21KB

MD5
41a77019399432895e70030a52883e18

SHA1
3ab381c388202bee80b76c40b0eb2c3a7d373949

SHA256
e02529901c133fc8428ae2c2cfc2e08a08555385e5bc88a8a2cdc361343ff16a

SHA512
9e0ce9fad0a3ee3d6085a628df113234bc96d0c01622c0d9332c947b627de392d29c5b0e167a7befd7a4ebad2ff4884a2e1e4c4c8d7883ed1cccf693fe31e536

Download Submit
C:\Config.Msi\e5866d0.rbs

Filesize
21KB

MD5
896ea9c8598b1eff77c080bb8bb49c73

SHA1
602dfd38b03ac1ddd6941b1251c1cfb082331b99

SHA256
68b130fd321149cb7b4f04043e8ecc08e90cba601e7523e235c7b94536553edc

SHA512
4cb4c4a95d1803171483c408a2b2126fe26e54b0fcffd251fc9d4485c27a4bb5e9eabc67ddbcbbd78bb2a4a3e4d9011a1f5f9e442d8100cfc5abc966eec1c9f3

Download Submit
C:\Config.Msi\e5866d5.rbs

Filesize
57KB

MD5
f2a9dd53039b091021d3906a95802078

SHA1
edb8fdb8b06d6041ad732cc97a757def580b88d0

SHA256
72aeaaebe2a3757b75b7184f9ab43d975411e1eccdd7a40e785bf31ea8ab497d

SHA512
fcc1b2c77cf7f1a73cdebaefcc9cfebf774263ff6b743c3de2e03c35da7a41c174853344e86f252e8b235a560c1a1157f7471b143a9059c325e92fcb9c81879e

Download Submit
C:\Config.Msi\e5866da.rbs

Filesize
8KB

MD5
1cad1dffa6cbbd54718635b89b001e23

SHA1
5ce23b7ef4c39bb5287d57481bb7dfc0b1193ca4

SHA256
f53f8c7cddf5cbf49b3096a470b9d2d35dd04cc8923fd6960867f014d36c9718

SHA512
ef23906e743214f3540ad9fddfc32dc1080bb2759de485f5aedf922f13d6c6f8a0c811d7ec8aac47f1c90c8bff9f58f5e749b6ea9c0886a16de59c4500937cbc

Download Submit
C:\Config.Msi\e5866df.rbs

Filesize
9KB

MD5
9f4892839c4475fd9e20afcfd12cd159

SHA1
eb3eb934346ad33489baa5865fef47659d32c016

SHA256
b72bbcb109ee3864bb13d33c4bed9cdc1253a2deed89202fd935bfaa903a783c

SHA512
7586e7bb9221343659bd6454151b24163bf5eaca6b13c0f32a22acbcc1767da14bd676fe23015e65aea41f6449818b4f50d4de558b4d4a99be667ec4fb677336

Download Submit
C:\Config.Msi\e5866e4.rbs

Filesize
73KB

MD5
b05c6fecc8cd4bc19b015d80a6118567

SHA1
fb89074023b8c7b2dc235f5ff05907127c7d6035

SHA256
4f6f9611f37c71ff7c04c210f701ee3cd17dd55f9de6460e30fe57909803496d

SHA512
a29b9288defde41c6001b2207f494395ed3360c59685bc332ff7daedb3383d8c4e7bc4681f07c206cf9abf9d67d1ed5df42e1ab296d42b771776db43c30d9d2d

Download Submit
C:\Config.Msi\e5866e9.rbs

Filesize
10KB

MD5
c7597d3dd7f0df71a0b7d9fc7846feda

SHA1
e0aaa9f7b833b4e6346fb8ab0904bbc3d7826bfd

SHA256
d2b98534e44ee9515cdec3b654d40c91a2db8cb816835e123ef1d2b93ad893cd

SHA512
db4c49cdcd6ff5950aef5acd3d2cec67e980d48aeb71c0c2d72128cff0324e79140c637ea20a3197da9d13052f7776e2d98b3e6e74725cf41f7d2a7dbe14d67c

Download Submit
C:\Config.Msi\e5866ee.rbs

Filesize
11KB

MD5
ae25b05fa3798810ffe7cb12e79b6ca7

SHA1
38fcc2fcfe7d63dd5a9002a80ebd971717752a38

SHA256
e36d533cf2da9e0858a8008dd6be95cdaae7ab3ae8363aaebf06b7cacc76ca99

SHA512
a48c4902064c498fbf9e3ba00b9f79e2e47d805f400889d79b4d44aec6183ee4de175c52f8ad2fa728d87cd1e447cc94209178972f89f44f3384121a2bae287e

Download Submit
C:\Config.Msi\e5866f3.rbs

Filesize
11KB

MD5
52141c6c312fa6c4740723e8968b4992

SHA1
f8452eb8f1cfad377bbac81f37529c50868cbb67

SHA256
108770add855e8319bf98ad5675b97f295dd04b9ec03d201694803129f9afc8c

SHA512
cbe8dcdd0dc907321c947864aeba5f9c291eff65ee7d6c7fd2543612af80dc7826d82360d76057533f229e22ed2ee93bb56741d45b088cd7f6d86d8862d420d7

Download Submit
C:\Config.Msi\e5866f8.rbs

Filesize
11KB

MD5
f1d332e7e9dc0e843966f6dd37a85474

SHA1
21f226af2444f9f991a31033670bc74566a26b00

SHA256
e0218bda9baa038a1ef1e46d3d499e0169da2d76343f87b453db5db0d6fa6cbe

SHA512
ac831eeeb0066d7fe36bd9af70fc3444986f28cbeefe3ca70cd5f649c3cba1c68cba13494f181e223f4691959f590c63deab0da0d0c02995f7f1b40dcb7cd5b8

Download Submit
C:\Config.Msi\e5866fd.rbs

Filesize
36KB

MD5
0de05809f854dda5123653df913ed5b1

SHA1
80eeefbeee6a74c872cd7962a0504032d09917a5

SHA256
abab4dbc53c478cec7a65569aceb3be69c9ec750d6ec0987bc822f94bcf5cb0f

SHA512
cf51aeffe0e40a0c79a2a230c352ae61032af74d8317eef11eef296ac3dd29ef3c8c4ff5d0cc754cfbf0d273e5ccab4e8dc8a6b52fd6d5c62a6292da922e48dd

Download Submit
C:\Config.Msi\e586702.rbs

Filesize
90KB

MD5
f6893fb2b2d45da8bd030b1193031dac

SHA1
47575e78d4cc70af32a996caa064150fec88cd90

SHA256
395faa705b353d2332468211f3da738d7f2f9c17b47ae7fcfc1baf539050f87f

SHA512
2b501f0b9a896c0bdc1498f174d4a64b076bd1bf8819bbfb170a8da3f1c0de839a2edd484da9c8dac2542c7c16ea470f90aa228fd82857bb10d14d5206c3a593

Download Submit
C:\Config.Msi\e586707.rbs

Filesize
41KB

MD5
64fd3d08f74cc4183f3f5a966e649d43

SHA1
6656c4228fd746d63594a38ce126580a9450c6e8

SHA256
1bd351991df56735dc5a798059763102ed64b1b1715ed0734c52cccaf3d4fd27

SHA512
3acb2d81b56df8e0062f6d536689f72e620ca744500e0a83978fe9e409a4ca09f26eccc1db499e3fd95ca7095c738ef7b4ab948f3c9d3fd0b02165a2b94d31dd

Download Submit
C:\Config.Msi\e58670c.rbs

Filesize
77KB

MD5
6cf38f3b6a6d0a4992b15589406855f9

SHA1
29cc8ab02b48de4341c26c21cfbca54c56755f79

SHA256
b150d3c9610967d0f73df28570703483667206c4b4aaed84a418c2a5191d7583

SHA512
c80e75f480821c613cd165d95c7c61cecb23a46c96980843336de7dc13eb4dde021a48092681be3f3be7b25a816179b858f88eae1c8181d98e159eefd2b45447

Download Submit
C:\Config.Msi\e586711.rbs

Filesize
10KB

MD5
1c1d7dea9f98ffbe1716bf1cbbde8727

SHA1
f45dbd359748b8d182bfaf5b84ed3fc404b6167a

SHA256
5e66f099de49139db95f1f29bbd7d37bcd6876f99895c334b9d9a3f057132179

SHA512
3b080beedb065a4cd258c17e528cb2b7f038eff8220a7ae29716cd4a6f494cd3e8d8218579e68e1a5a710657ed44370ed28495dc59b4a1f2166d4893aa66be51

Download Submit
C:\Config.Msi\e586716.rbs

Filesize
9KB

MD5
bc5f48816a5b8f58d284a8af58275719

SHA1
112c84eb0e9cb92cb9d9412fec787d74062d7022

SHA256
e0a5c35ac2e47b601e2fed211c16cec011821a0a50cb802baf149c946a4afe6e

SHA512
940a135af97da3d341deeb80bbd8a4ac3f482bc36aa7d754193cc69dcc7efaa093bce01ba9a8115e52656c93ba70d5e5f6345efe8bdbc8913f198e60a3e71e6b

Download Submit
C:\Config.Msi\e58671b.rbs

Filesize
8KB

MD5
1bfa7b33de6ec0128ddc14ea3d506de1

SHA1
e48786c8cdafae32e80befbff82747e29a1bac77

SHA256
04d119f0d806fd0d4e95b60214c19ea8bb88f31cc5e2f45560fa5bf63c751bd6

SHA512
57eadccd053110f39f6c2089dc6ae5ca2e94c3e8c8c7453209dd977935f458e687a9a753eb7dec33f236e9428338cf59b8c09dabf57ff17b456062af67af1f05

Download Submit
C:\Config.Msi\e586720.rbs

Filesize
9KB

MD5
3db296929c610aec8e1fcac10194a895

SHA1
0e23a339a46fdc92243f8dba0f24ef6ad2da7374

SHA256
e4a38377c879f24c74ab097d92244fe009d1b91e388b74971762875d0dcd6b3f

SHA512
aa9fd9dd7da312796af811b4f00cebd195925485bb98b97a7d71024286f55bf52335e6256f95fbf3946f2a8713ad7a5f981b21772a450215b98891362fff8a10

Download Submit
C:\Config.Msi\e586725.rbs

Filesize
9KB

MD5
6a79a483971dc267d78b7d6a702f7aff

SHA1
11810cc837edfa141f42b4e6d2cadf02119c2eea

SHA256
bdaff9775b8ef8faf38de1600efa28eac4ebc90e5e641ec66b09f8ad112bc951

SHA512
5abea45cb8ed845b7b8d2054d276310503ba9cd83056297597b287a62ac272b0cb959650f2bbee838aca981a95125a340b1dab639318e168cfc5a1814acc85c5

Download Submit
C:\Config.Msi\e58672a.rbs

Filesize
8KB

MD5
88285e94317dbf5b03e3e28a21506658

SHA1
8c14b108907174ee88fc42d154b330784df41490

SHA256
bb3d4cb2668fb05f3f93e76c432a48bbdd64b634a9a96ed22608869813602f89

SHA512
a46a2aa3a77a82bbda692c5b21cfb10f5e3a8885fc92b5268ae0f3c329edebbbb741fc201f56bf1ac3230d82d53e59881276066e667f58dfd65e8a1777431f14

Download Submit
C:\Config.Msi\e58672f.rbs

Filesize
8KB

MD5
01bccc394dee3437ac690437dc9b206e

SHA1
fd650c92e4c6bdd98659db9297281f68f82162bf

SHA256
69570838b47c5821068f2ca4da29a0f35ff2491571124af797bc46abe799de80

SHA512
25cbed2d2fc44b03f0f8e7bacce00bb22c061a17b9efe1d4a0c5185955a1ebfd3a362c86efe27cece6c026d1b71ee3509385b12cfbf25fc2c288d1494261a65c

Download Submit
C:\Config.Msi\e586734.rbs

Filesize
12KB

MD5
45ba71ea1ab75be96a3c13a54aa917c0

SHA1
5fdb2887033e600bfd272e424dad89597bad9f35

SHA256
9a45ee595a0cee890ecb84100bda059fe57492c3e54037caec29a0d0aba1b344

SHA512
f2ba1835266ae1c804ae3182a099ce16bc39c239d3eb3a0e7ede90a8d29e01da48d45de80c89972857baefb0bea4c47076f1279a1d588a1502138b82a7bea3ab

Download Submit
C:\Config.Msi\e586739.rbs

Filesize
9KB

MD5
0fd7ecb7ab4b2bd35975df6c0efd7990

SHA1
08ae3ab5119e2a2aa66fc946ea54339353064b60

SHA256
091b7b8e44178cecc1bc190fc5aabbfab0f4c5eafd64512b3b8e4f5a57fdb5e5

SHA512
c9a7a670db6a6c10b7e45e57cab50a85778432b3540f6d864687c097666e6c3ef6946a5de08a0f5a88e1b129d981588756c8a13b297da6c8566d4238bf533d2a

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\ProgramData\Package Cache\{0f39db03-9030-48f3-82ef-5384bed81d85}\state.rsm

Filesize
960B

MD5
1794a09d2661c87d884c5c30e86e9557

SHA1
4e37d06b293b209bde8ba007d8705493dca08eb0

SHA256
7179fc65fbd810e2c75868a66938035183a71b719b3378dda10ab6078aedaf2e

SHA512
2ee6823e7053071a8d6639ad215499473853f2166f563dfedaa6000af28bd9a99e99a711c5c9f6a5e25a4279cb4e68d7dd2ce35c243b3922fad56008173d6140

Download Submit
C:\ProgramData\Package Cache\{0f39db03-9030-48f3-82ef-5384bed81d85}\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\state.rsm

Filesize
912B

MD5
604c0f9b5086db2352a86501ae6bdab2

SHA1
dcca0cb59a535bc19c5d0ef42e9eb0b3f6c710a8

SHA256
87ac62bf0f70117eee38e8fa5bb95ab571c765ffa7c00b85ed0cc32104e6d7f0

SHA512
5c14c27acd493a7617a3325c9a189b410074ef3e208c9a05c869982be6e93c2237a68c1d64fb0f7c40a864a388f1a6a51d3db3f4a68bf2fbcc299447a4b1e6e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\axcgh20z.3zq\D3DCompiler_47_cor3.dll

Filesize
4.7MB

MD5
ca68272d2c97f1e145f50b8cd1edf3a6

SHA1
83097400436f111c13ee34740e66b3de0542914b

SHA256
ff5dddae92b3798cc00c14a706ecb6329c27aa6d7bb6e82b393cf8b7366458ba

SHA512
ffc670aea4dad0113196d594c0fd07a838123e485ffebe3b728b8a18403b0bb82b042ccf23019c850a62466990b10a2e94102178326df735e4815dba7811d502

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\axcgh20z.3zq\PresentationNative_cor3.dll

Filesize
1.2MB

MD5
5a137f1c0db458b0e5bb642f5293d3e6

SHA1
6f66bf8ad1a930c7021a95025b81af6169508a08

SHA256
334a78b0e495b25b9b828216c4613a8a169129c583245da3c3b2b923d4e4c39b

SHA512
d645f9c57523296923e2753202dbcd2a09f75bf46ac9a5a5525182d1d90b6f2fb078789150f4aeeafca8717098670780cbdb1e81fdb7fdd32d5ad791a2cafc79

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\axcgh20z.3zq\wpfgfx_cor3.dll

Filesize
1.9MB

MD5
c8af68f307e0868e673d6e69924b3b81

SHA1
fbf565bdc0c1fe97b57690e3be751452d7e2fc56

SHA256
23db27f5a6d7b9993f3d5179e4021913cd977d810fbfd8c482f601aee9759e47

SHA512
cb4d21179504de09c62629a7b4cb23d4b771f477bf888927896abb143214451c4ad6210f2586a4e442b68eb39b9af7f42c916931849dd650044152ce7bf25720

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20230826122421_000_dotnet_runtime_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
ce1228c5cdb49fad373bbb8ba782104c

SHA1
f08ff6cdf27bad1c1b78d344ebe0e9ea1ff21ffc

SHA256
65e7b41b57dbdea8b1aef9750edb9cda64ea1215193b35c6db98cd8989a25702

SHA512
16105cbd654c0f6de484e08dd8f79b6611c8822278fb0fc3d8e06212c37ea921bb14d6da15b97f81a7cc2eabc9b0766734dee914b35dc7e94f335321d5da0884

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20230826122421_001_dotnet_hostfxr_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
f19499c4ca355eb031d29d6fe1cc61c4

SHA1
291f0efe4e12fa4848e54d84cbaf27d006c3dd4a

SHA256
04271dd01906714a8363ba27665d34424a70c1bd462e22beb7defd960dd0055c

SHA512
842201e4a551ae91b4d96724e15062745b87285973e308422e8be78915a20d28e7f8c369f3b88b7f03817dab83754e4e6546fe37743b105873e70319b3266a96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20230826122421_002_dotnet_host_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
fbeda09d23bad108ee2b00486b3561a2

SHA1
7aab1932e14bc922c320eb78432964ba14027ba3

SHA256
3b0e7cf8623356c5402b03911ab2ce128ac932b7a8aad4cc0fd26bb59b7e2269

SHA512
1a835ce5f6b761acb048a5eb0c71d2a0915f40094ca7985291baac0f8e395525c5a7a1fd4cdf0a290337f3339ca65a589978916ac2d9d7ed619d4732222d1d0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20230826122421_003_windowsdesktop_runtime_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
fc65e3b6958466bc25a496c5ac6b4248

SHA1
1ebf1616aaea613b3125e19a6b0b6b067c6a5842

SHA256
3479ad1f4c422dc0febee95f523a99a3eb736347010a8729254bbfe3c0d561df

SHA512
9d49f0dd8e9e72e76aab208560d24edf80ac31add3117a58e18ce5c80b7660d7054c64456fc4a2eb6136c8d139b3af2c459397c8a754910a1dc29087d00e2bdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20230826122506_000_vcRuntimeMinimum_x64.log

Filesize
4KB

MD5
434451ec340b6e3e511c7218ad552a83

SHA1
604230d994cb376d0fba2799dda798c4ba9a1363

SHA256
b793f8ff2617bc33962fa938217088703caf93da0d0bd0faa9339c64e34dd6db

SHA512
edbe5e836073b6b57d6e26e8947bb69666dbff0a4502086739f075403ecb710372ca0330364626b37db11cd55203cc759449a5bfab4448bb52364cc1544b2b05

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20230826122506_001_vcRuntimeAdditional_x64.log

Filesize
4KB

MD5
00a156c9502221b876b5a55bcfc049bf

SHA1
b68e4bdc87868eb06781a935f6a8a9c35cd1ab4d

SHA256
37a8f1807b050f727a4c1f3ec2be6fdf6cb5ad4587a01f402558e1160d37e660

SHA512
abd53638e6f167fa4d1b69d8694180a77e7433eb00c2131ac89f7bcd410c7668748166c315e83e8437ec3c47b8aca75b4b44885d1525f285714878fde15b0e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dotnet-sdk-6.0.405-win-x64.exe

Filesize
185.2MB

MD5
8e003e67ae8154be6e4efbc2f788a631

SHA1
99cf7157aba3a64ae9a5a17eb8df81453bf9fed8

SHA256
ee634896a21a1a49b811efec9da39b95a564e764b87143ce424000c0ec6cfa04

SHA512
e767cfa0664630dd325ddf045bbee5e562c8e966a588a711f0dfba0e6458430ac3f2062c400dabc9d1e94fe7a2a592340593f6fabbe75e951fd6a31cbfe10727

Download Submit
C:\Users\Admin\AppData\Local\Temp\dotnet-sdk-6.0.405-win-x64.exe

Filesize
185.2MB

MD5
8e003e67ae8154be6e4efbc2f788a631

SHA1
99cf7157aba3a64ae9a5a17eb8df81453bf9fed8

SHA256
ee634896a21a1a49b811efec9da39b95a564e764b87143ce424000c0ec6cfa04

SHA512
e767cfa0664630dd325ddf045bbee5e562c8e966a588a711f0dfba0e6458430ac3f2062c400dabc9d1e94fe7a2a592340593f6fabbe75e951fd6a31cbfe10727

Download Submit
C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe

Filesize
24.2MB

MD5
077f0abdc2a3881d5c6c774af821f787

SHA1
c483f66c48ba83e99c764d957729789317b09c6b

SHA256
917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888

SHA512
70a888d5891efd2a48d33c22f35e9178bd113032162dc5a170e7c56f2d592e3c59a08904b9f1b54450c80f8863bda746e431b396e4c1624b91ff15dd701bd939

Download Submit
C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe

Filesize
24.2MB

MD5
077f0abdc2a3881d5c6c774af821f787

SHA1
c483f66c48ba83e99c764d957729789317b09c6b

SHA256
917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888

SHA512
70a888d5891efd2a48d33c22f35e9178bd113032162dc5a170e7c56f2d592e3c59a08904b9f1b54450c80f8863bda746e431b396e4c1624b91ff15dd701bd939

Download Submit
C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
54.7MB

MD5
1a6d60add2d112dd73e83fb46dca474d

SHA1
8b374a54f508cfdb8c8176bfaef96f37edf7170b

SHA256
aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545

SHA512
49192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
54.7MB

MD5
1a6d60add2d112dd73e83fb46dca474d

SHA1
8b374a54f508cfdb8c8176bfaef96f37edf7170b

SHA256
aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545

SHA512
49192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79

Download Submit
C:\Windows\Installer\MSI6C32.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI6C32.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI847F.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI847F.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI87EB.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI87EB.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI87EB.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8BD5.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8BD5.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI9089.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI9089.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI9780.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI9780.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI9D2E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI9D2E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIC087.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIC087.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\e586699.msi

Filesize
25.7MB

MD5
0fda2bb0ba0c1dd265e9540265a035b7

SHA1
03461f9f268e5ec0a997990c05b16086a03505dc

SHA256
bb994af42653ab3738ea3b689f6870c2549f6f170f23a1a8a161c7e02ccec9b1

SHA512
acdcb21c4ac6587b7a7cc43078a075f2f06d71823ace65e175611e0ef8af2bc7c753b7618447ba6d9f24cbea63cf582bcd5f71ca3b7a79066ca6cd61c43ed7d6

Download Submit
C:\Windows\Installer\e58669a.msi

Filesize
804KB

MD5
5dce0ef6b5d0bd2b850106a22b5e0264

SHA1
263cfbd815de6b877d084ab4b3d2f878d71c9b1f

SHA256
c98010f7c473bdb2a182e61aae35a20c044006fee26ffb378346cbdf255d2736

SHA512
fc7297d142cf8d0247ac86732182a031e819a4fc41b034d1b9a7dba5cdb56d73e158dd57132b6a083b3f6184859b4dca4a1a21205f6d11b2be6ca3913e89891b

Download Submit
C:\Windows\Installer\e5866a8.msi

Filesize
28.5MB

MD5
6ec2d8f7944d0766603fa3b043fe2410

SHA1
000a79c4792abbfdf65ca3b5367b7a3b02146732

SHA256
619074e13358e2c259086bf306083229ae8d3472187bc755951413858949cb68

SHA512
4f86befae9a437985e4ae491f416b0c06a72344ffccfb00c325e91d48244b46edee784003c0a519bc39fdb14409d949c7fe7cde7f51b3479d504c61d88f6371b

Download Submit
C:\Windows\Installer\e5866bb.msi

Filesize
188KB

MD5
a4075b745d8e506c48581c4a99ec78aa

SHA1
389e8b1dbeebdff749834b63ae06644c30feac84

SHA256
ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93

SHA512
0b980f397972bfc55e30c06e6e98e07b474e963832b76cdb48717e6772d0348f99c79d91ea0b4944fe0181ad5d6701d9527e2ee62c14123f1f232c1da977cada

Download Submit
C:\Windows\Installer\e5866d6.msi

Filesize
23.3MB

MD5
e79bada7cb5640f0c5c486a63fcfb75d

SHA1
b8c1fdadebd64a237ba63676e45c4702f998278b

SHA256
7d585a27e8fe15388570ea170765651189bad6ad7d2d84b6c252bf950784e516

SHA512
950f938fee3ae3328ad69ebc39e515fd0473753b1266a0f5a4c2354235526a6865661648990f90f844a4e493cef8c4b42495626e7ea8912442579ccfd3c7af36

Download Submit
C:\Windows\Temp\{1C2B4AEA-71F0-40DE-93DF-D7A6C8BCE607}\.cr\dotnet-sdk-6.0.405-win-x64.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{1C2B4AEA-71F0-40DE-93DF-D7A6C8BCE607}\.cr\dotnet-sdk-6.0.405-win-x64.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{2C1C564D-03D1-439A-B70F-947D58011AAB}\.cr\vc_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{2C1C564D-03D1-439A-B70F-947D58011AAB}\.cr\vc_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{31562555-DF1E-4CFE-BAFB-8793E69EE624}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{31562555-DF1E-4CFE-BAFB-8793E69EE624}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{31562555-DF1E-4CFE-BAFB-8793E69EE624}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{31562555-DF1E-4CFE-BAFB-8793E69EE624}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{31562555-DF1E-4CFE-BAFB-8793E69EE624}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{31562555-DF1E-4CFE-BAFB-8793E69EE624}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
46efc5476e6d948067b9ba2e822fd300

SHA1
d17c2bf232f308e53544b2a773e646d4b35e3171

SHA256
2de285c0fc328d30501cad8aa66a0ca9556ad5e30d03b198ebdbc422347db138

SHA512
58c9b43b0f93da00166f53fda324fcf78fb1696411e3c453b66e72143e774f68d377a0368b586fb3f3133db7775eb9ab7e109f89bb3c5e21ddd0b13eaa7bd64c

Download Submit
C:\Windows\Temp\{31562555-DF1E-4CFE-BAFB-8793E69EE624}\cab5046A8AB272BF37297BB7928664C9503

Filesize
935KB

MD5
c2df6cb9082ac285f6acfe56e3a4430a

SHA1
591e03bf436d448296798a4d80f6a39a00502595

SHA256
b8b4732a600b741e824ab749321e029a07390aa730ec59401964b38105d5fa11

SHA512
9f21b621fc871dd72de0c518174d1cbe41c8c93527269c3765b65edee870a8945ecc2700d49f5da8f6fab0aa3e4c2db422b505ffcbcb2c5a1ddf4b9cec0e8e13

Download Submit
C:\Windows\Temp\{31562555-DF1E-4CFE-BAFB-8793E69EE624}\vcRuntimeAdditional_x64

Filesize
188KB

MD5
dd070483eda0af71a2e52b65867d7f5d

SHA1
2b182fc81d19ae8808e5b37d8e19c4dafeec8106

SHA256
1c450cacdbf38527c27eb2107a674cd9da30aaf93a36be3c5729293f6f586e07

SHA512
69e16ee172d923173e874b12037629201017698997e8ae7a6696aab1ad3222ae2359f90dea73a7487ca9ff6b7c01dc6c4c98b0153b6f1ada8b59d2cec029ec1a

Download Submit
C:\Windows\Temp\{31562555-DF1E-4CFE-BAFB-8793E69EE624}\vcRuntimeMinimum_x64

Filesize
188KB

MD5
a4075b745d8e506c48581c4a99ec78aa

SHA1
389e8b1dbeebdff749834b63ae06644c30feac84

SHA256
ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93

SHA512
0b980f397972bfc55e30c06e6e98e07b474e963832b76cdb48717e6772d0348f99c79d91ea0b4944fe0181ad5d6701d9527e2ee62c14123f1f232c1da977cada

Download Submit
C:\Windows\Temp\{43B3FEF6-167C-4315-B5CB-CC1D317FD3A4}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{43B3FEF6-167C-4315-B5CB-CC1D317FD3A4}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{47CB40EA-FCD5-4255-B2B1-13CEED2F36B0}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{47CB40EA-FCD5-4255-B2B1-13CEED2F36B0}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{A704A1A3-16DE-4DF7-B7E1-4BC72134BBB8}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{A704A1A3-16DE-4DF7-B7E1-4BC72134BBB8}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{A704A1A3-16DE-4DF7-B7E1-4BC72134BBB8}\.be\dotnet-sdk-6.0.413-win-x86.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{A704A1A3-16DE-4DF7-B7E1-4BC72134BBB8}\.be\dotnet-sdk-6.0.413-win-x86.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{A704A1A3-16DE-4DF7-B7E1-4BC72134BBB8}\.be\dotnet-sdk-6.0.413-win-x86.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{A704A1A3-16DE-4DF7-B7E1-4BC72134BBB8}\AspNetCoreSharedFramework_x86

Filesize
7.5MB

MD5
759608b8db045afb303c4f66dca422b0

SHA1
f0536b100dfaec1e7de7c8c35ca7c7ad5ae6e779

SHA256
2035e3187d8b8369167ebf3e96c84f68639875eeaae7fd743379d0f4fc2eb30b

SHA512
25d6b772650a87bf428c7e1517f09876c2da789d53c4259d9a064d9f682e739226f37cc7d420653573f5fd898b0a0b6b23abef94406497bbd55852cbf7298447

Download Submit
C:\Windows\Temp\{A704A1A3-16DE-4DF7-B7E1-4BC72134BBB8}\Finalizer

Filesize
130KB

MD5
1ec0ef0eb7860f069bda682b0e74df8d

SHA1
12ffab75565303e970e27218efeeb364b3ecdd18

SHA256
2f6948e63b4c8e4493b32dedcaad3d871bd86940e160435bb794fb9be12e2001

SHA512
9964a24217aaf610f1bcd85ef246d9f361313090e1acddc5eaee7b2e241fc441b2ddcdb305e3cbc5591a0c6566856291ff549aab1e09c8b7acf45482df1cb71b

Download Submit
C:\Windows\Temp\{A704A1A3-16DE-4DF7-B7E1-4BC72134BBB8}\dotnet_host_6.0.21_win_x86.msi

Filesize
728KB

MD5
06a94b7b03fd6ddc6942959b0360551a

SHA1
6ec5e317599efa731ebd86a1fdca187391cd5f59

SHA256
837eb5ef21b543600c4dcd1905d7072e5ec88dd4ea7c177a9755df602f7aad97

SHA512
6c276e21070995f57ad2f31eeb4cdddd42e28dd1cd37405aa773883b567621c97077ef669f34dd357d15ffb3930c67b1a5950cc39ee7f78927002f3c8b2fbac8

Download Submit
C:\Windows\Temp\{A704A1A3-16DE-4DF7-B7E1-4BC72134BBB8}\dotnet_hostfxr_6.0.21_win_x86.msi

Filesize
784KB

MD5
1da4c6997d53b4e057eacba87395c44c

SHA1
e62f066789d3494799b3b0edd6885e8b92e59f53

SHA256
13cda8492bbcbf19f0d09582e259eab6f7b934f74b1bfb50c4250a4e27d80fde

SHA512
e2c39964a116cb14833c83a3efe09d890c8c0cac963c007a477aaf8c181230ebcfc54412953816588ac932656982ebd667739fefc135869d848ebab0f789c83f

Download Submit
C:\Windows\Temp\{A704A1A3-16DE-4DF7-B7E1-4BC72134BBB8}\dotnet_runtime_6.0.21_win_x86.msi

Filesize
23.3MB

MD5
e79bada7cb5640f0c5c486a63fcfb75d

SHA1
b8c1fdadebd64a237ba63676e45c4702f998278b

SHA256
7d585a27e8fe15388570ea170765651189bad6ad7d2d84b6c252bf950784e516

SHA512
950f938fee3ae3328ad69ebc39e515fd0473753b1266a0f5a4c2354235526a6865661648990f90f844a4e493cef8c4b42495626e7ea8912442579ccfd3c7af36

Download Submit
C:\Windows\Temp\{B827A4E4-788B-49E6-B286-B3A20FE354AB}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{B827A4E4-788B-49E6-B286-B3A20FE354AB}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{B827A4E4-788B-49E6-B286-B3A20FE354AB}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{B827A4E4-788B-49E6-B286-B3A20FE354AB}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{B827A4E4-788B-49E6-B286-B3A20FE354AB}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{B827A4E4-788B-49E6-B286-B3A20FE354AB}\dotnet_host_6.0.21_win_x64.msi

Filesize
736KB

MD5
12b8c5914e56f4bd933c8490f7f6cd45

SHA1
2ec135cdd97adbcfe7decb04f1a5e95b6f0614e3

SHA256
3b83682de5bfeabde75ffc34330f470df11ce5e62c2509c50b3e48e35130fa51

SHA512
ecc9ddd52d097ca6f643f7ce78399b01d37e776e30abb8b82b6278711716e6893528340b6719f8287848931759ae41427c252cb00df97742583dbe5d7ea4277a

Download Submit
C:\Windows\Temp\{B827A4E4-788B-49E6-B286-B3A20FE354AB}\dotnet_hostfxr_6.0.21_win_x64.msi

Filesize
804KB

MD5
5dce0ef6b5d0bd2b850106a22b5e0264

SHA1
263cfbd815de6b877d084ab4b3d2f878d71c9b1f

SHA256
c98010f7c473bdb2a182e61aae35a20c044006fee26ffb378346cbdf255d2736

SHA512
fc7297d142cf8d0247ac86732182a031e819a4fc41b034d1b9a7dba5cdb56d73e158dd57132b6a083b3f6184859b4dca4a1a21205f6d11b2be6ca3913e89891b

Download Submit
C:\Windows\Temp\{B827A4E4-788B-49E6-B286-B3A20FE354AB}\dotnet_runtime_6.0.21_win_x64.msi

Filesize
25.7MB

MD5
0fda2bb0ba0c1dd265e9540265a035b7

SHA1
03461f9f268e5ec0a997990c05b16086a03505dc

SHA256
bb994af42653ab3738ea3b689f6870c2549f6f170f23a1a8a161c7e02ccec9b1

SHA512
acdcb21c4ac6587b7a7cc43078a075f2f06d71823ace65e175611e0ef8af2bc7c753b7618447ba6d9f24cbea63cf582bcd5f71ca3b7a79066ca6cd61c43ed7d6

Download Submit
C:\Windows\Temp\{B827A4E4-788B-49E6-B286-B3A20FE354AB}\windowsdesktop_runtime_6.0.21_win_x64.msi

Filesize
28.5MB

MD5
6ec2d8f7944d0766603fa3b043fe2410

SHA1
000a79c4792abbfdf65ca3b5367b7a3b02146732

SHA256
619074e13358e2c259086bf306083229ae8d3472187bc755951413858949cb68

SHA512
4f86befae9a437985e4ae491f416b0c06a72344ffccfb00c325e91d48244b46edee784003c0a519bc39fdb14409d949c7fe7cde7f51b3479d504c61d88f6371b

Download Submit
memory/1116-66-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-52-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-57-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-59-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-58-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-56-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-5-0x0000000180000000-0x0000000180A23000-memory.dmp

Filesize
10.1MB

Download
memory/1116-61-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-63-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-64-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-62-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-54-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-65-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-67-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-68-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-69-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-1082-0x00007FF65B390000-0x00007FF65BCBE000-memory.dmp

Filesize
9.2MB

Download
memory/1116-55-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-53-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-60-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-51-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-49-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-50-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-48-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-47-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1116-44-0x000001DC4D220000-0x000001DC4D239000-memory.dmp

Filesize
100KB

Download
memory/1116-41-0x000001DC4D300000-0x000001DC4D3C4000-memory.dmp

Filesize
784KB

Download
memory/1116-38-0x000001DC4D1F0000-0x000001DC4D21E000-memory.dmp

Filesize
184KB

Download
memory/1116-35-0x000001DC2B1F0000-0x000001DC2B1FD000-memory.dmp

Filesize
52KB

Download
memory/1116-32-0x000001DC2B230000-0x000001DC2B238000-memory.dmp

Filesize
32KB

Download
memory/1116-29-0x000001DC2CAB0000-0x000001DC2CAF0000-memory.dmp

Filesize
256KB

Download
memory/1116-26-0x000001DC2B250000-0x000001DC2B262000-memory.dmp

Filesize
72KB

Download
memory/1116-23-0x000001DC2CA60000-0x000001DC2CAA7000-memory.dmp

Filesize
284KB

Download
memory/1116-20-0x000001DC2CA30000-0x000001DC2CA51000-memory.dmp

Filesize
132KB

Download
memory/1116-17-0x000001DC4D630000-0x000001DC4D78E000-memory.dmp

Filesize
1.4MB

Download
memory/1116-14-0x000001DC4D400000-0x000001DC4D628000-memory.dmp

Filesize
2.2MB

Download
memory/1116-11-0x000001DC4E150000-0x000001DC4F0D6000-memory.dmp

Filesize
15.5MB

Download
memory/1116-10-0x00007FF65B390000-0x00007FF65BCBE000-memory.dmp

Filesize
9.2MB

Download
memory/1116-8-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download