aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545

Analysis

max time kernel
92s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
17/09/2023, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

windowsdesktop-runtime-6.0.21-win-x64.exe
Size

54.7MB
MD5

1a6d60add2d112dd73e83fb46dca474d
SHA1

8b374a54f508cfdb8c8176bfaef96f37edf7170b
SHA256

aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545
SHA512

49192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79
SSDEEP

786432:TrS2qTgXes/qf9pmXoOz5imhfmgnAvgOLNsLKZCTpWecUlfe4X+wxCEGe9DdoAdz:6LoraD1Oz5imhfOL3WGA7QoaW//T

Score

8^/10

discovery persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	764	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0f39db03-9030-48f3-82ef-5384bed81d85} = "\"C:\\ProgramData\\Package Cache\\{0f39db03-9030-48f3-82ef-5384bed81d85}\\windowsdesktop-runtime-6.0.21-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.21-win-x64.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\it\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-crt-stdio-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.ServiceProcess.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\coreclr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hant\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Printing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\PresentationFramework-SystemDrawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Security.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\de\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\cs\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\it\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ru\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hant\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\PresentationFramework.Classic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\tr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hans\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.Quic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ko\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Resources.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Runtime.CompilerServices.VisualC.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\clretwrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.ServicePoint.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ru\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\UIAutomationClientSideProviders.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\tr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-crt-filesystem-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\Microsoft.Win32.Registry.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\cs\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hans\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\Microsoft.NETCore.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\UIAutomationTypes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-crt-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-rtlsupport-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\tr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Windows.Presentation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\Microsoft.VisualBasic.Forms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Threading.Tasks.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\PenImc_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Xml.XmlSerializer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\de\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pt-BR\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Private.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\tr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ru\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\tr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\de\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Private.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pt-BR\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pl\ReachFramework.resources.dll	msiexec.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI9284.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f7683df.msi	msiexec.exe
File created	C:\Windows\Installer\f7683f0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7683f4.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7683eb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7683ee.ipi	msiexec.exe
File created	C:\Windows\Installer\f7683e4.msi	msiexec.exe
File created	C:\Windows\Installer\f7683e5.msi	msiexec.exe
File created	C:\Windows\Installer\f7683e8.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB09E.tmp	msiexec.exe
File created	C:\Windows\Installer\f7683e2.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7683e2.ipi	msiexec.exe
File created	C:\Windows\Installer\f7683f6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC676.tmp	msiexec.exe
File created	C:\Windows\Installer\f7683df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BF9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE5A.tmp	msiexec.exe
File created	C:\Windows\Installer\f7683f4.ipi	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	windowsdesktop-runtime-6.0.21-win-x64.exe
File created	C:\Windows\Installer\f7683ea.msi	msiexec.exe
File created	C:\Windows\Installer\f7683eb.msi	msiexec.exe
File created	C:\Windows\Installer\f7683ee.ipi	msiexec.exe
File created	C:\Windows\Installer\f7683f1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7683f1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB86F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f7683e5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA86B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f7683e8.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA977.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1636	windowsdesktop-runtime-6.0.21-win-x64.exe
2560	windowsdesktop-runtime-6.0.21-win-x64.exe

Loads dropped DLL 9 IoCs

pid	Process
2228	windowsdesktop-runtime-6.0.21-win-x64.exe
1636	windowsdesktop-runtime-6.0.21-win-x64.exe
1636	windowsdesktop-runtime-6.0.21-win-x64.exe
2704	MsiExec.exe
1676	MsiExec.exe
764	msiexec.exe
764	msiexec.exe
2004	MsiExec.exe
1752	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\31	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\Dependents	windowsdesktop-runtime-6.0.21-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.87.64723_x64	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\PackageName = "dotnet-runtime-6.0.21-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6}v48.87.64667\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\ = "{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DD7FB6FA21B25C0419C9E29C0945BB1E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E29CE2D8309552B4496081B2E8AF38F4\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8D2EC92E-5903-4B25-9406-182B8EFA834F}v48.87.64667\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\SourceList\PackageName = "windowsdesktop-runtime-6.0.21-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BE3E5325A595AB443B7CED4E083B14EB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8D2EC92E-5903-4B25-9406-182B8EFA834F}v48.87.64667\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\78FE739DD11F877479C37BE171F8590D\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.87.64667_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\Version = "811072667"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.87.64723_x64\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.21 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\094F9C7997352096B7082D27C35AD959	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\Version = "811072723"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\PackageCode = "F3EE2D1AE943B6A42849618D009E9E0C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6}v48.87.64667\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\527B4FA944956476D4A7C20451951DD2	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\527B4FA944956476D4A7C20451951DD2\78FE739DD11F877479C37BE171F8590D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\Dependents\{0f39db03-9030-48f3-82ef-5384bed81d85}	windowsdesktop-runtime-6.0.21-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F53FF62BBDAF9C479AD9721D08BE06C\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64\Version = "48.87.64667"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E29CE2D8309552B4496081B2E8AF38F4\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\78FE739DD11F877479C37BE171F8590D\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\78FE739DD11F877479C37BE171F8590D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\SourceList\PackageName = "dotnet-hostfxr-6.0.21-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\Version = "48.87.64667"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.87.64723_x64\Dependents	windowsdesktop-runtime-6.0.21-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BE3E5325A595AB443B7CED4E083B14EB\E29CE2D8309552B4496081B2E8AF38F4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64\Dependents\{0f39db03-9030-48f3-82ef-5384bed81d85}	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DD7FB6FA21B25C0419C9E29C0945BB1E\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\ = "{0f39db03-9030-48f3-82ef-5384bed81d85}"	windowsdesktop-runtime-6.0.21-win-x64.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
764	msiexec.exe
764	msiexec.exe
764	msiexec.exe
764	msiexec.exe
764	msiexec.exe
764	msiexec.exe
764	msiexec.exe
764	msiexec.exe
2252	chrome.exe
2252	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeSecurityPrivilege	764	msiexec.exe
Token: SeCreateTokenPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeLockMemoryPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeMachineAccountPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeTcbPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSecurityPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeTakeOwnershipPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeLoadDriverPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemProfilePrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemtimePrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeProfSingleProcessPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncBasePriorityPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreatePagefilePrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreatePermanentPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeBackupPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRestorePrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeShutdownPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeDebugPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeAuditPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemEnvironmentPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeChangeNotifyPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRemoteShutdownPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeUndockPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSyncAgentPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeEnableDelegationPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeManageVolumePrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeImpersonatePrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreateGlobalPrivilege	2560	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe
Token: SeRestorePrivilege	764	msiexec.exe
Token: SeTakeOwnershipPrivilege	764	msiexec.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1636	windowsdesktop-runtime-6.0.21-win-x64.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1636	2228	windowsdesktop-runtime-6.0.21-win-x64.exe	28
PID 2228 wrote to memory of 1636	2228	windowsdesktop-runtime-6.0.21-win-x64.exe	28
PID 2228 wrote to memory of 1636	2228	windowsdesktop-runtime-6.0.21-win-x64.exe	28
PID 2228 wrote to memory of 1636	2228	windowsdesktop-runtime-6.0.21-win-x64.exe	28
PID 2228 wrote to memory of 1636	2228	windowsdesktop-runtime-6.0.21-win-x64.exe	28
PID 2228 wrote to memory of 1636	2228	windowsdesktop-runtime-6.0.21-win-x64.exe	28
PID 2228 wrote to memory of 1636	2228	windowsdesktop-runtime-6.0.21-win-x64.exe	28
PID 1636 wrote to memory of 2560	1636	windowsdesktop-runtime-6.0.21-win-x64.exe	29
PID 1636 wrote to memory of 2560	1636	windowsdesktop-runtime-6.0.21-win-x64.exe	29
PID 1636 wrote to memory of 2560	1636	windowsdesktop-runtime-6.0.21-win-x64.exe	29
PID 1636 wrote to memory of 2560	1636	windowsdesktop-runtime-6.0.21-win-x64.exe	29
PID 1636 wrote to memory of 2560	1636	windowsdesktop-runtime-6.0.21-win-x64.exe	29
PID 1636 wrote to memory of 2560	1636	windowsdesktop-runtime-6.0.21-win-x64.exe	29
PID 1636 wrote to memory of 2560	1636	windowsdesktop-runtime-6.0.21-win-x64.exe	29
PID 764 wrote to memory of 2704	764	msiexec.exe	31
PID 764 wrote to memory of 2704	764	msiexec.exe	31
PID 764 wrote to memory of 2704	764	msiexec.exe	31
PID 764 wrote to memory of 2704	764	msiexec.exe	31
PID 764 wrote to memory of 2704	764	msiexec.exe	31
PID 764 wrote to memory of 2704	764	msiexec.exe	31
PID 764 wrote to memory of 2704	764	msiexec.exe	31
PID 764 wrote to memory of 1676	764	msiexec.exe	32
PID 764 wrote to memory of 1676	764	msiexec.exe	32
PID 764 wrote to memory of 1676	764	msiexec.exe	32
PID 764 wrote to memory of 1676	764	msiexec.exe	32
PID 764 wrote to memory of 1676	764	msiexec.exe	32
PID 764 wrote to memory of 1676	764	msiexec.exe	32
PID 764 wrote to memory of 1676	764	msiexec.exe	32
PID 764 wrote to memory of 2004	764	msiexec.exe	33
PID 764 wrote to memory of 2004	764	msiexec.exe	33
PID 764 wrote to memory of 2004	764	msiexec.exe	33
PID 764 wrote to memory of 2004	764	msiexec.exe	33
PID 764 wrote to memory of 2004	764	msiexec.exe	33
PID 764 wrote to memory of 2004	764	msiexec.exe	33
PID 764 wrote to memory of 2004	764	msiexec.exe	33
PID 764 wrote to memory of 1752	764	msiexec.exe	34
PID 764 wrote to memory of 1752	764	msiexec.exe	34
PID 764 wrote to memory of 1752	764	msiexec.exe	34
PID 764 wrote to memory of 1752	764	msiexec.exe	34
PID 764 wrote to memory of 1752	764	msiexec.exe	34
PID 764 wrote to memory of 1752	764	msiexec.exe	34
PID 764 wrote to memory of 1752	764	msiexec.exe	34
PID 2252 wrote to memory of 2540	2252	chrome.exe	38
PID 2252 wrote to memory of 2540	2252	chrome.exe	38
PID 2252 wrote to memory of 2540	2252	chrome.exe	38
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40
PID 2252 wrote to memory of 2888	2252	chrome.exe	40

C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.21-win-x64.exe
"C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.21-win-x64.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\Temp\{D92B7B96-7CB8-47A3-9B82-A211DC888555}\.cr\windowsdesktop-runtime-6.0.21-win-x64.exe
  "C:\Windows\Temp\{D92B7B96-7CB8-47A3-9B82-A211DC888555}\.cr\windowsdesktop-runtime-6.0.21-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.21-win-x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\Temp\{5270FC03-3DE6-412D-8663-F483F07A5CC2}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe
    "C:\Windows\Temp\{5270FC03-3DE6-412D-8663-F483F07A5CC2}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe" -q -burn.elevated BurnPipe.{57CC69C8-EB7C-4BF8-AD27-AE3F37C3F795} {DCC14A19-1C64-4E55-BA43-5E5962525E0E} 1636
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2560

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F3240EB603DCDBA01EAD5ED720DBC7D9
  2⤵
  - Loads dropped DLL
  PID:2704
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 96291251C291C4BCF0D181271CBB4657
  2⤵
  - Loads dropped DLL
  PID:1676
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B2FC12A7178B8924F8B1521F76A433F1
  2⤵
  - Loads dropped DLL
  PID:2004
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0FB27DB9C952D031DCF5C02EC02F156E
  2⤵
  - Loads dropped DLL
  PID:1752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67c9758,0x7fef67c9768,0x7fef67c9778
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1104 --field-trial-handle=1368,i,8471668256459180068,1188735016484887488,131072 /prefetch:2
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1388 --field-trial-handle=1368,i,8471668256459180068,1188735016484887488,131072 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1368,i,8471668256459180068,1188735016484887488,131072 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2132 --field-trial-handle=1368,i,8471668256459180068,1188735016484887488,131072 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2268 --field-trial-handle=1368,i,8471668256459180068,1188735016484887488,131072 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1676 --field-trial-handle=1368,i,8471668256459180068,1188735016484887488,131072 /prefetch:2
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1248 --field-trial-handle=1368,i,8471668256459180068,1188735016484887488,131072 /prefetch:1
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3444 --field-trial-handle=1368,i,8471668256459180068,1188735016484887488,131072 /prefetch:8
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3452 --field-trial-handle=1368,i,8471668256459180068,1188735016484887488,131072 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3680 --field-trial-handle=1368,i,8471668256459180068,1188735016484887488,131072 /prefetch:8
  2⤵
  PID:1900

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7683e3.rbs

Filesize
55KB

MD5
d7c70972baa0a73ce568849fae84568a

SHA1
eedcd7e9b78290560dd4fa67fb0bc3f03d9b7642

SHA256
5d1df236a06bcc4d3e07ad12315bb9d82711fbad64b0b2c050e7593cb55a4ecc

SHA512
ff54b95675a39c686a89e91ee29b731cc1ffeebe1221ec994cdfa004f7937be2f800555a28a8ec59cc89667063b5444a262f90e797cd6e5f2db9db97da47a427

Download Submit
C:\Config.Msi\f7683e9.rbs

Filesize
8KB

MD5
2e3788fc281a1f21422b332970ba4215

SHA1
0023f7fcadb3b160ce00754ed2aae5d510b1b85a

SHA256
4754a4af2a16e564b8026231b5ec28eeda83f40906f42d921c71eed51b275496

SHA512
2b286803541a10d2eed180abe0d837b1e76d4f73edff0bcb8cbba4b19deee06a3d89c70ea7836bc2472fa6facd8203fb3c4c487039dbbfdb2646c5b874a70e9b

Download Submit
C:\Config.Msi\f7683ef.rbs

Filesize
9KB

MD5
240587a44e166def651f185f9c317071

SHA1
457e863d90ba9537e3d133d082f62b834c602155

SHA256
153481d3378cff6006b9b5519af61a01ff5a1bcb1a9873f4e6030f918bff08da

SHA512
e8148bf472a0a6b596a715398e7faef3a90d2703c82ec46122519fa5774866fcd61836bb3c739624dd0077376adac3db26f8109bb1fd6f2188fd9e0111691996

Download Submit
C:\Config.Msi\f7683f5.rbs

Filesize
87KB

MD5
4053f8b2112e18159c0c35c019bd3760

SHA1
816dd160088ebf6b658e27b512eec5b42513fc9e

SHA256
4cc02279fc2680cdfa4f62fcc9a9264e8eaea87a21b9cfd5c6adc7c885c638d3

SHA512
9c11002ebeb4c36780cee451c5742b70f5c7d235dbca962a1059dcdaa86ccb8b3a6ac611a75ddb670bf4e4474bf02ba8d15d8f71dd7d2d03086b5d0091361ae4

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5c4d55d022fa98a863e39ca70031056

SHA1
074ce9bd4f7d14b76bd5f768af2655fec0dbd5a6

SHA256
ff616191a4520f68a590fa1b24d00d81c11c617dcbbdf7721dd57c297138da97

SHA512
340ef8ed436364a6f9cc03862e6a21bd1bc448677f9b0f52c71599b02c90eacf511b2a0c65815c40d21ad8a3ffe530ec0c27580ac47c93a7dee8fc51a2e2f2f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73b978ee1f416b506f3d4d0c6f01d428

SHA1
74f4654f646a5ce5a06f57d9c286d75617896a01

SHA256
0ec9cf34e0b99a0e53db264fa37e16624d4b3b54777bd5c9905c62a2014af8e6

SHA512
25c7ba46b2ca3c6ba85830392bbb278862415e39f2e416b17a4f4ec95cbbd66089bd8ed81e17a5ad2c776f993eb356ad6fde498d2843fa03009747d8b53b5930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e461555b121284bc086bb13c5a1e907

SHA1
d94112cdf35ba6dce97f5f39eab7693b5f4100fe

SHA256
7ff1de69f95f24acbd4b6f049e1b0a770a095404fb78318e5b7106a8efc0ec73

SHA512
7c442c5293ef70b45dd673535ee69ec02c4deac334868cc81377299b629ce100f2f748a519bd0998c66be3cb178435deb44d5d9e5f0e9917c0e9757b5bcd0467

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
8ee650764d3618ac74c3f945353e03d5

SHA1
eb78e891dfa3baea402260a5275d14eaf83b5181

SHA256
e217291e47aad1b96261e00baf95ac6694b614dd2265e53ee7fcfa6ef58eb982

SHA512
c36e5646fef7656d74801878053e8ec30a4e92299a19e1ad31d5ea2d23c1b9ce37a4d0bf4a9a67d0c0b1e8dd1c1133f666ba9e914b3259e6691022f9924ab566

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
3e93848e872aae9c3e9d53888e3af6ec

SHA1
c0bec6b1be3e98875fb4381f724ccc385a898f3b

SHA256
7dcd3b230ebd42ef574230a39b250e70e6f72371bd63a728848efec7cca0e252

SHA512
a5df341cea5745edd5567b88ee8e5bbf9e809403903192c376e827ea177f3d1932bc6b41578b735df2329e7dd41c29f87094d11cde52daab69dd7d4f4f486029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab86CE.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20230917160820_000_dotnet_runtime_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
c765e10aed6ce76f956a639cedd6a80b

SHA1
fb390bcdf38b3b825b7d6510a3654dd848db3ed5

SHA256
1456c2158fafd694f11904d1ef47cb395b88b75daf5fe91e0f642d0da3fd8218

SHA512
4c0b7fbd8bdc7a92a2ad5f4fbf9fdc1484b585c3c41c1b58fc48f55ef4082acf938ef04c9098fbd809208e676e2e138518c33d821d3095b214d36254d8c3384f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20230917160820_001_dotnet_hostfxr_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
57895a546f61bd897fc87e3e429b252e

SHA1
7db0bc1406af0cb02594a429b3139060461f7f8a

SHA256
216ce76cee871947ebde5e3e93ce8bcdea2807be022491530b2019c2ab8ae45f

SHA512
437bb68aca7dca6fa872c54dc7c2cffbd5f1e4e5db75becad347ba235cb7c4a796a677d683c55ab3ea830eafc8c5750def6466a0754a26e114b24ad782baf965

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20230917160820_002_dotnet_host_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
1b7b68478f74a7c398be09be0b3a3f9b

SHA1
067a218fae3c6c38d8b09ad81f735607bf2dfcdc

SHA256
d8edea11288c2d519181a5046d5c2b18c9761ed58296843dc8280a8054c32b04

SHA512
fbdae5c1d413ac3f8464b427131b65b83a99afaa1c5b33b44ebd1dd46b53e02cb518b9902e56bd471bde3a8d4c0bea4adb41b905e547c7d577e1c80f8e26b627

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20230917160820_003_windowsdesktop_runtime_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
ddad36dcd8f3d07906deb20184e7f160

SHA1
0b7eedef1ab3ef3c258175b0008a417a3dc823d1

SHA256
e9c00f490736784166ef37d4ad38981035c3923a4f94f59bcc71173446770dc0

SHA512
948dbe350b109fb17c8271b040ee46843fb28cf75ba308599d49c653ecc785faac9f8ed64a72962c6b3d3b9c829215fccf8d38406569dbb4cdcef1a49ea59870

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8700.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Windows\Installer\MSI9BF9.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIA977.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIB09E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIB09E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIC676.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\f7683df.msi

Filesize
25.7MB

MD5
0fda2bb0ba0c1dd265e9540265a035b7

SHA1
03461f9f268e5ec0a997990c05b16086a03505dc

SHA256
bb994af42653ab3738ea3b689f6870c2549f6f170f23a1a8a161c7e02ccec9b1

SHA512
acdcb21c4ac6587b7a7cc43078a075f2f06d71823ace65e175611e0ef8af2bc7c753b7618447ba6d9f24cbea63cf582bcd5f71ca3b7a79066ca6cd61c43ed7d6

Download Submit
C:\Windows\Installer\f7683e5.msi

Filesize
804KB

MD5
5dce0ef6b5d0bd2b850106a22b5e0264

SHA1
263cfbd815de6b877d084ab4b3d2f878d71c9b1f

SHA256
c98010f7c473bdb2a182e61aae35a20c044006fee26ffb378346cbdf255d2736

SHA512
fc7297d142cf8d0247ac86732182a031e819a4fc41b034d1b9a7dba5cdb56d73e158dd57132b6a083b3f6184859b4dca4a1a21205f6d11b2be6ca3913e89891b

Download Submit
C:\Windows\Installer\f7683f6.msi

Filesize
28.5MB

MD5
6ec2d8f7944d0766603fa3b043fe2410

SHA1
000a79c4792abbfdf65ca3b5367b7a3b02146732

SHA256
619074e13358e2c259086bf306083229ae8d3472187bc755951413858949cb68

SHA512
4f86befae9a437985e4ae491f416b0c06a72344ffccfb00c325e91d48244b46edee784003c0a519bc39fdb14409d949c7fe7cde7f51b3479d504c61d88f6371b

Download Submit
C:\Windows\Temp\{5270FC03-3DE6-412D-8663-F483F07A5CC2}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{5270FC03-3DE6-412D-8663-F483F07A5CC2}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{5270FC03-3DE6-412D-8663-F483F07A5CC2}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{5270FC03-3DE6-412D-8663-F483F07A5CC2}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{5270FC03-3DE6-412D-8663-F483F07A5CC2}\dotnet_host_6.0.21_win_x64.msi

Filesize
736KB

MD5
12b8c5914e56f4bd933c8490f7f6cd45

SHA1
2ec135cdd97adbcfe7decb04f1a5e95b6f0614e3

SHA256
3b83682de5bfeabde75ffc34330f470df11ce5e62c2509c50b3e48e35130fa51

SHA512
ecc9ddd52d097ca6f643f7ce78399b01d37e776e30abb8b82b6278711716e6893528340b6719f8287848931759ae41427c252cb00df97742583dbe5d7ea4277a

Download Submit
C:\Windows\Temp\{5270FC03-3DE6-412D-8663-F483F07A5CC2}\dotnet_hostfxr_6.0.21_win_x64.msi

Filesize
804KB

MD5
5dce0ef6b5d0bd2b850106a22b5e0264

SHA1
263cfbd815de6b877d084ab4b3d2f878d71c9b1f

SHA256
c98010f7c473bdb2a182e61aae35a20c044006fee26ffb378346cbdf255d2736

SHA512
fc7297d142cf8d0247ac86732182a031e819a4fc41b034d1b9a7dba5cdb56d73e158dd57132b6a083b3f6184859b4dca4a1a21205f6d11b2be6ca3913e89891b

Download Submit
C:\Windows\Temp\{5270FC03-3DE6-412D-8663-F483F07A5CC2}\dotnet_runtime_6.0.21_win_x64.msi

Filesize
25.7MB

MD5
0fda2bb0ba0c1dd265e9540265a035b7

SHA1
03461f9f268e5ec0a997990c05b16086a03505dc

SHA256
bb994af42653ab3738ea3b689f6870c2549f6f170f23a1a8a161c7e02ccec9b1

SHA512
acdcb21c4ac6587b7a7cc43078a075f2f06d71823ace65e175611e0ef8af2bc7c753b7618447ba6d9f24cbea63cf582bcd5f71ca3b7a79066ca6cd61c43ed7d6

Download Submit
C:\Windows\Temp\{5270FC03-3DE6-412D-8663-F483F07A5CC2}\windowsdesktop_runtime_6.0.21_win_x64.msi

Filesize
28.5MB

MD5
6ec2d8f7944d0766603fa3b043fe2410

SHA1
000a79c4792abbfdf65ca3b5367b7a3b02146732

SHA256
619074e13358e2c259086bf306083229ae8d3472187bc755951413858949cb68

SHA512
4f86befae9a437985e4ae491f416b0c06a72344ffccfb00c325e91d48244b46edee784003c0a519bc39fdb14409d949c7fe7cde7f51b3479d504c61d88f6371b

Download Submit
C:\Windows\Temp\{D92B7B96-7CB8-47A3-9B82-A211DC888555}\.cr\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{D92B7B96-7CB8-47A3-9B82-A211DC888555}\.cr\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
\Program Files\dotnet\dotnet.exe

Filesize
133KB

MD5
54a71118efdb67dbbe816765908b6cf4

SHA1
10d2e20e4042f91cdadd0a5bc1e09b9ea79eb88a

SHA256
d2607dbc6c95c252baaba299b659f156b388c6130ac846f79eb4c768f91a019f

SHA512
77a4a33340f5ac8b5eb7f690526bbc1fa31f6855354c98c44ff77b92fd6f560a15405bb22e747c217bb8343dc7b9390d0ff25ed8b405a95f601dc06222bbc000

Download Submit
\Program Files\dotnet\dotnet.exe

Filesize
133KB

MD5
54a71118efdb67dbbe816765908b6cf4

SHA1
10d2e20e4042f91cdadd0a5bc1e09b9ea79eb88a

SHA256
d2607dbc6c95c252baaba299b659f156b388c6130ac846f79eb4c768f91a019f

SHA512
77a4a33340f5ac8b5eb7f690526bbc1fa31f6855354c98c44ff77b92fd6f560a15405bb22e747c217bb8343dc7b9390d0ff25ed8b405a95f601dc06222bbc000

Download Submit
\Windows\Installer\MSI9BF9.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSIA977.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSIB09E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSIC676.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Temp\{5270FC03-3DE6-412D-8663-F483F07A5CC2}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
\Windows\Temp\{5270FC03-3DE6-412D-8663-F483F07A5CC2}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
\Windows\Temp\{D92B7B96-7CB8-47A3-9B82-A211DC888555}\.cr\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit