0b136ebad5e9be01570aecd0c92906371c20729e09de4e7b2e3994be829d771d

Analysis

max time kernel
160s
max time network
169s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
09/10/2023, 13:19

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

disk-drill-win.exe
Size

18.6MB
MD5

7dd843c7524d9d7b0cbce1ca2de894bb
SHA1

f84e6c5e6dfe61744376cbb8f465a9529e3e1543
SHA256

0b136ebad5e9be01570aecd0c92906371c20729e09de4e7b2e3994be829d771d
SHA512

d9dc3f58dfd3b5c711cadc9c0c4619c684cec00d66292aa404186cab7c8a958c8e345abf69be25ae4db6cd9688e92c42df5a0d614a461a7873010d24b84dcace
SSDEEP

393216:EtZSoFIFfYIyffUsoPA/ib9gPP/5XcJtH3vNuuftlh:EIFfnOcsoPA+qWH/Nuezh

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET6C6C.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET6C6C.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\dokan1.sys	MsiExec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{49b90425-d03c-4b56-b8ba-0ccd425f5863} = "\"C:\\ProgramData\\Package Cache\\{49b90425-d03c-4b56-b8ba-0ccd425f5863}\\DiskDrillSetup.5.3.826.0.exe\" /burn.runonce"	DiskDrillSetup.5.3.826.0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d92971ab-f030-43c8-8545-c66c818d0e05} = "\"C:\\ProgramData\\Package Cache\\{d92971ab-f030-43c8-8545-c66c818d0e05}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d260fcb6-95b8-4c81-8e07-ce75876ffca2} = "\"C:\\ProgramData\\Package Cache\\{d260fcb6-95b8-4c81-8e07-ce75876ffca2}\\windowsdesktop-runtime-7.0.8-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-7.0.8-win-x64.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
31	1312	msiexec.exe
37	1312	msiexec.exe
39	1312	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\DRVSTORE\dokan_C9C23E1918E5ABD45F0BAFDE646F163969BA20F8\dokan.inf	MsiExec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dokanfuse1.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\System32\dokanfuse1.dll	msiexec.exe
File created	C:\Windows\System32\dokan1.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\DRVSTORE\dokan_C9C23E1918E5ABD45F0BAFDE646F163969BA20F8\dokan1.cat	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\dokan_C9C23E1918E5ABD45F0BAFDE646F163969BA20F8\dokan1.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRVSTORE	MsiExec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dokan1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\System32\dokannp1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dokannp1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\DRVSTORE\dokan_C9C23E1918E5ABD45F0BAFDE646F163969BA20F8\dokan.inf	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\es\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\zh-Hant\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\ko\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\PresentationFramework.AeroLite.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\de\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\System.Windows.Controls.Ribbon.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\pt-BR\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\it\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\it\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\Dokan\Dokan Library-1.5.1\sample\memfs\filenodes.cpp	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\PresentationFramework.Classic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Memory.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Threading.Thread.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Xml.XPath.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\cs\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\pl\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\ru\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Text.Encoding.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Transactions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.ComponentModel.DataAnnotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Runtime.Intrinsics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\System.Drawing.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\DirectWriteForwarder.dll	msiexec.exe
File created	C:\Program Files\Dokan\Dokan Library-1.5.1\dokan1.dll	msiexec.exe
File created	C:\Program Files\Dokan\Dokan Library-1.5.1\sample\memfs\dokan1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\Dokan\Dokan Library-1.5.1\dokanfuse1.dll	msiexec.exe
File created	C:\Program Files\Dokan\Dokan Library-1.5.1\x86\dokannp1.pdb	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.ServiceProcess.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\cs\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\de\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Text.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\System.DirectoryServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\vcruntime140_cor3.dll	msiexec.exe
File created	C:\Program Files\Dokan\Dokan Library-1.5.1\include\fuse.h	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\fr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\cs\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\tr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\de\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\Dokan\Dokan Library-1.5.1\x86\libdokanfuse1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\pl\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\pl\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\ja\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\es\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.8\pl\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\Dokan\Dokan Library-1.5.1\x86\dokanfuse1.pdb	msiexec.exe
File created	C:\Program Files\Dokan\Dokan Library-1.5.1\x86\dokanctl.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.8\System.Linq.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI31CA.tmp	msiexec.exe
File created	C:\Windows\Installer\e58d0a9.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B45C77BA-0B4E-4FBB-99B9-9774ECBE20AA}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2DB1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EFE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99AC.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE5BF.tmp	msiexec.exe
File created	C:\Windows\Installer\e58d0d6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58d0d7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6BC2.tmp	msiexec.exe
File created	C:\Windows\Installer\{65A3A964-3DC3-0105-0001-211126123627}\DokanIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7097.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC725.tmp-\msiGaCustomAction.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2BE9.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{19FCE07F-2A75-44AC-9EA5-8E29FE2F8DBE}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI38F2.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{65A3A964-3DC3-0105-0001-211126123627}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3133BC55-90BD-4B87-82A2-6670B3CAFB81}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66FD.tmp	msiexec.exe
File created	C:\Windows\Installer\e58d0d7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3013.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI34CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58d0e1.msi	msiexec.exe
File created	C:\Windows\Installer\e58d0e6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58d0bc.msi	msiexec.exe
File created	C:\Windows\Installer\e58d0d1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI16C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99AC.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID87B.tmp	msiexec.exe
File created	C:\Windows\Installer\e58d0d2.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{174E0D7C-F2C9-49A2-83FB-95A0FE6FA023}	msiexec.exe
File opened for modification	C:\Windows\Installer\e58d0d2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI29F4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58d0eb.msi	msiexec.exe
File created	C:\Windows\Installer\e58d0ea.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{65A3A964-3DC3-0105-0001-211126123627}\DokanIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC725.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC725.tmp-\libSoftMeter.dll	rundll32.exe
File created	C:\Windows\Installer\e58d0db.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58d0dc.msi	msiexec.exe
File created	C:\Windows\Installer\e58d0e1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7DA37AE3-D8AE-49B1-9BDC-23CA0AB9FF22}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC725.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2417.tmp	msiexec.exe
File created	C:\Windows\Installer\e58d0e5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58d0e6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6575.tmp	msiexec.exe
File created	C:\Windows\Installer\e58d0eb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58d0a9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID52D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE148.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99AC.tmp	msiexec.exe
File created	C:\Windows\Installer\e58d0bb.msi	msiexec.exe
File created	C:\Windows\Installer\e58d0dc.msi	msiexec.exe
File created	C:\Windows\Installer\e58d0e0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99AC.tmp-\msiGaCustomAction.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3E04.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC725.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI11D3.tmp	msiexec.exe
File created	C:\Windows\Installer\e58d0bc.msi	msiexec.exe

Executes dropped EXE 12 IoCs

pid	Process
1156	disk-drill-win.exe
4188	DiskDrillSetup.5.3.826.0.exe
4980	vc_redist.14.34.31938.x64.exe
2096	vc_redist.14.34.31938.x64.exe
5016	VC_redist.x64.exe
4984	windowsdesktop-runtime-7.0.8-win-x64.exe
212	windowsdesktop-runtime-7.0.8-win-x64.exe
332	windowsdesktop-runtime-7.0.8-win-x64.exe
3096	DokanSetup.1.5.1.1000.exe
3276	DokanSetup.1.5.1.1000.exe
3656	DokanSetup.exe
2784	dokanctl.exe

Loads dropped DLL 29 IoCs

pid	Process
1156	disk-drill-win.exe
2096	vc_redist.14.34.31938.x64.exe
5084	VC_redist.x64.exe
212	windowsdesktop-runtime-7.0.8-win-x64.exe
2712	MsiExec.exe
2712	MsiExec.exe
4980	MsiExec.exe
4980	MsiExec.exe
4744	MsiExec.exe
4744	MsiExec.exe
4356	MsiExec.exe
4356	MsiExec.exe
3276	DokanSetup.1.5.1.1000.exe
660	MsiExec.exe
1584	MsiExec.exe
4764	MsiExec.exe
2784	dokanctl.exe
660	MsiExec.exe
3108	MsiExec.exe
2700	rundll32.exe
2700	rundll32.exe
2700	rundll32.exe
3108	MsiExec.exe
3016	rundll32.exe
3016	rundll32.exe
3016	rundll32.exe
3016	rundll32.exe
608	Process not Found
608	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7D0E4719C2F2A9438BF590AEFF60A32\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7D0E4719C2F2A9438BF590AEFF60A32\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\469A3A563CD350100010121162216372\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55CB3313DB0978B4282A66073BACBF18\PackageCode = "A20A7DFF4B859C944ACF30AF16AA857D"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.35.63153_x64\Dependents	windowsdesktop-runtime-7.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\469A3A563CD350100010121162216372\DokanDevFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{5F030BFA-CE6E-408A-9694-F593B319DBBE}\Version = "1.5.1.1000"	DokanSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{5F030BFA-CE6E-408A-9694-F593B319DBBE}\Dependents	DokanSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\469A3A563CD350100010121162216372\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{d260fcb6-95b8-4c81-8e07-ce75876ffca2}\Dependents	windowsdesktop-runtime-7.0.8-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB77C54BE4B0BBF4999B7947CEEB02AA\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7D0E4719C2F2A9438BF590AEFF60A32\Version = "941880999"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.35.63143_x64\Dependents	windowsdesktop-runtime-7.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\46C08FE26A801EF4EB2931DF92C338B1\469A3A563CD350100010121162216372	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{d260fcb6-95b8-4c81-8e07-ce75876ffca2}\Dependents\{d260fcb6-95b8-4c81-8e07-ce75876ffca2}	windowsdesktop-runtime-7.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.35.63143_x64\DisplayName = "Microsoft .NET Runtime - 7.0.8 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C035A7E641F5DE543DB8CEC8B4A20490\C7D0E4719C2F2A9438BF590AEFF60A32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55CB3313DB0978B4282A66073BACBF18\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.34.31938"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F70ECF9157A2CA44E95AE892EFF2D8EB\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\ = "{19FCE07F-2A75-44AC-9EA5-8E29FE2F8DBE}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7D0E4719C2F2A9438BF590AEFF60A32\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\469A3A563CD350100010121162216372	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{8E5816F9-297E-4C51-8728-6FB385159C68}	DiskDrillSetup.5.3.826.0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AB77C54BE4B0BBF4999B7947CEEB02AA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB77C54BE4B0BBF4999B7947CEEB02AA\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.35.63143_x64	windowsdesktop-runtime-7.0.8-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55CB3313DB0978B4282A66073BACBF18\SourceList\PackageName = "windowsdesktop-runtime-7.0.8-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55CB3313DB0978B4282A66073BACBF18\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{3133BC55-90BD-4B87-82A2-6670B3CAFB81}v56.35.63153\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB77C54BE4B0BBF4999B7947CEEB02AA\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{B45C77BA-0B4E-4FBB-99B9-9774ECBE20AA}v56.35.63143\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C7D0E4719C2F2A9438BF590AEFF60A32\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7D0E4719C2F2A9438BF590AEFF60A32\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F70ECF9157A2CA44E95AE892EFF2D8EB\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.34.31938"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EA73AD7EA8D1B94B9CD32ACA09BFF22\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9911C2F713F59805E00F4DDA82E472D5\55CB3313DB0978B4282A66073BACBF18	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F70ECF9157A2CA44E95AE892EFF2D8EB\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{19FCE07F-2A75-44AC-9EA5-8E29FE2F8DBE}v56.35.63143\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.34,bundle\ = "{d92971ab-f030-43c8-8545-c66c818d0e05}"	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB77C54BE4B0BBF4999B7947CEEB02AA\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7D0E4719C2F2A9438BF590AEFF60A32\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4E3F426DBD05F2A509C6867B91443826	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{8E5816F9-297E-4C51-8728-6FB385159C68}\DisplayName = "Disk Drill 5.3.826.0"	DiskDrillSetup.5.3.826.0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\06093EA0902F50D4BA7C458B9FFC3AE2	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55CB3313DB0978B4282A66073BACBF18\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7D0E4719C2F2A9438BF590AEFF60A32\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.35.63143_x64	windowsdesktop-runtime-7.0.8-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64	windowsdesktop-runtime-7.0.8-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06093EA0902F50D4BA7C458B9FFC3AE2\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.34.31938"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7D0E4719C2F2A9438BF590AEFF60A32\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{174E0D7C-F2C9-49A2-83FB-95A0FE6FA023}v56.35.63143\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\469A3A563CD350100010121162216372\SourceList\PackageName = "Dokan_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.34,bundle	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7D0E4719C2F2A9438BF590AEFF60A32\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F70ECF9157A2CA44E95AE892EFF2D8EB\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.35.63153_x64\DisplayName = "Microsoft Windows Desktop Runtime - 7.0.8 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB77C54BE4B0BBF4999B7947CEEB02AA\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F70ECF9157A2CA44E95AE892EFF2D8EB\Version = "941880999"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F70ECF9157A2CA44E95AE892EFF2D8EB\SourceList\Net	msiexec.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe
1312	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	4072	vssvc.exe
Token: SeRestorePrivilege	4072	vssvc.exe
Token: SeAuditPrivilege	4072	vssvc.exe
Token: SeBackupPrivilege	4588	srtasks.exe
Token: SeRestorePrivilege	4588	srtasks.exe
Token: SeSecurityPrivilege	4588	srtasks.exe
Token: SeTakeOwnershipPrivilege	4588	srtasks.exe
Token: SeBackupPrivilege	4588	srtasks.exe
Token: SeRestorePrivilege	4588	srtasks.exe
Token: SeSecurityPrivilege	4588	srtasks.exe
Token: SeTakeOwnershipPrivilege	4588	srtasks.exe
Token: SeShutdownPrivilege	5016	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	5016	VC_redist.x64.exe
Token: SeSecurityPrivilege	1312	msiexec.exe
Token: SeCreateTokenPrivilege	5016	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	5016	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	5016	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	5016	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	5016	VC_redist.x64.exe
Token: SeTcbPrivilege	5016	VC_redist.x64.exe
Token: SeSecurityPrivilege	5016	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	5016	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	5016	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	5016	VC_redist.x64.exe
Token: SeSystemtimePrivilege	5016	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	5016	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	5016	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	5016	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	5016	VC_redist.x64.exe
Token: SeBackupPrivilege	5016	VC_redist.x64.exe
Token: SeRestorePrivilege	5016	VC_redist.x64.exe
Token: SeShutdownPrivilege	5016	VC_redist.x64.exe
Token: SeDebugPrivilege	5016	VC_redist.x64.exe
Token: SeAuditPrivilege	5016	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	5016	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	5016	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	5016	VC_redist.x64.exe
Token: SeUndockPrivilege	5016	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	5016	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	5016	VC_redist.x64.exe
Token: SeManageVolumePrivilege	5016	VC_redist.x64.exe
Token: SeImpersonatePrivilege	5016	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	5016	VC_redist.x64.exe
Token: SeRestorePrivilege	1312	msiexec.exe
Token: SeTakeOwnershipPrivilege	1312	msiexec.exe
Token: SeRestorePrivilege	1312	msiexec.exe
Token: SeTakeOwnershipPrivilege	1312	msiexec.exe
Token: SeRestorePrivilege	1312	msiexec.exe
Token: SeTakeOwnershipPrivilege	1312	msiexec.exe
Token: SeRestorePrivilege	1312	msiexec.exe
Token: SeTakeOwnershipPrivilege	1312	msiexec.exe
Token: SeRestorePrivilege	1312	msiexec.exe
Token: SeTakeOwnershipPrivilege	1312	msiexec.exe
Token: SeRestorePrivilege	1312	msiexec.exe
Token: SeTakeOwnershipPrivilege	1312	msiexec.exe
Token: SeRestorePrivilege	1312	msiexec.exe
Token: SeTakeOwnershipPrivilege	1312	msiexec.exe
Token: SeRestorePrivilege	1312	msiexec.exe
Token: SeTakeOwnershipPrivilege	1312	msiexec.exe
Token: SeRestorePrivilege	1312	msiexec.exe
Token: SeTakeOwnershipPrivilege	1312	msiexec.exe
Token: SeRestorePrivilege	1312	msiexec.exe
Token: SeTakeOwnershipPrivilege	1312	msiexec.exe
Token: SeRestorePrivilege	1312	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1156	disk-drill-win.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3816	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1156	1052	disk-drill-win.exe	70
PID 1052 wrote to memory of 1156	1052	disk-drill-win.exe	70
PID 1052 wrote to memory of 1156	1052	disk-drill-win.exe	70
PID 1156 wrote to memory of 4188	1156	disk-drill-win.exe	71
PID 1156 wrote to memory of 4188	1156	disk-drill-win.exe	71
PID 1156 wrote to memory of 4188	1156	disk-drill-win.exe	71
PID 4188 wrote to memory of 4980	4188	DiskDrillSetup.5.3.826.0.exe	78
PID 4188 wrote to memory of 4980	4188	DiskDrillSetup.5.3.826.0.exe	78
PID 4188 wrote to memory of 4980	4188	DiskDrillSetup.5.3.826.0.exe	78
PID 4980 wrote to memory of 2096	4980	vc_redist.14.34.31938.x64.exe	79
PID 4980 wrote to memory of 2096	4980	vc_redist.14.34.31938.x64.exe	79
PID 4980 wrote to memory of 2096	4980	vc_redist.14.34.31938.x64.exe	79
PID 2096 wrote to memory of 5016	2096	vc_redist.14.34.31938.x64.exe	80
PID 2096 wrote to memory of 5016	2096	vc_redist.14.34.31938.x64.exe	80
PID 2096 wrote to memory of 5016	2096	vc_redist.14.34.31938.x64.exe	80
PID 5016 wrote to memory of 3260	5016	VC_redist.x64.exe	84
PID 5016 wrote to memory of 3260	5016	VC_redist.x64.exe	84
PID 5016 wrote to memory of 3260	5016	VC_redist.x64.exe	84
PID 3260 wrote to memory of 5084	3260	VC_redist.x64.exe	85
PID 3260 wrote to memory of 5084	3260	VC_redist.x64.exe	85
PID 3260 wrote to memory of 5084	3260	VC_redist.x64.exe	85
PID 5084 wrote to memory of 4704	5084	VC_redist.x64.exe	86
PID 5084 wrote to memory of 4704	5084	VC_redist.x64.exe	86
PID 5084 wrote to memory of 4704	5084	VC_redist.x64.exe	86
PID 4188 wrote to memory of 4984	4188	DiskDrillSetup.5.3.826.0.exe	87
PID 4188 wrote to memory of 4984	4188	DiskDrillSetup.5.3.826.0.exe	87
PID 4188 wrote to memory of 4984	4188	DiskDrillSetup.5.3.826.0.exe	87
PID 4984 wrote to memory of 212	4984	windowsdesktop-runtime-7.0.8-win-x64.exe	88
PID 4984 wrote to memory of 212	4984	windowsdesktop-runtime-7.0.8-win-x64.exe	88
PID 4984 wrote to memory of 212	4984	windowsdesktop-runtime-7.0.8-win-x64.exe	88
PID 212 wrote to memory of 332	212	windowsdesktop-runtime-7.0.8-win-x64.exe	89
PID 212 wrote to memory of 332	212	windowsdesktop-runtime-7.0.8-win-x64.exe	89
PID 212 wrote to memory of 332	212	windowsdesktop-runtime-7.0.8-win-x64.exe	89
PID 1312 wrote to memory of 2712	1312	msiexec.exe	90
PID 1312 wrote to memory of 2712	1312	msiexec.exe	90
PID 1312 wrote to memory of 2712	1312	msiexec.exe	90
PID 1312 wrote to memory of 4980	1312	msiexec.exe	91
PID 1312 wrote to memory of 4980	1312	msiexec.exe	91
PID 1312 wrote to memory of 4980	1312	msiexec.exe	91
PID 1312 wrote to memory of 4744	1312	msiexec.exe	92
PID 1312 wrote to memory of 4744	1312	msiexec.exe	92
PID 1312 wrote to memory of 4744	1312	msiexec.exe	92
PID 1312 wrote to memory of 4356	1312	msiexec.exe	93
PID 1312 wrote to memory of 4356	1312	msiexec.exe	93
PID 1312 wrote to memory of 4356	1312	msiexec.exe	93
PID 4188 wrote to memory of 3096	4188	DiskDrillSetup.5.3.826.0.exe	94
PID 4188 wrote to memory of 3096	4188	DiskDrillSetup.5.3.826.0.exe	94
PID 4188 wrote to memory of 3096	4188	DiskDrillSetup.5.3.826.0.exe	94
PID 3096 wrote to memory of 3276	3096	DokanSetup.1.5.1.1000.exe	95
PID 3096 wrote to memory of 3276	3096	DokanSetup.1.5.1.1000.exe	95
PID 3096 wrote to memory of 3276	3096	DokanSetup.1.5.1.1000.exe	95
PID 3276 wrote to memory of 3656	3276	DokanSetup.1.5.1.1000.exe	96
PID 3276 wrote to memory of 3656	3276	DokanSetup.1.5.1.1000.exe	96
PID 3276 wrote to memory of 3656	3276	DokanSetup.1.5.1.1000.exe	96
PID 1312 wrote to memory of 660	1312	msiexec.exe	97
PID 1312 wrote to memory of 660	1312	msiexec.exe	97
PID 1312 wrote to memory of 1584	1312	msiexec.exe	98
PID 1312 wrote to memory of 1584	1312	msiexec.exe	98
PID 1312 wrote to memory of 4764	1312	msiexec.exe	99
PID 1312 wrote to memory of 4764	1312	msiexec.exe	99
PID 1312 wrote to memory of 4764	1312	msiexec.exe	99
PID 4764 wrote to memory of 2784	4764	MsiExec.exe	100
PID 4764 wrote to memory of 2784	4764	MsiExec.exe	100
PID 1312 wrote to memory of 3108	1312	msiexec.exe	102

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe
"C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\Temp\{B215C943-D1C5-4C89-AACD-0BE50AA65E1A}\.cr\disk-drill-win.exe
  "C:\Windows\Temp\{B215C943-D1C5-4C89-AACD-0BE50AA65E1A}\.cr\disk-drill-win.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe" -burn.filehandle.attached=528 -burn.filehandle.self=536
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\Temp\{1E7861A7-054E-41E6-A1A8-73FDCCF97FC4}\.be\DiskDrillSetup.5.3.826.0.exe
    "C:\Windows\Temp\{1E7861A7-054E-41E6-A1A8-73FDCCF97FC4}\.be\DiskDrillSetup.5.3.826.0.exe" -q -burn.elevated BurnPipe.{4871E7B8-D5DD-46F6-859A-2AADC5B78DE3} {2ED73D9D-FD11-424A-9F14-271B75B6554F} 1156
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\ProgramData\Package Cache\4DE9F6681F0F213B132DEF3AF88A3C68483F5F32\vc_redist.14.34.31938.x64.exe
      "C:\ProgramData\Package Cache\4DE9F6681F0F213B132DEF3AF88A3C68483F5F32\vc_redist.14.34.31938.x64.exe" /norestart /q /chainingpackage ADMINDEPLOYMENT /pipe NetFxSection.{8AE5EE66-725F-4E5D-B637-669B9E2C5D63}
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4980
    - - C:\Windows\Temp\{88E165CC-F819-4EBD-8C25-9DDB96E11CC5}\.cr\vc_redist.14.34.31938.x64.exe
        
        "C:\Windows\Temp\{88E165CC-F819-4EBD-8C25-9DDB96E11CC5}\.cr\vc_redist.14.34.31938.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\4DE9F6681F0F213B132DEF3AF88A3C68483F5F32\vc_redist.14.34.31938.x64.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532 /norestart /q /chainingpackage ADMINDEPLOYMENT /pipe NetFxSection.{8AE5EE66-725F-4E5D-B637-669B9E2C5D63}
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2096
      - C:\Windows\Temp\{969C69FB-68AD-4D00-A9CB-ED156D29F367}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{969C69FB-68AD-4D00-A9CB-ED156D29F367}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{41611BD5-91F0-4B2C-86FE-8C87E12549B3} {F12DFEDD-4366-42C2-BAB0-12BF1CF64EEB} 2096
        6⤵
        Adds Run key to start application
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d92971ab-f030-43c8-8545-c66c818d0e05} -burn.filehandle.self=988 -burn.embedded BurnPipe.{8B2EB89E-9D1B-4991-9DE4-1DE303FD7EFC} {87D25296-A966-4BB7-A6F7-9E18418EBCD2} 5016
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d92971ab-f030-43c8-8545-c66c818d0e05} -burn.filehandle.self=988 -burn.embedded BurnPipe.{8B2EB89E-9D1B-4991-9DE4-1DE303FD7EFC} {87D25296-A966-4BB7-A6F7-9E18418EBCD2} 5016
        8⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{4B91D6AA-D8F1-4DA7-98CB-580A2ED0D9CF} {2BE5BE11-9D08-4984-B7D3-FD75F1B816C9} 5084
        9⤵
        
        PID:4704
  - - C:\ProgramData\Package Cache\8CD8A1621FB4A7D0B4370A5A31DF0215A05BEE23\windowsdesktop-runtime-7.0.8-win-x64.exe
      "C:\ProgramData\Package Cache\8CD8A1621FB4A7D0B4370A5A31DF0215A05BEE23\windowsdesktop-runtime-7.0.8-win-x64.exe" /norestart /q /chainingpackage ADMINDEPLOYMENT /pipe NetFxSection.{FCA4C222-6AEB-43B2-B923-C13D97C575E5}
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\Windows\Temp\{615C886E-590F-4FBC-AAAC-B3A170557CC5}\.cr\windowsdesktop-runtime-7.0.8-win-x64.exe
        
        "C:\Windows\Temp\{615C886E-590F-4FBC-AAAC-B3A170557CC5}\.cr\windowsdesktop-runtime-7.0.8-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\8CD8A1621FB4A7D0B4370A5A31DF0215A05BEE23\windowsdesktop-runtime-7.0.8-win-x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=600 /norestart /q /chainingpackage ADMINDEPLOYMENT /pipe NetFxSection.{FCA4C222-6AEB-43B2-B923-C13D97C575E5}
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:212
      - C:\Windows\Temp\{02DE276D-9FC3-4C88-B720-6A38D1793337}\.be\windowsdesktop-runtime-7.0.8-win-x64.exe
        
        "C:\Windows\Temp\{02DE276D-9FC3-4C88-B720-6A38D1793337}\.be\windowsdesktop-runtime-7.0.8-win-x64.exe" -q -burn.elevated BurnPipe.{3964BE9B-FDB1-4C78-92DD-C8C5AB84A001} {46D270C6-14B4-4D7D-8769-DABE1BCE0E78} 212
        6⤵
        Adds Run key to start application
        Executes dropped EXE
        Modifies registry class
        
        PID:332
  - - C:\ProgramData\Package Cache\20B1CAB9BCD5CAD52C5407D60E8556437242C730\DokanSetup.1.5.1.1000.exe
      "C:\ProgramData\Package Cache\20B1CAB9BCD5CAD52C5407D60E8556437242C730\DokanSetup.1.5.1.1000.exe" /norestart /quiet /install -burn.filehandle.self=964 -burn.embedded BurnPipe.{90D1E40A-97E9-4E54-8B2F-BD49F5B89FA8} {90E7DEBD-385A-443D-932A-0802E1C01BEF} 4188
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3096
    - - C:\Windows\Temp\{E79E941B-27D9-4ADF-922E-4301CA3905E6}\.cr\DokanSetup.1.5.1.1000.exe
        
        "C:\Windows\Temp\{E79E941B-27D9-4ADF-922E-4301CA3905E6}\.cr\DokanSetup.1.5.1.1000.exe" -burn.clean.room="C:\ProgramData\Package Cache\20B1CAB9BCD5CAD52C5407D60E8556437242C730\DokanSetup.1.5.1.1000.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532 /norestart /quiet /install -burn.filehandle.self=964 -burn.embedded BurnPipe.{90D1E40A-97E9-4E54-8B2F-BD49F5B89FA8} {90E7DEBD-385A-443D-932A-0802E1C01BEF} 4188
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3276
      - C:\Windows\Temp\{9B315333-D4F9-42B5-9B8C-0912C3439BE1}\.be\DokanSetup.exe
        
        "C:\Windows\Temp\{9B315333-D4F9-42B5-9B8C-0912C3439BE1}\.be\DokanSetup.exe" -q -burn.elevated BurnPipe.{632C39C7-BBCA-40AD-ACC8-FE582BE0D8F8} {395DDE7F-5E54-4D03-8A48-CD00C5929BDB} 3276
        6⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4312

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 78AED137B256D5A089CC78B5E267B3B0
  2⤵
  - Loads dropped DLL
  PID:2712
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 19CD9D143F2E390394B6A977B0F7ECF8
  2⤵
  - Loads dropped DLL
  PID:4980
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 49CB92717265304F644D617786AB1963
  2⤵
  - Loads dropped DLL
  PID:4744
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5311179FB9C3CC24F2BEED2B61964CD4
  2⤵
  - Loads dropped DLL
  PID:4356
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7B4252ED8B34D25FF5C876A9EADD7D4F
  2⤵
  - Loads dropped DLL
  PID:660
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E738FAAFD406A0166EEB3ECD7BBA45CF E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:1584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B23C315FEAEA1D2511914331A861CE78 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Program Files\Dokan\Dokan Library-1.5.1\dokanctl.exe
    "C:\Program Files\Dokan\Dokan Library-1.5.1\dokanctl.exe" /i n
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2784
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E51702F0C866022C5398D2B444F7B82D
  2⤵
  - Loads dropped DLL
  PID:3108
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI99AC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240753093 108 msiGaCustomAction!msiGaCustomAction.CustomActions.gaCheckInstallPathCustomAction
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:2700
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC725.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240764718 114 msiGaCustomAction!msiGaCustomAction.CustomActions.gaErrorCustomAction
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:3016

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ae8855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58d0ae.rbs

Filesize
17KB

MD5
8db4f18a7921b8b3c4a7d1efc07cbb01

SHA1
445697fdc84ec443659ea894f3309263d9fb93fd

SHA256
94fc779690ab41f664bf692612cb7d86337b2878bcdcff649c03cde23760e14a

SHA512
0b44cfcad3d3761467f890798ea2fc1a1580cfb7b76e55d8db753f0eb7e397723b21323ba35d9d2ca77628f8dfd1d720ef30642ec68f6c7352cb5bf1c4478b76

Download Submit
C:\Config.Msi\e58d0ba.rbs

Filesize
16KB

MD5
9de5793cbee0514a9d374e6bd068b9ce

SHA1
9baa76e4d6064d0990f4a4b8ed9838aaf3c8c5b4

SHA256
c5cb47fdc495d57fdf97c11d4480ae7228681374a75c7484e91f895576ae7cf9

SHA512
0644e26863a15389bca34aeb9e5ff3fe0c5ed8bdd7617b072e7ba456ab60706b688ae7f1072637730f3466432572a98445f2b601228d709b2833cfe1cac53be0

Download Submit
C:\Config.Msi\e58d0c1.rbs

Filesize
19KB

MD5
64ae1c0abb1a0f689af640b3dac755dc

SHA1
830c4e941e2c757be5429e3c466479d20a51f275

SHA256
57bacf7920e8f30b450a13ccee02d604dda905d6a27522ad4435565a983828af

SHA512
410970505b383e7a08174a35e4b4e1a8730ed482962dcb07680666c2e632b33a70c8b9eb01c08f6acbbff8b121740a53677f9270030c812326163a65eb273db3

Download Submit
C:\Config.Msi\e58d0d0.rbs

Filesize
18KB

MD5
f770ddd67f31dd09cb539bbe5aaa867d

SHA1
a6cbb4f287ef4924affa0ff5bb858e99783a327e

SHA256
8edc2e91ee4e514ea23aeaa4205bab97923de4d66cd1d288aa1cf5c15e8ade21

SHA512
514edbb6c7f1e6b0db52d1ebac150f0278c18218d470a043e85045c5cd243412669a74f21b204ea4106bba96c57ef2575dbb7b0d2dd291a5d490941e76d47189

Download Submit
C:\Config.Msi\e58d0d5.rbs

Filesize
47KB

MD5
bc2698f28cedb92c6adac706c6d5a63e

SHA1
c67044fa49ef9354066e3a750456d209d5c5a1e9

SHA256
3a243a80bf08072a0e598298c78742ef01a9c89b2add819f5b21ee067fd2f21b

SHA512
a0370724a862371a4311356613dc6b3381fbe696660597495bb77792098b1aebfad8db19ef2154c2579e36747d66c46067a7f07632fa011e1a1b9cd98de302ee

Download Submit
C:\Config.Msi\e58d0da.rbs

Filesize
8KB

MD5
d3d3004f16de7b461fb2b687ef35b5d5

SHA1
e51557dd403b0090baf7a90bbc9e00a6e48a8f45

SHA256
1bfdbbbb08a3ca2460c1e603ad8d98060a32c1ac1691d7e41ea09aa0899d2cdc

SHA512
08ee6a229434275bd6c4e9426d278d2194516d97c72433b12ffd432714beb7a5d0ac2762f04cb4515ee52a72dfce49ba1a51d6708b209a3196a5f9cec625af80

Download Submit
C:\Config.Msi\e58d0df.rbs

Filesize
9KB

MD5
ef68ead15b4184732e738b50e2ffd52f

SHA1
b98e821209cae08fccba2d93254806b17e6e0703

SHA256
6dd10231c15f8c5fa51f62bc829f6d0939f91a59fc78476fbdf107f60ebe52d0

SHA512
e606028595af683246f9f1abcafdab3873c60f920c33c9c29d9a42a995bc8c32b3aae293db7492048ed33cfd1bc7b604cd466dcba79df5a6ce0a638c4cdb33ff

Download Submit
C:\Config.Msi\e58d0e4.rbs

Filesize
86KB

MD5
90acd4afaa2986fe83a850ae747366a0

SHA1
e3cb7e40c585d5161f1073243d68f014b431f3ac

SHA256
c58087b85d1b0706153586a1e2add0b6c8baa36443336c4e79d894491232d4b0

SHA512
92f7558fe6c2cd7be805e34846a39cb3f8c184ff4246c3cec781789eba21f41d449bfb9304fd038312d982f08b96c004c7cb8cfad8fe1989e0eaeddb35438ff6

Download Submit
C:\Config.Msi\e58d0e9.rbs

Filesize
712KB

MD5
5924d3d539c498ac34c38b5a30d07775

SHA1
4710e8de8aa4f08aa74efba57c4a9e798d5d51e8

SHA256
da04196d9f633a7aa0d767b2e09b3f2a858798d4fab824b4b91e1ef2d9f903ac

SHA512
897c3b7fbbadbf4d7c0756b71bb6cb77dd724c2f1afd8411331c1440b87635317e8fa247ee0c4b329b64219b9cb7a9e3b8c6dfa0b955111f51c1456ab854fa50

Download Submit
C:\Program Files\Dokan\Dokan Library-1.5.1\x86\dokan1.dll

Filesize
394KB

MD5
a60f678d0fd4524adc0eb934a1739365

SHA1
5dd45ab3c14a1998fec3a10fc998ab1c86f63485

SHA256
d3ebcc2003be13a8fe9d9b35da2a08d59521beb19591cbecf808a8b68af419a1

SHA512
e701a51dfb203e1483f13d75788e8d7182fc8f3c8e5807c60b492baf8dcb46c02fea90b33f56b3018737a06b8e03eaee46b8b0d3abf6c9b3facae93d6fc588bb

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
85KB

MD5
481ad608d2c3b3a5a0a3a529f2b2569e

SHA1
e271613b837d2cda290808af2bbd104a8c104a10

SHA256
29aec309fa6f036be931222385612088a3d98aa07ac2356243028a3072d0ce86

SHA512
93dde6782e14ac259b8655a89b31f7efe6990f27bc560f90200f3c967645d20fc54510e8fb0346732ea54707728a7075c9b566a936e76586c50681de65c83afb

Download Submit
C:\ProgramData\Package Cache\20B1CAB9BCD5CAD52C5407D60E8556437242C730\DokanSetup.1.5.1.1000.exe

Filesize
17.6MB

MD5
5494822f54196466a02bfbd78b91e827

SHA1
20b1cab9bcd5cad52c5407d60e8556437242c730

SHA256
48e7b21310d28bbef6961ba01d52ace8a08a937a8c9cf4f60f4fa17885eeb518

SHA512
bf4d243f805087d8dbe5a36e5ebcf00bb7d0456d6304ea89ae4b1cb0aece790c04f5941424a91d988604472c910e02e7fc494b5718ed091ec4e92c710c2f125d

Download Submit
C:\ProgramData\Package Cache\4DE9F6681F0F213B132DEF3AF88A3C68483F5F32\vc_redist.14.34.31938.x64.exe

Filesize
24.3MB

MD5
119dde89a20674349a51893114eae5ed

SHA1
4de9f6681f0f213b132def3af88a3c68483f5f32

SHA256
26c2c72fba6438f5e29af8ebc4826a1e424581b3c446f8c735361f1db7beff72

SHA512
9be541f26b5d43cee1766239d8880ab7d30d18fea2f17e28d63a498b30b7dd0918f389805398cb56b0df0df17c8633cb73f9e46672c93b21be04b85bda7a2648

Download Submit
C:\ProgramData\Package Cache\8CD8A1621FB4A7D0B4370A5A31DF0215A05BEE23\windowsdesktop-runtime-7.0.8-win-x64.exe

Filesize
55.0MB

MD5
08ad33d1e236158450618ffd814d237c

SHA1
8cd8a1621fb4a7d0b4370a5a31df0215a05bee23

SHA256
f895c10c76b2d61e3b7e59e677b37ef69b2ccb0c0616d365dd6a5544e6aef2d2

SHA512
68337ebb614049596cc80eb2a4a3803b403e1f8268af00a367e99b0af28e6934e2de4ef3985882b5a06f764b287d7f6df3a98ff49132288cd5b3a491e402f7e5

Download Submit
C:\ProgramData\Package Cache\{49b90425-d03c-4b56-b8ba-0ccd425f5863}\DiskDrillSetup.5.3.826.0.exe

Filesize
809KB

MD5
2d8db4992c8a75355a0b2ff46d356a35

SHA1
d18e8e2942bb6e6130a37de4571c875a3083c966

SHA256
df5c762325a6b9d7b933408c52c545eeb447f91034db6cb9e7813a47f5df5ed3

SHA512
6947c36b6b0f6488b260508d98d51c7229abca65047bba3f9455df10ad6d8a8b6f05dc57dde82439a0b528963a0ccd4f122c7d9fee84bff0f13503d074361cec

Download Submit
C:\ProgramData\Package Cache\{49b90425-d03c-4b56-b8ba-0ccd425f5863}\state.rsm

Filesize
878B

MD5
42a77f66584838f1aefe5e3ff67a31bc

SHA1
1689e356b80dd3b7b589c3ba2c3ce552af6a6e30

SHA256
de76e839d297ac2ba19900b1b3eb291bf478914d5812ddc48bc06aa7f5fddc2a

SHA512
5e336979a9fbf05c7cabfb6587065c26f0fcf1ecf10509e3b06dcf8bc882a18ddf738785f811960a5dc010c0bcaf8019e2a816224f5a313f30d3e7405a4b26dc

Download Submit
C:\ProgramData\Package Cache\{d92971ab-f030-43c8-8545-c66c818d0e05}\VC_redist.x64.exe

Filesize
635KB

MD5
7cf46d8dfb686998aaaf81e27b995e8c

SHA1
c5638a049787ce441c9720c92d3cd02aa3b02429

SHA256
120019a0ac9f54224fc9787afba241bd9faaecef489be5a660bb16e85df052e4

SHA512
66cf76324e373d3be6cbef39535b419eda486a8f43c305c38a8c01cfc05f9e4073aeade808db8dea306fd3251955e177e45ab578a57114bac1d2df54b4e95efe

Download Submit
C:\ProgramData\Package Cache\{d92971ab-f030-43c8-8545-c66c818d0e05}\state.rsm

Filesize
1KB

MD5
9d262ba0de11cc7bd572e75250cde41b

SHA1
985b9388906309d734dea2eb215fae5a769596df

SHA256
eaff6bf7a7f19b585b15e13518b26b4b1611f8ae4639a401553b2f751807438e

SHA512
9a0012c0bbb9a878197358b9e9d37327b8007ca83eab89c6b549a513e04c32e9401605c991038c5b57edf1f725d27db9b146c5b60a09507b18bebb44c512fa18

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.8_(x64)_20231009132137_000_dotnet_runtime_7.0.8_win_x64.msi.log

Filesize
4KB

MD5
25137e37c77bfa718713e308d248c212

SHA1
ae5259a9e2f6e773416f88ff59542d7fd76b8c5c

SHA256
4b10773ef7c523789397815d9e1d4aaaf99ad2a235c8b73e651029ce0f0e25c4

SHA512
8e6818f5b847fc07857a9a7229e2ecb4f77410ce033bc6ba66f621c447db0dce263af4c530574fbcfc6b8d2e13016ade96822adade621087d967b11d51cd2e78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.8_(x64)_20231009132137_001_dotnet_hostfxr_7.0.8_win_x64.msi.log

Filesize
2KB

MD5
cda23fdd54b0783a5142625fe7623fb9

SHA1
fc22189c410f946c2c21c90037df7016d07657ab

SHA256
a26679829da439cc0c6ce966871890612316bfa369442398e394780149da9e54

SHA512
2473eb99f98287409aafbaa1bedcdcbaee156cc0ff521cd197ae70b1a0efda3b8e01c1ba7d497d5ede91f927eddca109e1d5f9d98308097680e8e90a8efb9099

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.8_(x64)_20231009132137_002_dotnet_host_7.0.8_win_x64.msi.log

Filesize
2KB

MD5
173344676b4b29b3a8f68754493b6dcd

SHA1
08b569466ea4cea27f0af0d06654e2cea909ff62

SHA256
2d1d20a9ad0d5bed3933f6a6dee465152da63901d926c26fee55e0163ffca4a9

SHA512
62773314c0adbd3acc9fe692596bd13782d11d89b7e6b5b970a8dcc8433123a779d226f144f3179d790904fbfa0b7ca6146cfb37a0d553b07782c3b090cf316b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.8_(x64)_20231009132137_003_windowsdesktop_runtime_7.0.8_win_x64.msi.log

Filesize
2KB

MD5
5fa19f6ae651ef2a928f3dc73cc27417

SHA1
8b86255597dbb858de40fa46b36ebfdac2164ea4

SHA256
e0315f525f9162b8ba5ce005c5501423593001399ee742c2dbbf7a9948238b9e

SHA512
827f3dd0142ca18f990cea0a3cae913634fd1b58a6e1d7b0aa1e65b908bd62b7a5895cdff7e3a72806e6b300e324700947865c87931181b137eb7e54f5cbcd64

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20231009132125_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
e638a1e4f06a6befec50deb1f24cc518

SHA1
0f549ccad28c72eea5fc66d3e9bdb74d9921e578

SHA256
c2b14f22c1b9157d7b113f1983db859aad6a7678bbbb16725a1612f042f9d8b1

SHA512
c17383321a018c9421ead6d13ae4e2c9fd8ebd1a99e42dc53e562f656242bfad844f7eff1ec5661cdbe3eb6ac92ff2bad701702d3a140a842ca60be439112bde

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20231009132125_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
4ef8339fc73dcf808cb955f9434bae8c

SHA1
ebfd41878acc8b299b0eee78128cdb29c33189ea

SHA256
c5e897ebfe9976afa8bf7013d11d78a5a1a0068210f93037d5204c4a324244d2

SHA512
11f716a8cf2188c33cf9e06c9ab0c79d49eebeec76e9ba13e14e9f47043e12ff8797ae412bfeecc5bd18ac4595b68ebe6f12268dd816ddc703435b787346f632

Download Submit
C:\Windows\Installer\MSI11D3.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI2417.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI29F4.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI29F4.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI2DB1.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI3013.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI34CA.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI38F2.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI4EFE.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIC725.tmp-\CustomAction.config

Filesize
1KB

MD5
01c01d040563a55e0fd31cc8daa5f155

SHA1
3c1c229703198f9772d7721357f1b90281917842

SHA256
33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f

SHA512
9c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5

Download Submit
C:\Windows\Installer\MSIC725.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIC725.tmp-\msiGaCustomAction.dll

Filesize
27KB

MD5
b56b815dc93fb7893cd5a262f2ff2c7f

SHA1
65b7cfebea3bbd1f174015defbbf7df7e6d7b54d

SHA256
33c889dfa52e0cc8eebef7a135c6b5ab565db868d826e068f880f2efb30be1a7

SHA512
4a63343e69e76e8aa95e39c60a4f983aa971b44fea6c2b0bab39974922ac383d12a88eaa8bfaa8f56227cf02e09a5b6f11fab106af53bbb20a054778131427df

Download Submit
C:\Windows\Installer\e58d0bb.msi

Filesize
180KB

MD5
a16b7d2616657a5ca44c480a82dcdd74

SHA1
1da94c7ea9d2042e6d71e5b2cdbf2256b3956c2b

SHA256
293eba293c34aa7257abb89d7e6aa3dce218b28f565a664a3c531a64e46be379

SHA512
f8244892766553238c56618be1e96515e58cae2b8c3db60505034f4e44b8e3faf766d79839eb0ce0e57128e8a6af71163260a851016b9446ac997b6945e6fc7f

Download Submit
C:\Windows\Installer\e58d0d6.msi

Filesize
26.1MB

MD5
753c7927673196db30b32eb67dd120ba

SHA1
83f6ee9c0f47a6df9f0f2923a1c178d7cb8ede80

SHA256
85f38c3a4777b042b41468d5c35db4a999b3321db13e37c2a7cdcd9e36a7adec

SHA512
c9e0a655812f3281789e22b81e6e365d218bad6816fe2435b38c0d87c0d9703919ca06e0a92bd34167fd5d2c121b79e04bdbd1a5c8eb025cfc2f661af66f9b2b

Download Submit
C:\Windows\Installer\e58d0d7.msi

Filesize
808KB

MD5
abff962b066dde6d4bc81d230d77b67f

SHA1
a101ee6e5186fdeabdc07c859563f70fce80f2a5

SHA256
a427d0873b8dcc573c42b8f1565697fe578d60bf962dff8b15e3a028780cdc91

SHA512
635335feff0c55b1e561deec1a736b86687d69827a4e2cdc085959806a8b8dafb05246f67500bd2afeba13fc7244a5347c3ee3cafdf47fc43c9b243cf449725a

Download Submit
C:\Windows\Installer\e58d0e5.msi

Filesize
28.5MB

MD5
70add694c8a0acf138fd29f26ead70eb

SHA1
96e972767ae393008cc27be64eab27943a3a9ab3

SHA256
38623cb65d460b70672f673f3182593f8c95f680288e2594a6c54b6fd6e9a30a

SHA512
143d72ae05fc8d05c4cf560484d8750415bf24f3ae95e6a0df2f95f2b0f2f13df7ff24a3fceae4da999e03b727334050c5cbd1a51f451f4696ca352a410752ce

Download Submit
C:\Windows\Installer\e58d0ea.msi

Filesize
11.9MB

MD5
910c2771cc11e19efecc8b79437df6f0

SHA1
65cf740580e4c202579aedd2ec520a9f85e68e05

SHA256
c7ab35e0d80d0f81a03e44cbeb7220625248d00de8c8019fc6a87ffe223db49f

SHA512
492f4560c1505ada9d5c79ad0c098159af473de7567048e7dc48559328c9970641cd5e2eb8f749ce04918a9a0bb1a0bd943915abd686ea8824191c0747fafe1f

Download Submit
C:\Windows\System32\DRVSTORE\dokan_C9C23E1918E5ABD45F0BAFDE646F163969BA20F8\dokan1.sys

Filesize
377KB

MD5
98d68d07ed2759612018ef269f713dc8

SHA1
830ae5d65a2782a874d2373f883de113867a3609

SHA256
7a055d96a85ca1926e0f89da0bffe47e31beb0c75f756b38bdf935e5f972ded4

SHA512
7c6cf6126b6625fda1f76add72db7864fde9d675d3a424dee91d558b618ebd65588e2ec6ba7fedc140555450a9fe8717ae27baa4d934adef0408fc3bb3447932

Download Submit
C:\Windows\System32\dokan1.dll

Filesize
507KB

MD5
3556298d25afd095b48279264d9911da

SHA1
a1182374dd98b0ec3c9edfa3597f2142a25fed2b

SHA256
e5a4d9f08f0faf571abfe0a361f5e5ad9fd80315c835f7a8ddb5d6a8f81e5b57

SHA512
ab2b66b366ba6c56e075e652ac8a8a30e8310488d65db7812ba9676e4c500ba21c9c0e00730998693874d33924d4e2a591ec54aa2da394578d2c6e5262b49f5c

Download Submit
C:\Windows\Temp\{02DE276D-9FC3-4C88-B720-6A38D1793337}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{02DE276D-9FC3-4C88-B720-6A38D1793337}\.be\windowsdesktop-runtime-7.0.8-win-x64.exe

Filesize
610KB

MD5
03323d8e69a23d2be78c8a010dbe5dd5

SHA1
34a1deafa5b8b82bfe6963eba396916105dc0e2e

SHA256
058d692bd037592747694e15352bf3319d48cae0cb32219571a278d82ca84f46

SHA512
60ea90f5e0b9cd53c8a133ae6497afe7e76658ccc4ee6bee3be39b4f80330e73d8bf3bf5108959af7fb3c63e2dc99d858b17a9212d1dba98412253e07d9971b2

Download Submit
C:\Windows\Temp\{02DE276D-9FC3-4C88-B720-6A38D1793337}\.be\windowsdesktop-runtime-7.0.8-win-x64.exe

Filesize
610KB

MD5
03323d8e69a23d2be78c8a010dbe5dd5

SHA1
34a1deafa5b8b82bfe6963eba396916105dc0e2e

SHA256
058d692bd037592747694e15352bf3319d48cae0cb32219571a278d82ca84f46

SHA512
60ea90f5e0b9cd53c8a133ae6497afe7e76658ccc4ee6bee3be39b4f80330e73d8bf3bf5108959af7fb3c63e2dc99d858b17a9212d1dba98412253e07d9971b2

Download Submit
C:\Windows\Temp\{02DE276D-9FC3-4C88-B720-6A38D1793337}\.be\windowsdesktop-runtime-7.0.8-win-x64.exe

Filesize
610KB

MD5
03323d8e69a23d2be78c8a010dbe5dd5

SHA1
34a1deafa5b8b82bfe6963eba396916105dc0e2e

SHA256
058d692bd037592747694e15352bf3319d48cae0cb32219571a278d82ca84f46

SHA512
60ea90f5e0b9cd53c8a133ae6497afe7e76658ccc4ee6bee3be39b4f80330e73d8bf3bf5108959af7fb3c63e2dc99d858b17a9212d1dba98412253e07d9971b2

Download Submit
C:\Windows\Temp\{02DE276D-9FC3-4C88-B720-6A38D1793337}\dotnet_host_7.0.8_win_x64.msi

Filesize
744KB

MD5
431e1ba77a9a96f07ae41b21fd30aed9

SHA1
42c6fae18fa8119d67ac6fc712d4126dad4643e9

SHA256
94876c12b2793aeef2b5e3dbe3de36b9793a38ba348661756085f626225ce330

SHA512
ffd565578240938904c780ab90da068d53e834033230c0fa3001142feebf98e28c2e7d2183f9caa04f8602609693638680b685e3efdb18613a03aea3e31a6724

Download Submit
C:\Windows\Temp\{02DE276D-9FC3-4C88-B720-6A38D1793337}\dotnet_hostfxr_7.0.8_win_x64.msi

Filesize
808KB

MD5
abff962b066dde6d4bc81d230d77b67f

SHA1
a101ee6e5186fdeabdc07c859563f70fce80f2a5

SHA256
a427d0873b8dcc573c42b8f1565697fe578d60bf962dff8b15e3a028780cdc91

SHA512
635335feff0c55b1e561deec1a736b86687d69827a4e2cdc085959806a8b8dafb05246f67500bd2afeba13fc7244a5347c3ee3cafdf47fc43c9b243cf449725a

Download Submit
C:\Windows\Temp\{02DE276D-9FC3-4C88-B720-6A38D1793337}\dotnet_runtime_7.0.8_win_x64.msi

Filesize
26.1MB

MD5
753c7927673196db30b32eb67dd120ba

SHA1
83f6ee9c0f47a6df9f0f2923a1c178d7cb8ede80

SHA256
85f38c3a4777b042b41468d5c35db4a999b3321db13e37c2a7cdcd9e36a7adec

SHA512
c9e0a655812f3281789e22b81e6e365d218bad6816fe2435b38c0d87c0d9703919ca06e0a92bd34167fd5d2c121b79e04bdbd1a5c8eb025cfc2f661af66f9b2b

Download Submit
C:\Windows\Temp\{02DE276D-9FC3-4C88-B720-6A38D1793337}\windowsdesktop_runtime_7.0.8_win_x64.msi

Filesize
28.5MB

MD5
70add694c8a0acf138fd29f26ead70eb

SHA1
96e972767ae393008cc27be64eab27943a3a9ab3

SHA256
38623cb65d460b70672f673f3182593f8c95f680288e2594a6c54b6fd6e9a30a

SHA512
143d72ae05fc8d05c4cf560484d8750415bf24f3ae95e6a0df2f95f2b0f2f13df7ff24a3fceae4da999e03b727334050c5cbd1a51f451f4696ca352a410752ce

Download Submit
C:\Windows\Temp\{1E7861A7-054E-41E6-A1A8-73FDCCF97FC4}\.ba\logo.png

Filesize
55KB

MD5
45a241ae6f9efb59c7506d5a5bd0ed32

SHA1
2a215973d58a9c465765a7885c302453cb240887

SHA256
23e6ebe4a24a22c55bef84892e42f1cad2873bb9706369056972387df4a72147

SHA512
92435d454035d0efc8c0f29c4ffb1fc137a4f9c80d78628bb0fe4ba94559e0f2eb3f05a8cc33c303d6eb3d88d67b93bfb146fd1c0ba02b07a4ebddb5e895a65d

Download Submit
C:\Windows\Temp\{1E7861A7-054E-41E6-A1A8-73FDCCF97FC4}\.be\DiskDrillSetup.5.3.826.0.exe

Filesize
809KB

MD5
2d8db4992c8a75355a0b2ff46d356a35

SHA1
d18e8e2942bb6e6130a37de4571c875a3083c966

SHA256
df5c762325a6b9d7b933408c52c545eeb447f91034db6cb9e7813a47f5df5ed3

SHA512
6947c36b6b0f6488b260508d98d51c7229abca65047bba3f9455df10ad6d8a8b6f05dc57dde82439a0b528963a0ccd4f122c7d9fee84bff0f13503d074361cec

Download Submit
C:\Windows\Temp\{1E7861A7-054E-41E6-A1A8-73FDCCF97FC4}\.be\DiskDrillSetup.5.3.826.0.exe

Filesize
809KB

MD5
2d8db4992c8a75355a0b2ff46d356a35

SHA1
d18e8e2942bb6e6130a37de4571c875a3083c966

SHA256
df5c762325a6b9d7b933408c52c545eeb447f91034db6cb9e7813a47f5df5ed3

SHA512
6947c36b6b0f6488b260508d98d51c7229abca65047bba3f9455df10ad6d8a8b6f05dc57dde82439a0b528963a0ccd4f122c7d9fee84bff0f13503d074361cec

Download Submit
C:\Windows\Temp\{1E7861A7-054E-41E6-A1A8-73FDCCF97FC4}\.be\DiskDrillSetup.5.3.826.0.exe

Filesize
809KB

MD5
2d8db4992c8a75355a0b2ff46d356a35

SHA1
d18e8e2942bb6e6130a37de4571c875a3083c966

SHA256
df5c762325a6b9d7b933408c52c545eeb447f91034db6cb9e7813a47f5df5ed3

SHA512
6947c36b6b0f6488b260508d98d51c7229abca65047bba3f9455df10ad6d8a8b6f05dc57dde82439a0b528963a0ccd4f122c7d9fee84bff0f13503d074361cec

Download Submit
C:\Windows\Temp\{1E7861A7-054E-41E6-A1A8-73FDCCF97FC4}\DD.Setup.x64.msi

Filesize
18.4MB

MD5
8ad7e4a44cbea80370e6edfbd77d021b

SHA1
ae0127f925a9741abfaa5f9cbad8c3ceba0ea030

SHA256
3937c33a41dc7e0f1b766f61f67021f0cacb6270191f91c23f24d895345771c0

SHA512
74afb6149c2fb8c9c3df1cc0814dfdf082d2647ef694b569e1f172840db19deb5b83fc5fbc4667bad2e7cdbeb845e2be33663da70cfe36a2771ac3fb59e832a4

Download Submit
C:\Windows\Temp\{1E7861A7-054E-41E6-A1A8-73FDCCF97FC4}\DokanSetup.exe

Filesize
17.6MB

MD5
5494822f54196466a02bfbd78b91e827

SHA1
20b1cab9bcd5cad52c5407d60e8556437242c730

SHA256
48e7b21310d28bbef6961ba01d52ace8a08a937a8c9cf4f60f4fa17885eeb518

SHA512
bf4d243f805087d8dbe5a36e5ebcf00bb7d0456d6304ea89ae4b1cb0aece790c04f5941424a91d988604472c910e02e7fc494b5718ed091ec4e92c710c2f125d

Download Submit
C:\Windows\Temp\{1E7861A7-054E-41E6-A1A8-73FDCCF97FC4}\Net7x64

Filesize
55.0MB

MD5
08ad33d1e236158450618ffd814d237c

SHA1
8cd8a1621fb4a7d0b4370a5a31df0215a05bee23

SHA256
f895c10c76b2d61e3b7e59e677b37ef69b2ccb0c0616d365dd6a5544e6aef2d2

SHA512
68337ebb614049596cc80eb2a4a3803b403e1f8268af00a367e99b0af28e6934e2de4ef3985882b5a06f764b287d7f6df3a98ff49132288cd5b3a491e402f7e5

Download Submit
C:\Windows\Temp\{1E7861A7-054E-41E6-A1A8-73FDCCF97FC4}\vcredist_2019_x64.exe

Filesize
24.3MB

MD5
119dde89a20674349a51893114eae5ed

SHA1
4de9f6681f0f213b132def3af88a3c68483f5f32

SHA256
26c2c72fba6438f5e29af8ebc4826a1e424581b3c446f8c735361f1db7beff72

SHA512
9be541f26b5d43cee1766239d8880ab7d30d18fea2f17e28d63a498b30b7dd0918f389805398cb56b0df0df17c8633cb73f9e46672c93b21be04b85bda7a2648

Download Submit
C:\Windows\Temp\{528158B9-73D7-4ED3-AA7D-24712779E17B}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{615C886E-590F-4FBC-AAAC-B3A170557CC5}\.cr\windowsdesktop-runtime-7.0.8-win-x64.exe

Filesize
610KB

MD5
03323d8e69a23d2be78c8a010dbe5dd5

SHA1
34a1deafa5b8b82bfe6963eba396916105dc0e2e

SHA256
058d692bd037592747694e15352bf3319d48cae0cb32219571a278d82ca84f46

SHA512
60ea90f5e0b9cd53c8a133ae6497afe7e76658ccc4ee6bee3be39b4f80330e73d8bf3bf5108959af7fb3c63e2dc99d858b17a9212d1dba98412253e07d9971b2

Download Submit
C:\Windows\Temp\{615C886E-590F-4FBC-AAAC-B3A170557CC5}\.cr\windowsdesktop-runtime-7.0.8-win-x64.exe

Filesize
610KB

MD5
03323d8e69a23d2be78c8a010dbe5dd5

SHA1
34a1deafa5b8b82bfe6963eba396916105dc0e2e

SHA256
058d692bd037592747694e15352bf3319d48cae0cb32219571a278d82ca84f46

SHA512
60ea90f5e0b9cd53c8a133ae6497afe7e76658ccc4ee6bee3be39b4f80330e73d8bf3bf5108959af7fb3c63e2dc99d858b17a9212d1dba98412253e07d9971b2

Download Submit
C:\Windows\Temp\{88E165CC-F819-4EBD-8C25-9DDB96E11CC5}\.cr\vc_redist.14.34.31938.x64.exe

Filesize
635KB

MD5
7cf46d8dfb686998aaaf81e27b995e8c

SHA1
c5638a049787ce441c9720c92d3cd02aa3b02429

SHA256
120019a0ac9f54224fc9787afba241bd9faaecef489be5a660bb16e85df052e4

SHA512
66cf76324e373d3be6cbef39535b419eda486a8f43c305c38a8c01cfc05f9e4073aeade808db8dea306fd3251955e177e45ab578a57114bac1d2df54b4e95efe

Download Submit
C:\Windows\Temp\{88E165CC-F819-4EBD-8C25-9DDB96E11CC5}\.cr\vc_redist.14.34.31938.x64.exe

Filesize
635KB

MD5
7cf46d8dfb686998aaaf81e27b995e8c

SHA1
c5638a049787ce441c9720c92d3cd02aa3b02429

SHA256
120019a0ac9f54224fc9787afba241bd9faaecef489be5a660bb16e85df052e4

SHA512
66cf76324e373d3be6cbef39535b419eda486a8f43c305c38a8c01cfc05f9e4073aeade808db8dea306fd3251955e177e45ab578a57114bac1d2df54b4e95efe

Download Submit
C:\Windows\Temp\{969C69FB-68AD-4D00-A9CB-ED156D29F367}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{969C69FB-68AD-4D00-A9CB-ED156D29F367}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
7cf46d8dfb686998aaaf81e27b995e8c

SHA1
c5638a049787ce441c9720c92d3cd02aa3b02429

SHA256
120019a0ac9f54224fc9787afba241bd9faaecef489be5a660bb16e85df052e4

SHA512
66cf76324e373d3be6cbef39535b419eda486a8f43c305c38a8c01cfc05f9e4073aeade808db8dea306fd3251955e177e45ab578a57114bac1d2df54b4e95efe

Download Submit
C:\Windows\Temp\{969C69FB-68AD-4D00-A9CB-ED156D29F367}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
7cf46d8dfb686998aaaf81e27b995e8c

SHA1
c5638a049787ce441c9720c92d3cd02aa3b02429

SHA256
120019a0ac9f54224fc9787afba241bd9faaecef489be5a660bb16e85df052e4

SHA512
66cf76324e373d3be6cbef39535b419eda486a8f43c305c38a8c01cfc05f9e4073aeade808db8dea306fd3251955e177e45ab578a57114bac1d2df54b4e95efe

Download Submit
C:\Windows\Temp\{969C69FB-68AD-4D00-A9CB-ED156D29F367}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
7cf46d8dfb686998aaaf81e27b995e8c

SHA1
c5638a049787ce441c9720c92d3cd02aa3b02429

SHA256
120019a0ac9f54224fc9787afba241bd9faaecef489be5a660bb16e85df052e4

SHA512
66cf76324e373d3be6cbef39535b419eda486a8f43c305c38a8c01cfc05f9e4073aeade808db8dea306fd3251955e177e45ab578a57114bac1d2df54b4e95efe

Download Submit
C:\Windows\Temp\{969C69FB-68AD-4D00-A9CB-ED156D29F367}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
21742d42a69cd5caf3a8a2755fb0d472

SHA1
2f081e6a2e3f3f6bbf40e8645e2e85678f52a769

SHA256
51d43233a4a4726e4bf0cb65214dc54cf7b703a980f7b0a276f37bfd2bd7761b

SHA512
53b801763a891a7ac40fd198d91d700050272c9445b84445edfbbe797a4f4d28efbc793297ca45f43cb53db2d0710bf9cf45eba664d70cc414ef73545b834fae

Download Submit
C:\Windows\Temp\{969C69FB-68AD-4D00-A9CB-ED156D29F367}\cab5046A8AB272BF37297BB7928664C9503

Filesize
925KB

MD5
49d2d776f9d88979fff9041b021ebce6

SHA1
0e505bff7ccb0913a5e2e1c49b5b4cd86102541d

SHA256
5333dd41789fcb64b9da329e14b34544031b8cc4fc2b5f863a01d425064a7954

SHA512
555a9f091bc6cdbe4bc6f9ed40bb3f92129b1bf6db9108c65ea4d8cf837fdd7d47749b33ae9b8a4ae606247485f29968ae52d5c49a086e2522444b02f440c913

Download Submit
C:\Windows\Temp\{969C69FB-68AD-4D00-A9CB-ED156D29F367}\vcRuntimeAdditional_x64

Filesize
180KB

MD5
5454587e1613092539742efe1183dd67

SHA1
3a26f9456051d342758732f66e5ed751d8afda70

SHA256
cfcdba2bff2f9933db7af33ed47c6a43f484fd8c8b844c246506fc3a5329b6f4

SHA512
c73b6cb8dfce6a52f82ea289f43cdaf198dfc0bfbc406afbd8edc74e5724e0b492850c56d9540e723b60ac0a43be3b4f5c5e6d471c4bc7e4191c04498e57de22

Download Submit
C:\Windows\Temp\{969C69FB-68AD-4D00-A9CB-ED156D29F367}\vcRuntimeMinimum_x64

Filesize
180KB

MD5
a16b7d2616657a5ca44c480a82dcdd74

SHA1
1da94c7ea9d2042e6d71e5b2cdbf2256b3956c2b

SHA256
293eba293c34aa7257abb89d7e6aa3dce218b28f565a664a3c531a64e46be379

SHA512
f8244892766553238c56618be1e96515e58cae2b8c3db60505034f4e44b8e3faf766d79839eb0ce0e57128e8a6af71163260a851016b9446ac997b6945e6fc7f

Download Submit
C:\Windows\Temp\{9B315333-D4F9-42B5-9B8C-0912C3439BE1}\.ba\logo.png

Filesize
4KB

MD5
0d1ae52cb83dc37298bd0872d1e08374

SHA1
d6223fe2e4834b0e10d946879a2cb645c11e6db5

SHA256
4e716f8dc1fdf9a803ea2441e2a6a185f7bbccd25dcb4a389742f056f9b4e74e

SHA512
0e2a7938cab23eeb430a677f5061b40eb2b68d5691b9cdf4ac697caab52142a79f40ccd5e52d8b1eb73a3eff3495de92161e6cced5b4478f2240eb2c10add484

Download Submit
C:\Windows\Temp\{9B315333-D4F9-42B5-9B8C-0912C3439BE1}\.ba\wixstdba.dll

Filesize
184KB

MD5
fe7e0bd53f52e6630473c31299a49fdd

SHA1
f706f45768bfb95f4c96dfa0be36df57aa863898

SHA256
2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

SHA512
feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

Download Submit
C:\Windows\Temp\{9B315333-D4F9-42B5-9B8C-0912C3439BE1}\.be\DokanSetup.exe

Filesize
700KB

MD5
a506dc305fea77b94923f210e5389968

SHA1
5857367e32178fff8b501b16a025ecf02ed05d24

SHA256
203b6c8e2d88200e290ffb83791e1953acbdd2aee21fa841c4c67081583a0d4c

SHA512
c7c01c018c9fa07f2e0ae5dce31a3b22004ddbca5d794c193790f0685b8f511f95f8df6b3da6d0f8bfc392460f24faf84de450f968e0cb215fb6db813c03daf2

Download Submit
C:\Windows\Temp\{9B315333-D4F9-42B5-9B8C-0912C3439BE1}\.be\DokanSetup.exe

Filesize
700KB

MD5
a506dc305fea77b94923f210e5389968

SHA1
5857367e32178fff8b501b16a025ecf02ed05d24

SHA256
203b6c8e2d88200e290ffb83791e1953acbdd2aee21fa841c4c67081583a0d4c

SHA512
c7c01c018c9fa07f2e0ae5dce31a3b22004ddbca5d794c193790f0685b8f511f95f8df6b3da6d0f8bfc392460f24faf84de450f968e0cb215fb6db813c03daf2

Download Submit
C:\Windows\Temp\{9B315333-D4F9-42B5-9B8C-0912C3439BE1}\.be\DokanSetup.exe

Filesize
700KB

MD5
a506dc305fea77b94923f210e5389968

SHA1
5857367e32178fff8b501b16a025ecf02ed05d24

SHA256
203b6c8e2d88200e290ffb83791e1953acbdd2aee21fa841c4c67081583a0d4c

SHA512
c7c01c018c9fa07f2e0ae5dce31a3b22004ddbca5d794c193790f0685b8f511f95f8df6b3da6d0f8bfc392460f24faf84de450f968e0cb215fb6db813c03daf2

Download Submit
C:\Windows\Temp\{B215C943-D1C5-4C89-AACD-0BE50AA65E1A}\.cr\disk-drill-win.exe

Filesize
809KB

MD5
2d8db4992c8a75355a0b2ff46d356a35

SHA1
d18e8e2942bb6e6130a37de4571c875a3083c966

SHA256
df5c762325a6b9d7b933408c52c545eeb447f91034db6cb9e7813a47f5df5ed3

SHA512
6947c36b6b0f6488b260508d98d51c7229abca65047bba3f9455df10ad6d8a8b6f05dc57dde82439a0b528963a0ccd4f122c7d9fee84bff0f13503d074361cec

Download Submit
C:\Windows\Temp\{B215C943-D1C5-4C89-AACD-0BE50AA65E1A}\.cr\disk-drill-win.exe

Filesize
809KB

MD5
2d8db4992c8a75355a0b2ff46d356a35

SHA1
d18e8e2942bb6e6130a37de4571c875a3083c966

SHA256
df5c762325a6b9d7b933408c52c545eeb447f91034db6cb9e7813a47f5df5ed3

SHA512
6947c36b6b0f6488b260508d98d51c7229abca65047bba3f9455df10ad6d8a8b6f05dc57dde82439a0b528963a0ccd4f122c7d9fee84bff0f13503d074361cec

Download Submit
C:\Windows\Temp\{E79E941B-27D9-4ADF-922E-4301CA3905E6}\.cr\DokanSetup.1.5.1.1000.exe

Filesize
700KB

MD5
a506dc305fea77b94923f210e5389968

SHA1
5857367e32178fff8b501b16a025ecf02ed05d24

SHA256
203b6c8e2d88200e290ffb83791e1953acbdd2aee21fa841c4c67081583a0d4c

SHA512
c7c01c018c9fa07f2e0ae5dce31a3b22004ddbca5d794c193790f0685b8f511f95f8df6b3da6d0f8bfc392460f24faf84de450f968e0cb215fb6db813c03daf2

Download Submit
C:\Windows\Temp\{E79E941B-27D9-4ADF-922E-4301CA3905E6}\.cr\DokanSetup.1.5.1.1000.exe

Filesize
700KB

MD5
a506dc305fea77b94923f210e5389968

SHA1
5857367e32178fff8b501b16a025ecf02ed05d24

SHA256
203b6c8e2d88200e290ffb83791e1953acbdd2aee21fa841c4c67081583a0d4c

SHA512
c7c01c018c9fa07f2e0ae5dce31a3b22004ddbca5d794c193790f0685b8f511f95f8df6b3da6d0f8bfc392460f24faf84de450f968e0cb215fb6db813c03daf2

Download Submit
\Windows\Installer\MSI11D3.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI2417.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI29F4.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI2DB1.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI3013.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI34CA.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI38F2.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI4EFE.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Temp\{02DE276D-9FC3-4C88-B720-6A38D1793337}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
\Windows\Temp\{1E7861A7-054E-41E6-A1A8-73FDCCF97FC4}\.ba\wixstdba.dll

Filesize
184KB

MD5
fe7e0bd53f52e6630473c31299a49fdd

SHA1
f706f45768bfb95f4c96dfa0be36df57aa863898

SHA256
2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

SHA512
feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

Download Submit
\Windows\Temp\{528158B9-73D7-4ED3-AA7D-24712779E17B}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
\Windows\Temp\{969C69FB-68AD-4D00-A9CB-ED156D29F367}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
\Windows\Temp\{9B315333-D4F9-42B5-9B8C-0912C3439BE1}\.ba\wixstdba.dll

Filesize
184KB

MD5
fe7e0bd53f52e6630473c31299a49fdd

SHA1
f706f45768bfb95f4c96dfa0be36df57aa863898

SHA256
2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

SHA512
feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

Download Submit
memory/2700-1279-0x000001BFB1FD0000-0x000001BFB1FE0000-memory.dmp

Filesize
64KB

Download
memory/2700-1274-0x000001BF99A60000-0x000001BF99A6C000-memory.dmp

Filesize
48KB

Download
memory/2700-1278-0x00007FFDC4860000-0x00007FFDC524C000-memory.dmp

Filesize
9.9MB

Download
memory/2700-1276-0x000001BFB1FD0000-0x000001BFB1FE0000-memory.dmp

Filesize
64KB

Download
memory/2700-1290-0x00007FFDC4860000-0x00007FFDC524C000-memory.dmp

Filesize
9.9MB

Download
memory/2700-1275-0x00007FFDC4860000-0x00007FFDC524C000-memory.dmp

Filesize
9.9MB

Download
memory/2700-1269-0x000001BF99BB0000-0x000001BF99BDE000-memory.dmp

Filesize
184KB

Download
memory/2700-1277-0x000001BFB1FD0000-0x000001BFB1FE0000-memory.dmp

Filesize
64KB

Download
memory/3016-1306-0x000001BB694A0000-0x000001BB694B0000-memory.dmp

Filesize
64KB

Download
memory/3016-1307-0x000001BB694A0000-0x000001BB694B0000-memory.dmp

Filesize
64KB

Download
memory/3016-1310-0x000001BB694A0000-0x000001BB694B0000-memory.dmp

Filesize
64KB

Download
memory/3016-1311-0x000001BB694A0000-0x000001BB694B0000-memory.dmp

Filesize
64KB

Download
memory/3016-1302-0x00007FFDC4860000-0x00007FFDC524C000-memory.dmp

Filesize
9.9MB

Download
memory/3016-1323-0x00007FFDC4860000-0x00007FFDC524C000-memory.dmp

Filesize
9.9MB

Download
memory/3016-1324-0x00007FFDC4860000-0x00007FFDC524C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads