hxxps://nova[.]blksservers[.]com/Installer/2[.]1/NovaInstaller[.]exe

Analysis

max time kernel
1839s
max time network
1733s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://nova.blksservers.com/Installer/2.1/NovaInstaller.exe

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-6.0.15-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation	vc_redist.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation	dotnet-sdk-6.0.405-win-x64.exe

Executes dropped EXE 10 IoCs

pid	Process
2640	NovaInstaller.exe
4240	windowsdesktop-runtime-6.0.15-win-x64.exe
1464	windowsdesktop-runtime-6.0.15-win-x64.exe
4788	windowsdesktop-runtime-6.0.21-win-x64.exe
180	vc_redist.x64.exe
1388	vc_redist.x64.exe
3440	VC_redist.x64.exe
2140	dotnet-sdk-6.0.405-win-x64.exe
4100	dotnet-sdk-6.0.405-win-x64.exe
3476	dotnet-sdk-6.0.413-win-x86.exe

Loads dropped DLL 25 IoCs

pid	Process
2640	NovaInstaller.exe
2640	NovaInstaller.exe
2640	NovaInstaller.exe
1464	windowsdesktop-runtime-6.0.15-win-x64.exe
4444	MsiExec.exe
4444	MsiExec.exe
1288	MsiExec.exe
1288	MsiExec.exe
1276	MsiExec.exe
1276	MsiExec.exe
2528	MsiExec.exe
2528	MsiExec.exe
1388	vc_redist.x64.exe
2956	VC_redist.x64.exe
4100	dotnet-sdk-6.0.405-win-x64.exe
3744	MsiExec.exe
1648	MsiExec.exe
4676	MsiExec.exe
4368	MsiExec.exe
4668	MsiExec.exe
3660	MsiExec.exe
4464	MsiExec.exe
4812	MsiExec.exe
4312	MsiExec.exe
2600	MsiExec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{901a4233-9860-4dd0-bb2d-0d86482fc5bd} = "\"C:\\ProgramData\\Package Cache\\{901a4233-9860-4dd0-bb2d-0d86482fc5bd}\\dotnet-sdk-6.0.413-win-x86.exe\" /burn.runonce"	dotnet-sdk-6.0.413-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0f39db03-9030-48f3-82ef-5384bed81d85} = "\"C:\\ProgramData\\Package Cache\\{0f39db03-9030-48f3-82ef-5384bed81d85}\\windowsdesktop-runtime-6.0.21-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{8bdfe669-9705-4184-9368-db9ce581e0e7} = "\"C:\\ProgramData\\Package Cache\\{8bdfe669-9705-4184-9368-db9ce581e0e7}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pl\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\D3DCompiler_47_cor3.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\UIAutomationProvider.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pt-BR\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\it\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Host.win-x64\6.0.21\runtimes\win-x64\native\nethost.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Host.win-arm\6.0.21\runtimes\win-arm\native\coreclr_delegates.h	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Host.win-arm\6.0.21\runtimes\win-arm\native\nethost.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pt-BR\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hans\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.ComponentModel.Primitives.xml	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Diagnostics.DiagnosticSource.xml	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ko\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hans\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\cs\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Xml.XmlSerializer.xml	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\NETStandard.Library.Ref\2.1.0\ref\netstandard2.1\System.Drawing.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\es\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pl\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\es\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\WindowsBase.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Security.Cryptography.OpenSsl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.IO.FileSystem.Watcher.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\PresentationFramework-SystemXmlLinq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\tr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hans\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\NETStandard.Library.Ref\2.1.0\ref\netstandard2.1\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Xml.XPath.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\mscorrc.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.HttpListener.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Text.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Drawing.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\analyzers\dotnet\cs\es\System.Text.Json.SourceGeneration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Transactions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.Quic.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Net.Mail.xml	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Runtime.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\it\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Security.Cryptography.Encoding.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Net.Requests.xml	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\analyzers\dotnet\cs\de\System.Text.Json.SourceGeneration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\NETStandard.Library.Ref\2.1.0\ref\netstandard2.1\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\System.Linq.Queryable.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\packs\Microsoft.NETCore.App.Ref\6.0.21\ref\net6.0\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\cs\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\PresentationFramework.resources.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e684112.msi	msiexec.exe
File created	C:\Windows\Installer\e68414f.msi	msiexec.exe
File created	C:\Windows\Installer\e68410d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI374D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF258.tmp	msiexec.exe
File created	C:\Windows\Installer\e684145.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e68415e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e684112.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI86DC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e68416d.msi	msiexec.exe
File created	C:\Windows\Installer\e684102.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9DA9.tmp	msiexec.exe
File created	C:\Windows\Installer\e68413f.msi	msiexec.exe
File created	C:\Windows\Installer\e68416d.msi	msiexec.exe
File created	C:\Windows\Installer\e684103.msi	msiexec.exe
File created	C:\Windows\Installer\e684107.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D5D19E2F-7189-42FE-8103-92CD1FA457C2}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F25834D2-0460-4995-8585-8E41BD074159}	msiexec.exe
File opened for modification	C:\Windows\Installer\e684168.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI404F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C8D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C20CC808-E3C5-48B9-B791-0B145CD1D7A7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAFD.tmp	msiexec.exe
File created	C:\Windows\Installer\e68415e.msi	msiexec.exe
File created	C:\Windows\Installer\e684162.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e684103.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F63.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F51F1638-9569-40DB-8775-4AA7CE6FD41F}	msiexec.exe
File created	C:\Windows\Installer\e684140.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICFDE.tmp	msiexec.exe
File created	C:\Windows\Installer\e684108.msi	msiexec.exe
File created	C:\Windows\Installer\e684125.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e684145.msi	msiexec.exe
File created	C:\Windows\Installer\e684111.msi	msiexec.exe
File created	C:\Windows\Installer\e68414a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI63A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2662.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e68414a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e684154.msi	msiexec.exe
File created	C:\Windows\Installer\e68415d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D2D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0025DD72-A959-45B5-A0A3-7EFEB15A8050}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B8ED272B-5F2D-4FF5-A7CA-C73552D7FB0F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E4B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A9F8F2E3-D3A4-4D90-9800-F689932ECE89}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3C415703-440C-4819-B133-6B442A16D0C7}	msiexec.exe
File opened for modification	C:\Windows\Installer\e68414f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB13.tmp	msiexec.exe
File created	C:\Windows\Installer\e684168.msi	msiexec.exe
File created	C:\Windows\Installer\e684159.msi	msiexec.exe
File created	C:\Windows\Installer\e68416c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AF6BF7DD-2B12-40C5-919C-2EC99054BBE1}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC863.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{525AB200-93CA-4619-A27A-E82D0729EA5E}	msiexec.exe
File created	C:\Windows\Installer\e684149.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID501.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE56D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e684108.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI50BF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1728.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI521F.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e909c866916b25070000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e909c8660000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e909c866000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de909c866000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e909c86600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 39 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133433373316542756"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B272DE8BD2F55FF47AAC7C53257DBFF0\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_targeting_pack_48.87.64667_x86\Dependents\{901a4233-9860-4dd0-bb2d-0d86482fc5bd}	dotnet-sdk-6.0.413-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\ = "{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DD7FB6FA21B25C0419C9E29C0945BB1E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\002BA525AC3991642AA78ED27092AEE5\Version = "811072667"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_apphost_pack_48.87.64667_x86_arm	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8361F15F9659BD047857A47AECF64DF1\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\netstandard_targeting_pack_24.0.28113_x86\Version = "24.0.28113"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64\Version = "48.87.64667"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B272DE8BD2F55FF47AAC7C53257DBFF0\PackageCode = "10AAC301F174A9447AA745253AB19B59"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD73A4FEEF129E34981DC196C91C79CA\SourceList\PackageName = "dotnet-hostfxr-6.0.21-win-x86.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8361F15F9659BD047857A47AECF64DF1\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\307514C3C04491841B33B644A2610D7C\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{3C415703-440C-4819-B133-6B442A16D0C7}v48.87.64667\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{8bdfe669-9705-4184-9368-db9ce581e0e7}	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\307514C3C04491841B33B644A2610D7C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\307514C3C04491841B33B644A2610D7C\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13E50C477853C52439243293464C6257\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8361F15F9659BD047857A47AECF64DF1\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\16F350F7730518B71214A03200AA04D5\DD7FB6FA21B25C0419C9E29C0945BB1E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532"	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\Version = "237272852"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x86\ = "{B8ED272B-5F2D-4FF5-A7CA-C73552D7FB0F}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F69CEBDA7D057DE61BC89C3CE758E01B\808CC02C5C3E9B847B19B041C51D7D7A	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_apphost_pack_48.87.64667_x86	dotnet-sdk-6.0.413-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\ProductName = "Microsoft Windows Desktop Runtime - 6.0.21 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\DisplayName = "Microsoft .NET Host - 6.0.21 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.87.64723_x64\Dependents	windowsdesktop-runtime-6.0.21-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B272DE8BD2F55FF47AAC7C53257DBFF0\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD73A4FEEF129E34981DC196C91C79CA\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8361F15F9659BD047857A47AECF64DF1\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6}v48.87.64667\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD73A4FEEF129E34981DC196C91C79CA\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD5D59C9E092FCA4CBA65208D9880D20	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13E50C477853C52439243293464C6257\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\Dependents\{0f39db03-9030-48f3-82ef-5384bed81d85}	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\27DD5200959A5B540A3AE7EF1BA50805	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B272DE8BD2F55FF47AAC7C53257DBFF0\Version = "811072667"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_targeting_pack_48.87.64667_x86\Dependents	dotnet-sdk-6.0.413-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\307514C3C04491841B33B644A2610D7C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\SourceList\PackageName = "windowsdesktop-runtime-6.0.21-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\PackageName = "dotnet-runtime-6.0.21-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD73A4FEEF129E34981DC196C91C79CA\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD73A4FEEF129E34981DC196C91C79CA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E2F8F9A4A3D09D489006F9839E2EC98\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\Version = "811072667"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x86	dotnet-sdk-6.0.413-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\808CC02C5C3E9B847B19B041C51D7D7A\Provider	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD5D59C9E092FCA4CBA65208D9880D20\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\F2E91D5D9817EF24183029DCF14A752C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\Dependents	dotnet-sdk-6.0.413-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD73A4FEEF129E34981DC196C91C79CA\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\netstandard_targeting_pack_24.0.28113_x86\DisplayName = "Microsoft .NET Standard Targeting Pack - 2.1.0 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.87.64723_x64\Dependents\{0f39db03-9030-48f3-82ef-5384bed81d85}	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_targeting_pack_48.87.64667_x86\ = "{C20CC808-E3C5-48B9-B791-0B145CD1D7A7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\307514C3C04491841B33B644A2610D7C\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\Dependents	windowsdesktop-runtime-6.0.21-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
3540	chrome.exe
3540	chrome.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe
3136	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2640	NovaInstaller.exe
4240	windowsdesktop-runtime-6.0.15-win-x64.exe
1464	windowsdesktop-runtime-6.0.15-win-x64.exe
4788	windowsdesktop-runtime-6.0.21-win-x64.exe
180	vc_redist.x64.exe
1388	vc_redist.x64.exe
3440	VC_redist.x64.exe
832	VC_redist.x64.exe
2956	VC_redist.x64.exe
4816	VC_redist.x64.exe
2140	dotnet-sdk-6.0.405-win-x64.exe
4100	dotnet-sdk-6.0.405-win-x64.exe
3476	dotnet-sdk-6.0.413-win-x86.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4536	5036	chrome.exe	86
PID 5036 wrote to memory of 4536	5036	chrome.exe	86
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 4692	5036	chrome.exe	89
PID 5036 wrote to memory of 5060	5036	chrome.exe	90
PID 5036 wrote to memory of 5060	5036	chrome.exe	90
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91
PID 5036 wrote to memory of 2900	5036	chrome.exe	91

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nova.blksservers.com/Installer/2.1/NovaInstaller.exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6df49758,0x7ffd6df49768,0x7ffd6df49778
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:2
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3904 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:8
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5240 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1740 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3880 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:8
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3040 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1200 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 --field-trial-handle=1904,i,10207748068854150383,13855087166058015580,131072 /prefetch:8
  2⤵
  PID:4036
- C:\Users\Admin\Downloads\NovaInstaller.exe
  "C:\Users\Admin\Downloads\NovaInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2640
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe
    "windowsdesktop-runtime-6.0.15-win-x64.exe" /S
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4240
  - - C:\Windows\Temp\{639C3F7C-DBFF-4204-B24E-1491AE698FB0}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe
      "C:\Windows\Temp\{639C3F7C-DBFF-4204-B24E-1491AE698FB0}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=564 /S
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1464
    - - C:\Windows\Temp\{18754794-87B8-4208-90AF-C15397799318}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe
        
        "C:\Windows\Temp\{18754794-87B8-4208-90AF-C15397799318}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe" -q -burn.elevated BurnPipe.{048DFBA4-E1EC-4E05-8423-5FF526818FC9} {C513B90E-E42A-4277-BEA6-4F926558FA5B} 1464
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4788
- - C:\Users\Admin\Downloads\vc_redist.x64.exe
    "vc_redist.x64.exe" /install /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:180
  - - C:\Windows\Temp\{7DF61E1F-9B08-4D8B-A067-80C2F668DC74}\.cr\vc_redist.x64.exe
      "C:\Windows\Temp\{7DF61E1F-9B08-4D8B-A067-80C2F668DC74}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\vc_redist.x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=580 /install /quiet /norestart
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1388
    - - C:\Windows\Temp\{9A486AC2-4BB7-4B89-A7C6-63F3AF6723E7}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{9A486AC2-4BB7-4B89-A7C6-63F3AF6723E7}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{B121C794-2627-48EB-AC0B-F96022023182} {9FD05594-7249-4B63-B945-CA607F2E5C36} 1388
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:3440
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1168 -burn.embedded BurnPipe.{AC67A695-562A-42F6-B044-3DD4530A3992} {3857C608-D5F7-4631-BBC6-2D979EE57F7D} 3440
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:832
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1168 -burn.embedded BurnPipe.{AC67A695-562A-42F6-B044-3DD4530A3992} {3857C608-D5F7-4631-BBC6-2D979EE57F7D} 3440
        7⤵
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2956
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7157F8A1-F9D3-4CD9-B34C-91C19F0893D8} {008512B0-F143-41EF-AA53-6864612CCB52} 2956
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4816
- - C:\Users\Admin\Downloads\dotnet-sdk-6.0.405-win-x64.exe
    "dotnet-sdk-6.0.405-win-x64.exe" /install /quiet
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2140
  - - C:\Windows\Temp\{2F7EBD67-7DF2-4D9D-955A-B75215BE5C9E}\.cr\dotnet-sdk-6.0.405-win-x64.exe
      "C:\Windows\Temp\{2F7EBD67-7DF2-4D9D-955A-B75215BE5C9E}\.cr\dotnet-sdk-6.0.405-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\dotnet-sdk-6.0.405-win-x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=680 /install /quiet
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:4100
    - - C:\Windows\Temp\{B8E78548-E18F-45DE-BB34-9D3774733979}\.be\dotnet-sdk-6.0.413-win-x86.exe
        
        "C:\Windows\Temp\{B8E78548-E18F-45DE-BB34-9D3774733979}\.be\dotnet-sdk-6.0.413-win-x86.exe" -q -burn.elevated BurnPipe.{707E527F-2C01-49A4-8FEF-1DEF83D392AB} {94A225D9-2CCC-463E-B1A8-A8CF28A4A299} 4100
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:3476

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1476

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3136
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A34F0519AE5FC967E71D6256133077B6
  2⤵
  - Loads dropped DLL
  PID:4444
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 29FE3644ECE31B9307F0371AA2B79787
  2⤵
  - Loads dropped DLL
  PID:1288
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 39DE57F025587EC4C5F5884D74805E92
  2⤵
  - Loads dropped DLL
  PID:1276
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F917C569E036CA9E911AAEB869A368A9
  2⤵
  - Loads dropped DLL
  PID:2528
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7E7707B4425D5D9048845EC222E3167A
  2⤵
  - Loads dropped DLL
  PID:3744
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CD641EF5CC0B80E7207C8A9AADF42137
  2⤵
  - Loads dropped DLL
  PID:1648
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 366E1F11969B1EDF651782415F45E6AF
  2⤵
  - Loads dropped DLL
  PID:4676
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 156620631B71F60112D7A1A5CE04D975
  2⤵
  - Loads dropped DLL
  PID:4368
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1B3EAF7D84649F29C6CC53D21D0473FD
  2⤵
  - Loads dropped DLL
  PID:4668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8E4B79CE39BDA7B189D103A15CACD8A1
  2⤵
  - Loads dropped DLL
  PID:3660
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7FCDDF94B7C1EEA427D89F3D11FA46EC
  2⤵
  - Loads dropped DLL
  PID:4464
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3AC53B8B7A5621D9D8D4396C51957DE0
  2⤵
  - Loads dropped DLL
  PID:4812
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 325C2BA8C12DE3F8FB494D8F1E862001
  2⤵
  - Loads dropped DLL
  PID:4312
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2C7EDD548FA0628C9128A4D2B6EEA968
  2⤵
  - Loads dropped DLL
  PID:2600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1368

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e684101.rbs

Filesize
56KB

MD5
67318cbebd33d7c92f93c1df81676b5d

SHA1
f812f125edd9e586d2c3c21b14c6bed291050eab

SHA256
8197a4a36d4b4f0c7568c8aa39901e941dd4efc61b1e7e8b7a7ab56a4e962b9b

SHA512
c626ec31ae76016a5b4d1cc9b1c541021a874f8f4ad7187476aa327c85d524296412dcb720361b11a56338ef16723790963f989ed1f8030371661ccb0043c93f

Download Submit
C:\Config.Msi\e684106.rbs

Filesize
8KB

MD5
c85ca140e1705aa98dd39d5914d75dda

SHA1
3a0783702335e92002e5ba5fc716aeb8ca562ad1

SHA256
6869eaa4832c64361e93baec47d5afcb8aa792d1b1c664d362e90c7f27f6ba8d

SHA512
e9d6ce07fa0878624fe3f1e3590ed427027573dfc5351a77616975ce1f805e8ae2de4f75d3d8be7b2df2d1e426068d95e3c48d13c7bac3680ebbe1756b41b367

Download Submit
C:\Config.Msi\e68410b.rbs

Filesize
10KB

MD5
f5afe45295d803fd20d165cee2f25c35

SHA1
c4e06d57bd04788ddffc33a059e05e92fe425648

SHA256
02baaf63a7e46dc8210bf8e46ea89aa06a7a01de0c9fd122a6a213d6a46748e4

SHA512
44f6faa6b501008caa3016af3c5d0772ab1b94096302999c5c3df9cd10d8d6ddd890469832f65b0d43cda3efc9a5310fc4f50272f800cfe15fffac61f575c900

Download Submit
C:\Config.Msi\e684110.rbs

Filesize
87KB

MD5
773a03d696f14ea0ee7df2f21ee22d21

SHA1
0cd43c302caaf4c6d89ba4b024f948b33dbcb401

SHA256
887baf04de65aee9a93727a7ab3cafba86d9f9bb53f83791d7908bc787a2b51e

SHA512
b0a2243d7f4cbea6c28a08cb4c02e1a21fdd0737272874e22576c00970a3f94bfa78816bd01ee4beb2820357c009a65ab63fcc8e8abfba34212aabaf0e3d5192

Download Submit
C:\Config.Msi\e684117.rbs

Filesize
19KB

MD5
e4b3f5027c1167091e98f700c2936a9c

SHA1
f6a487ab269b9e1daa705f03189ee5b1e3cb5fad

SHA256
f7ea0e7d658d73a7564281326f8a261ffe8ff4e59ccf9fc3c46885ccf999b337

SHA512
bf44ab1619a1ba88193bc44ef9beb76c08f2ec4b5711becf9f572aead8c1ecdfdf2b88fa2026fb6d1507eef50f3fe84d34bdf832c06a2ccfd5a84e8fb18a9c7b

Download Submit
C:\Config.Msi\e684123.rbs

Filesize
19KB

MD5
3cc9914f8568004bdfff4250a02f11d8

SHA1
f9e2b63bdc387b8d509a844c67070b90101273f8

SHA256
61d41af59ca25d3cc27adab04f962c2739c2a6131167537c63ad2df7269eac12

SHA512
6ff161f9e2ed883069f780f612c2ac6170d97843527e33b21f1c9f3730fc3c0d0ecb48ba08f9f320f309d87c55079dfb3940719a54281dd813dd5f9825bb9771

Download Submit
C:\Config.Msi\e68412a.rbs

Filesize
21KB

MD5
35483db8efa799de897b51cb700ef10c

SHA1
68712dccefbd525d3343230584e263284ee088c7

SHA256
5e5b9dce36d2fdcd91c930b1b4b7a3c2f079c05bcb5ff049484274fb4d7755d2

SHA512
3df0669fb59ce292490af49f0a22fd0ea6d6aa89e21ba37de96568b93e2fa8a8097019bcac04264d19be1ddf6460a97d7cef800e1300f1c9eace4fbf49319aa4

Download Submit
C:\Config.Msi\e684139.rbs

Filesize
21KB

MD5
f59efcd682343d2b2362277afc3bbe75

SHA1
6f9e967b7275a75f1f51e353075e7bf96b3632cb

SHA256
a822f2baac6cceada69d2398830486bd929475717bbb8b566b715aab821dcfa9

SHA512
06715cc7e05c2257735ab04f5653fc770db6ae41132c65c187599a20d126f9b3706d8ba0597b2a96287df4dcded02bbb84b8d694fdad3cbe2a9d1f07cedef35a

Download Submit
C:\Config.Msi\e68413e.rbs

Filesize
57KB

MD5
25ee95671a69dea91c0c4246fca2a571

SHA1
6095e7f1ed3b85656cef4626166c5c66344a3878

SHA256
1e5be5c744e6a583324448cb8a06fa7b7182663ae12796c83624d29a7618c9e9

SHA512
ac3810f116152467539d89273ad92cab337e1c0d3ee3642a0eb588dcf804a2c7503cbc178ba6936c9ddd560ba9594eb2389cdb708d249247abe7c7351b89b82e

Download Submit
C:\Config.Msi\e684143.rbs

Filesize
8KB

MD5
dc30c7f810a4b10666364cbcc5918297

SHA1
53bd29906835170e052772808044ef5a1cb89535

SHA256
30204a13004b2b96f7c6c1541e30e37fe92d72d713ff22c5c2e8f4389ca1872d

SHA512
501110e70b62c05ed4028787ef528c85484e83622c5e663d0674977841858c870bf7574aa48cbbe7e88b16bce794eb130f2f623a0b334fd6f530fcb7e5cef325

Download Submit
C:\Config.Msi\e684148.rbs

Filesize
9KB

MD5
0bada10dd41a4cb28925bf47a0a046ab

SHA1
2a185918730acd4aa6f893659f907b2932bec042

SHA256
0bb9615a2c7a1b697800c30804b1a76573a690a02d23928961311210ad984b53

SHA512
50c0b936d5e7fe9f225b3eb98e251cd3f077d6a79e3028f3791d4bf943d4a7640d1bc1c898733b0d947a37837b55830d882b9c780cfa9910274ae0598aa4d41d

Download Submit
C:\Config.Msi\e68414d.rbs

Filesize
73KB

MD5
42acce600124eac641910928301ab0a5

SHA1
10bc6bda47d468a7d50b4af8d2c1ce3ab2bfbe7e

SHA256
34554e026bc38b620983a9af16f98ba61c662c72f3cb55cf25bd4fa652c845ba

SHA512
6fdbff0d86e1c93af309487d0fe92d9ef0500bc28cdbf80c37944e831bb8976391cd8a8f59dd46c4b6d4589b136602516c65a6f58d4fcc6361b567ef7be3797b

Download Submit
C:\Config.Msi\e684152.rbs

Filesize
10KB

MD5
7be4410f50fd918e963a801a2f2588a6

SHA1
196a52642e4d3066045f5f2e19d0d7dcd0f411af

SHA256
d153b278d8533412a244b7fc9384e8a4ed197617e0c978aee6a8cda4110e4589

SHA512
1360aa2086a6fdfd82f3a6b132b33748f3558602bdbb637a9bb5ff5804ddf980821b996a608e1d2a58cd752ea1dc5baaa3109844cadffd6e805152dca9673979

Download Submit
C:\Config.Msi\e684157.rbs

Filesize
11KB

MD5
d2a0c546e55a179b240a8e92d356e853

SHA1
6187a125f57a85e583c7925f624ed15cc77ec92d

SHA256
46baa216464e5861589ea82642851eb2afc68ce935684aa426abb3c625cd8ec3

SHA512
325b640131b9117ab21c1edd82ee195fb639eaa1b831c0154e068c91930808f3b37e915da4f54fd3f9fd2ec650aa8699b5c9e57552ff19b043cbd9927e6686c4

Download Submit
C:\Config.Msi\e68415c.rbs

Filesize
11KB

MD5
84eaf2239044229884a55e8e1ee90e36

SHA1
a3437641d3e8875c80713d25e95f5a7a863aa88e

SHA256
d3a181efcc47bf85421d0c13270880e1a251008d6d23638cd9df9cb9385565e2

SHA512
0d04ae106d7e9f2e0292d8d9dcf59a206abc1ec7cb738cf1461a7426ac891d19532a93393f198b91e1de325ae08341368400889a00b1e7f8106a65e8c35ddd98

Download Submit
C:\Config.Msi\e684161.rbs

Filesize
11KB

MD5
4ff1acb4bd7fb7e9ffe5c315f108c42d

SHA1
acf4b640ac55728e13ee8c763f74254384121059

SHA256
2b54af9e17a27e8cfde12a10c3afbdaf3ac9de55a8d6a9056a63af3dfc8d070c

SHA512
2cc38587cb22c24be0bcf7bbf61194447c4fcdecbcf600c5ad86ab64060b9d7121e6c06aacdcd3a0fd5c1a65563036855e0284d9929972c1868eac4e2e8f2c7a

Download Submit
C:\Config.Msi\e684166.rbs

Filesize
36KB

MD5
4fe7460a90960e532e67ff6c30f53303

SHA1
5c8872e3a9a7cb16071f2c8bec8234b1ea1438f4

SHA256
a22caab3e1a4b347a8c29c01c71862ca15d715e9c0f67fd54fcdcb66437ed343

SHA512
4e2e31c91dcae19b9bef2c05604308b8576e58af9e96a0d3150c2a6e2e41e4ebd8faf91fcee7e5909581f8741bb1890a98d4db9935fc2b0b11f050a393895c87

Download Submit
C:\Config.Msi\e68416b.rbs

Filesize
90KB

MD5
db4e1cacadaa85d82c31620aaa70eaf5

SHA1
d46cc55f66490cefd28016a70f6ef816f86515c8

SHA256
67d3ad645dac59ca2ffd1a22ac4447322b916b20aa769427410bce41c704be0e

SHA512
327ca54b71111a9e43af1d2c38f4062d5a53054fc6fd40061934856fab228955565e67041f3a8ba2898fdd3de5d1186e87d054a77725519d9612e308babfde36

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\PresentationNative_cor3.dll

Filesize
1.2MB

MD5
c7bcc68b81e965fe74ef58d503c58deb

SHA1
99990f204f7318eeb8de6f9664ebcd0d42ea81b7

SHA256
06cb4da78f5cfddece86329241a2af9d6390ce1082b02f7db2e3bf320215a23e

SHA512
cab2bc27eca0ee097324a2471c8228f1723cfef5df9971359eec7710082c122b26a7aa1d1e6faab75389438a358bbff2973ad67e8dd9046455b4c4ac880d858c

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\wpfgfx_cor3.dll

Filesize
1.9MB

MD5
1b01746fe61beb761a643050823190b0

SHA1
927b12e4a733bcc51545c6a005838a24b8dc4dda

SHA256
f8c4d6eb1cfa9c5b6fb322a0c818a4f5d5ee44043c259e0262c0460513953fb8

SHA512
83eeb187e554588a5a4efbce0fcb7e9c30e718ec9f6d797a7add28036e3d4506cd3e78386522467d7ac967a60ac509a23edd79a1b9032a7e230d980b9f36080a

Download Submit
C:\ProgramData\Package Cache\{0f39db03-9030-48f3-82ef-5384bed81d85}\state.rsm

Filesize
924B

MD5
59c182f62a4fea42a2ffdc561c7b9f28

SHA1
dac31afe1721586b6ea1fd456f20c8ff717859d1

SHA256
896acca0e08a5440dd09dca45f8295f8ae86529da1208fddd5a6bfe9f6394834

SHA512
3a83a3a506d2f00fa72f01d3113897ac1bfe91a4b68a5cc7012d7c2b41c4509faf568a7d37ea6dbf2a0a0bdae133b0a784e18d31b44862cb685bc746a832188d

Download Submit
C:\ProgramData\Package Cache\{0f39db03-9030-48f3-82ef-5384bed81d85}\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
cefdfc9fa769457a2892d0665c9fcb45

SHA1
f3061c1ad09e9711d4b93870d8b0e51b430a4f0e

SHA256
6b18528b9faef8046a1b605fdfe859ff2f1d0f0325ae38bc9e224b45b809c309

SHA512
255660fa8fb37f72cddd35ce19d29de97fd965f816d2553da6cbd5507787aa524fcd09181a1feb87577b2df61a792a423cce6e2f3da1ccc69c7bc6bb2d96b29d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
a18a40ee256a71a6c772e38f1b0e30ed

SHA1
dc9f69bed7b5b34eff43b300c16e027ca1c4cade

SHA256
adb8c5f8c5af2ea8b8dcb415b1e49eca1f4c4e9f627f950f21dc97876a65fad5

SHA512
abe8ec74b13bee2a7f09b5db05e53af7af03d3869a800da3584eea1d0b3aa76532f3a5b8a3b49acc154c64dcdcc626fa5d6b5c56a008eb54c2c508a3a5aae163

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
78bc77c4fda2f7787f97d19a3bf9306f

SHA1
91f8576672f1f839f8d019bd9dc701991accb187

SHA256
0758b60b8149f6be4d3bce5ccad8d83b80936d4da6a0d658698f29c82c617fc8

SHA512
a96cc10fbe86c5f9e77aea2d7b739c3dac718087467c9a9f0b41d8b19e3ba36be5484307bff3f63c493bd6f6f06bb37f3f4f87e41325dfda1ffd3cb2dd57a5e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
606f127747bde4bc8b202eba1746ccec

SHA1
4d32bef8ea71852bf16616fd954e75bd31d9d37c

SHA256
dd14822cc15f95d6c486c40eed8433ac223a280c0fe5e79470a041a5b0816383

SHA512
172654cbf2eaae1098ceaefe41f6979ef83ef9849eb5432caf5951ee1d46e90d7ee53e6e95279d1d474047fc357e9a608d36d74971b0e712e2a6f922e027e969

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0510c24dbac5f6501be375a90ad3518e

SHA1
53d371fb14e5e1f0361c0bf6af209c5ef55d8e59

SHA256
891babec1b51c145c9cc74c354a3f1f5ea4f71a0eb3490bf47789d905c5bca04

SHA512
86c30bfb0810bbc81a0cf4da3ebf8d6076e9f15dec04026ce12d0952c2e913fb1b07d5d1b43634fdc00fff08543201d11070ab8e68842aa36f6b9af14d9b4de8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
214KB

MD5
8841452a362886f1d884f87acfc9ef94

SHA1
486345900f4399443cd37a1d72402cd850c17291

SHA256
1b8a365418a895e6e3f1e016834dc3d36ea6dd7aa28375c3c90c80bdd053bbdb

SHA512
992abf62299e37ea78f63eab105d13df02918a5484fcb58d021bc3eae314ae33f88aecf3c5cd066e31b1201490dc5302ca554c49c95c3d657e2cc4d5bc12dfa8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
8e69f7b585f53e05989b3b93a1603ee7

SHA1
af7a33db5a3f5a1dc04d8f5411968434b99aaec4

SHA256
c1bb4204c8097c8801869aa9329811a1deff65ec8354f5ac3520c9d765a0ba0c

SHA512
8beda37e04b4d0f5bf81b5d61241f40ef4ecc7c7c6239a91d719a3b50f6adbf3afeba4b68c319e8ea483adfec2d81c0d2558576f77175928f155f2f088513b5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
107KB

MD5
c2e2dd7b1429df8735b9a869aaa0075c

SHA1
cdbf6d7be7399a88d7515379fe8229381cc13b1b

SHA256
70bc45362e6540b122c4af11285357d6c308f2247763a7d85a8f0a384f2b5b12

SHA512
ea7d652f465177087d957709fce4c5511409a894ec54b104939bc7157dbbd6d80518a2feff06d878a29046d8102dd680dea7f5f6a594a607ce715f674083bc7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe662bba.TMP

Filesize
106KB

MD5
e1fe7e3740046e72a76ba3812240b732

SHA1
3418595e9ab08e584f22caabf8bad748fdf679b6

SHA256
affe659122d5259c17190a2ac74a6997d59d5ccb2d7540ba8cae0cd13d7fc2c7

SHA512
26e9c7e266883eda9c25486c0d991ad1a3d7fd5c49892e79400116232c9adabaf80f4169efe77f17c7c97be5fa40d349e736cc800cff240df77adeeab1f27591

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\uWcU5_6FXSwQ4UMNThCcNYZC4UGolsg=\D3DCompiler_47_cor3.dll

Filesize
4.7MB

MD5
2191e768cc2e19009dad20dc999135a3

SHA1
f49a46ba0e954e657aaed1c9019a53d194272b6a

SHA256
7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

SHA512
5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\uWcU5_6FXSwQ4UMNThCcNYZC4UGolsg=\PresentationNative_cor3.dll

Filesize
1.2MB

MD5
c7bcc68b81e965fe74ef58d503c58deb

SHA1
99990f204f7318eeb8de6f9664ebcd0d42ea81b7

SHA256
06cb4da78f5cfddece86329241a2af9d6390ce1082b02f7db2e3bf320215a23e

SHA512
cab2bc27eca0ee097324a2471c8228f1723cfef5df9971359eec7710082c122b26a7aa1d1e6faab75389438a358bbff2973ad67e8dd9046455b4c4ac880d858c

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\uWcU5_6FXSwQ4UMNThCcNYZC4UGolsg=\wpfgfx_cor3.dll

Filesize
1.9MB

MD5
1b01746fe61beb761a643050823190b0

SHA1
927b12e4a733bcc51545c6a005838a24b8dc4dda

SHA256
f8c4d6eb1cfa9c5b6fb322a0c818a4f5d5ee44043c259e0262c0460513953fb8

SHA512
83eeb187e554588a5a4efbce0fcb7e9c30e718ec9f6d797a7add28036e3d4506cd3e78386522467d7ac967a60ac509a23edd79a1b9032a7e230d980b9f36080a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20231101185240_000_dotnet_runtime_6.0.21_win_x64.msi.log

Filesize
3KB

MD5
d02b11b60896c94f6657a4308731c4a6

SHA1
808036139b986595601b521baac1113a58172bc9

SHA256
ecc49b91478f9467eb564fd786c062dd47701d671a840e51e0001b408e7d24c4

SHA512
8dc65e380e82dc9c86e2278a6c1efda978e49c71509e05499a6c39eb0d3f72557ceed399b4aad9991823fa9a0c9d0c3cd492e5ee4ffd5e78ff4be77afc1b77dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20231101185240_001_dotnet_hostfxr_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
2f15d9ac61a3a649791db80185411a07

SHA1
8ce8b70d6c7a647d23f3603d42fb9047c252da7c

SHA256
9d2d6d4ec5ee79a1ab1d2296744ff7c2dfb44d1f107e8f1514f34ac10ed62f27

SHA512
7b015aca73be1ba9f125854dcb81c047274d1d12321a2b2a79a5a84f6db250f026d0e24fd1c9aa2067167d3f57f5be25a2607b39758ffc4ce6376159b90533d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20231101185240_002_dotnet_host_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
61fbb1af1c1440d3950ebb7aab744717

SHA1
cdfa73f92f11b4500d0d76673c246ed6aefb6122

SHA256
5bef9c10e69262aad44ee779437cfd847a47c2cdde4ee386cf42f1ae53f0c19c

SHA512
e6bb961adac57b1445585f11562f9e6c561f7f9ae188686cf73071c5981184b92b14b04905ef30ea10d238a872e98a18e9a46ffd9e4415dc290ea78734748bc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20231101185240_003_windowsdesktop_runtime_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
e59a83363f474937f90414a7a9e5d947

SHA1
947116909aa48a05c280e833690df1b488e2a130

SHA256
066340ee17c577a3aaa63a08f43b8412ac04c5e2fbbb18be1795082da9a8f0dd

SHA512
2021780416d7e878a070fad01201d06a329df5adb8460ea0d41a330f94ee61e2df3cd90d72bb0ccd26f9f489455f4f630b9a7eb512c3df1485ff09c0aa9dc920

Download Submit
C:\Users\Admin\Downloads\NovaInstaller.exe

Filesize
152.1MB

MD5
6196a6ac54713dc0d11c7ebab96bc6d0

SHA1
594c07c73f5844f74dc80b79f9d29ae0c9591f3f

SHA256
74db4ae35512c9a7be17f01544b2a5bd56b3b256edb3f179e76b59951f222175

SHA512
613b185438c693c25e55174eaf2dc5e8d36b57f462c82ab318276219b0bdadb1f145712b9dbb4bd49ad60dfc8e9176428c6cceaac3ff615c13e60e74153724c7

Download Submit
C:\Users\Admin\Downloads\NovaInstaller.exe

Filesize
152.1MB

MD5
6196a6ac54713dc0d11c7ebab96bc6d0

SHA1
594c07c73f5844f74dc80b79f9d29ae0c9591f3f

SHA256
74db4ae35512c9a7be17f01544b2a5bd56b3b256edb3f179e76b59951f222175

SHA512
613b185438c693c25e55174eaf2dc5e8d36b57f462c82ab318276219b0bdadb1f145712b9dbb4bd49ad60dfc8e9176428c6cceaac3ff615c13e60e74153724c7

Download Submit
C:\Users\Admin\Downloads\NovaInstaller.exe

Filesize
152.1MB

MD5
6196a6ac54713dc0d11c7ebab96bc6d0

SHA1
594c07c73f5844f74dc80b79f9d29ae0c9591f3f

SHA256
74db4ae35512c9a7be17f01544b2a5bd56b3b256edb3f179e76b59951f222175

SHA512
613b185438c693c25e55174eaf2dc5e8d36b57f462c82ab318276219b0bdadb1f145712b9dbb4bd49ad60dfc8e9176428c6cceaac3ff615c13e60e74153724c7

Download Submit
C:\Users\Admin\Downloads\vc_redist.x64.exe

Filesize
24.2MB

MD5
077f0abdc2a3881d5c6c774af821f787

SHA1
c483f66c48ba83e99c764d957729789317b09c6b

SHA256
917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888

SHA512
70a888d5891efd2a48d33c22f35e9178bd113032162dc5a170e7c56f2d592e3c59a08904b9f1b54450c80f8863bda746e431b396e4c1624b91ff15dd701bd939

Download Submit
C:\Users\Admin\Downloads\vc_redist.x64.exe

Filesize
24.2MB

MD5
077f0abdc2a3881d5c6c774af821f787

SHA1
c483f66c48ba83e99c764d957729789317b09c6b

SHA256
917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888

SHA512
70a888d5891efd2a48d33c22f35e9178bd113032162dc5a170e7c56f2d592e3c59a08904b9f1b54450c80f8863bda746e431b396e4c1624b91ff15dd701bd939

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
54.7MB

MD5
1a6d60add2d112dd73e83fb46dca474d

SHA1
8b374a54f508cfdb8c8176bfaef96f37edf7170b

SHA256
aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545

SHA512
49192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
54.7MB

MD5
1a6d60add2d112dd73e83fb46dca474d

SHA1
8b374a54f508cfdb8c8176bfaef96f37edf7170b

SHA256
aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545

SHA512
49192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79

Download Submit
C:\Windows\Installer\MSI2578.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI2578.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI465E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI465E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI508E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI508E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8D2D.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8D2D.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI973.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI973.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI9C8D.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI9C8D.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI9DA9.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI9DA9.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIBB13.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIBB13.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIBB13.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\e684102.msi

Filesize
25.7MB

MD5
0fda2bb0ba0c1dd265e9540265a035b7

SHA1
03461f9f268e5ec0a997990c05b16086a03505dc

SHA256
bb994af42653ab3738ea3b689f6870c2549f6f170f23a1a8a161c7e02ccec9b1

SHA512
acdcb21c4ac6587b7a7cc43078a075f2f06d71823ace65e175611e0ef8af2bc7c753b7618447ba6d9f24cbea63cf582bcd5f71ca3b7a79066ca6cd61c43ed7d6

Download Submit
C:\Windows\Installer\e684103.msi

Filesize
804KB

MD5
5dce0ef6b5d0bd2b850106a22b5e0264

SHA1
263cfbd815de6b877d084ab4b3d2f878d71c9b1f

SHA256
c98010f7c473bdb2a182e61aae35a20c044006fee26ffb378346cbdf255d2736

SHA512
fc7297d142cf8d0247ac86732182a031e819a4fc41b034d1b9a7dba5cdb56d73e158dd57132b6a083b3f6184859b4dca4a1a21205f6d11b2be6ca3913e89891b

Download Submit
C:\Windows\Installer\e684111.msi

Filesize
28.5MB

MD5
6ec2d8f7944d0766603fa3b043fe2410

SHA1
000a79c4792abbfdf65ca3b5367b7a3b02146732

SHA256
619074e13358e2c259086bf306083229ae8d3472187bc755951413858949cb68

SHA512
4f86befae9a437985e4ae491f416b0c06a72344ffccfb00c325e91d48244b46edee784003c0a519bc39fdb14409d949c7fe7cde7f51b3479d504c61d88f6371b

Download Submit
C:\Windows\Installer\e684124.msi

Filesize
188KB

MD5
a4075b745d8e506c48581c4a99ec78aa

SHA1
389e8b1dbeebdff749834b63ae06644c30feac84

SHA256
ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93

SHA512
0b980f397972bfc55e30c06e6e98e07b474e963832b76cdb48717e6772d0348f99c79d91ea0b4944fe0181ad5d6701d9527e2ee62c14123f1f232c1da977cada

Download Submit
C:\Windows\Installer\e68413f.msi

Filesize
23.3MB

MD5
e79bada7cb5640f0c5c486a63fcfb75d

SHA1
b8c1fdadebd64a237ba63676e45c4702f998278b

SHA256
7d585a27e8fe15388570ea170765651189bad6ad7d2d84b6c252bf950784e516

SHA512
950f938fee3ae3328ad69ebc39e515fd0473753b1266a0f5a4c2354235526a6865661648990f90f844a4e493cef8c4b42495626e7ea8912442579ccfd3c7af36

Download Submit
C:\Windows\Temp\{18754794-87B8-4208-90AF-C15397799318}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{18754794-87B8-4208-90AF-C15397799318}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{18754794-87B8-4208-90AF-C15397799318}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{18754794-87B8-4208-90AF-C15397799318}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{18754794-87B8-4208-90AF-C15397799318}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{18754794-87B8-4208-90AF-C15397799318}\dotnet_host_6.0.21_win_x64.msi

Filesize
736KB

MD5
12b8c5914e56f4bd933c8490f7f6cd45

SHA1
2ec135cdd97adbcfe7decb04f1a5e95b6f0614e3

SHA256
3b83682de5bfeabde75ffc34330f470df11ce5e62c2509c50b3e48e35130fa51

SHA512
ecc9ddd52d097ca6f643f7ce78399b01d37e776e30abb8b82b6278711716e6893528340b6719f8287848931759ae41427c252cb00df97742583dbe5d7ea4277a

Download Submit
C:\Windows\Temp\{18754794-87B8-4208-90AF-C15397799318}\dotnet_hostfxr_6.0.21_win_x64.msi

Filesize
804KB

MD5
5dce0ef6b5d0bd2b850106a22b5e0264

SHA1
263cfbd815de6b877d084ab4b3d2f878d71c9b1f

SHA256
c98010f7c473bdb2a182e61aae35a20c044006fee26ffb378346cbdf255d2736

SHA512
fc7297d142cf8d0247ac86732182a031e819a4fc41b034d1b9a7dba5cdb56d73e158dd57132b6a083b3f6184859b4dca4a1a21205f6d11b2be6ca3913e89891b

Download Submit
C:\Windows\Temp\{18754794-87B8-4208-90AF-C15397799318}\dotnet_runtime_6.0.21_win_x64.msi

Filesize
25.7MB

MD5
0fda2bb0ba0c1dd265e9540265a035b7

SHA1
03461f9f268e5ec0a997990c05b16086a03505dc

SHA256
bb994af42653ab3738ea3b689f6870c2549f6f170f23a1a8a161c7e02ccec9b1

SHA512
acdcb21c4ac6587b7a7cc43078a075f2f06d71823ace65e175611e0ef8af2bc7c753b7618447ba6d9f24cbea63cf582bcd5f71ca3b7a79066ca6cd61c43ed7d6

Download Submit
C:\Windows\Temp\{18754794-87B8-4208-90AF-C15397799318}\windowsdesktop_runtime_6.0.21_win_x64.msi

Filesize
28.5MB

MD5
6ec2d8f7944d0766603fa3b043fe2410

SHA1
000a79c4792abbfdf65ca3b5367b7a3b02146732

SHA256
619074e13358e2c259086bf306083229ae8d3472187bc755951413858949cb68

SHA512
4f86befae9a437985e4ae491f416b0c06a72344ffccfb00c325e91d48244b46edee784003c0a519bc39fdb14409d949c7fe7cde7f51b3479d504c61d88f6371b

Download Submit
C:\Windows\Temp\{37FA4E9E-0062-427D-A646-65AFDB9309BA}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{639C3F7C-DBFF-4204-B24E-1491AE698FB0}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{639C3F7C-DBFF-4204-B24E-1491AE698FB0}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{7DF61E1F-9B08-4D8B-A067-80C2F668DC74}\.cr\vc_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{7DF61E1F-9B08-4D8B-A067-80C2F668DC74}\.cr\vc_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{9A486AC2-4BB7-4B89-A7C6-63F3AF6723E7}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{9A486AC2-4BB7-4B89-A7C6-63F3AF6723E7}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{9A486AC2-4BB7-4B89-A7C6-63F3AF6723E7}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{9A486AC2-4BB7-4B89-A7C6-63F3AF6723E7}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{9A486AC2-4BB7-4B89-A7C6-63F3AF6723E7}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{9A486AC2-4BB7-4B89-A7C6-63F3AF6723E7}\cab5046A8AB272BF37297BB7928664C9503

Filesize
935KB

MD5
c2df6cb9082ac285f6acfe56e3a4430a

SHA1
591e03bf436d448296798a4d80f6a39a00502595

SHA256
b8b4732a600b741e824ab749321e029a07390aa730ec59401964b38105d5fa11

SHA512
9f21b621fc871dd72de0c518174d1cbe41c8c93527269c3765b65edee870a8945ecc2700d49f5da8f6fab0aa3e4c2db422b505ffcbcb2c5a1ddf4b9cec0e8e13

Download Submit
C:\Windows\Temp\{9A486AC2-4BB7-4B89-A7C6-63F3AF6723E7}\vcRuntimeAdditional_x64

Filesize
188KB

MD5
dd070483eda0af71a2e52b65867d7f5d

SHA1
2b182fc81d19ae8808e5b37d8e19c4dafeec8106

SHA256
1c450cacdbf38527c27eb2107a674cd9da30aaf93a36be3c5729293f6f586e07

SHA512
69e16ee172d923173e874b12037629201017698997e8ae7a6696aab1ad3222ae2359f90dea73a7487ca9ff6b7c01dc6c4c98b0153b6f1ada8b59d2cec029ec1a

Download Submit
C:\Windows\Temp\{9A486AC2-4BB7-4B89-A7C6-63F3AF6723E7}\vcRuntimeMinimum_x64

Filesize
188KB

MD5
a4075b745d8e506c48581c4a99ec78aa

SHA1
389e8b1dbeebdff749834b63ae06644c30feac84

SHA256
ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93

SHA512
0b980f397972bfc55e30c06e6e98e07b474e963832b76cdb48717e6772d0348f99c79d91ea0b4944fe0181ad5d6701d9527e2ee62c14123f1f232c1da977cada

Download Submit
C:\Windows\Temp\{B8E78548-E18F-45DE-BB34-9D3774733979}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{B8E78548-E18F-45DE-BB34-9D3774733979}\.be\dotnet-sdk-6.0.413-win-x86.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{B8E78548-E18F-45DE-BB34-9D3774733979}\AspNetCoreSharedFramework_x86

Filesize
7.5MB

MD5
759608b8db045afb303c4f66dca422b0

SHA1
f0536b100dfaec1e7de7c8c35ca7c7ad5ae6e779

SHA256
2035e3187d8b8369167ebf3e96c84f68639875eeaae7fd743379d0f4fc2eb30b

SHA512
25d6b772650a87bf428c7e1517f09876c2da789d53c4259d9a064d9f682e739226f37cc7d420653573f5fd898b0a0b6b23abef94406497bbd55852cbf7298447

Download Submit
memory/2640-184-0x00000210713C0000-0x0000021071400000-memory.dmp

Filesize
256KB

Download
memory/2640-206-0x0000021071000000-0x000002107102A000-memory.dmp

Filesize
168KB

Download
memory/2640-197-0x0000021071500000-0x00000210715F4000-memory.dmp

Filesize
976KB

Download
memory/2640-200-0x0000021070F70000-0x0000021070F78000-memory.dmp

Filesize
32KB

Download
memory/2640-187-0x0000021070FC0000-0x0000021070FD8000-memory.dmp

Filesize
96KB

Download
memory/2640-223-0x00007FF655A50000-0x00007FF65637D000-memory.dmp

Filesize
9.2MB

Download
memory/2640-181-0x0000021070FA0000-0x0000021070FB6000-memory.dmp

Filesize
88KB

Download
memory/2640-169-0x0000021070F80000-0x0000021070F99000-memory.dmp

Filesize
100KB

Download
memory/2640-166-0x0000021070E30000-0x0000021070E37000-memory.dmp

Filesize
28KB

Download
memory/2640-163-0x0000021070F30000-0x0000021070F43000-memory.dmp

Filesize
76KB

Download
memory/2640-203-0x0000021071460000-0x00000210714A7000-memory.dmp

Filesize
284KB

Download
memory/2640-190-0x0000021070FE0000-0x0000021070FF2000-memory.dmp

Filesize
72KB

Download
memory/2640-209-0x0000021075790000-0x0000021075FAC000-memory.dmp

Filesize
8.1MB

Download
memory/2640-160-0x0000021070E20000-0x0000021070E25000-memory.dmp

Filesize
20KB

Download
memory/2640-157-0x0000021070E10000-0x0000021070E1D000-memory.dmp

Filesize
52KB

Download
memory/2640-154-0x0000021070EA0000-0x0000021070F1F000-memory.dmp

Filesize
508KB

Download
memory/2640-151-0x0000021072D10000-0x0000021073552000-memory.dmp

Filesize
8.3MB

Download
memory/2640-148-0x00000210707F0000-0x000002107082E000-memory.dmp

Filesize
248KB

Download
memory/2640-143-0x0000021070E50000-0x0000021070E94000-memory.dmp

Filesize
272KB

Download
memory/2640-140-0x0000021071260000-0x00000210713BE000-memory.dmp

Filesize
1.4MB

Download
memory/2640-137-0x0000021071030000-0x0000021071258000-memory.dmp

Filesize
2.2MB

Download
memory/2640-133-0x0000021071D80000-0x0000021072D08000-memory.dmp

Filesize
15.5MB

Download
memory/2640-134-0x00007FF655A50000-0x00007FF65637D000-memory.dmp

Filesize
9.2MB

Download
memory/2640-130-0x0000000180000000-0x0000000180A25000-memory.dmp

Filesize
10.1MB

Download