74db4ae35512c9a7be17f01544b2a5bd56b3b256edb3f179e76b59951f222175

Analysis

max time kernel
153s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2023, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NovaInstaller.exe
Size

152.1MB
MD5

6196a6ac54713dc0d11c7ebab96bc6d0
SHA1

594c07c73f5844f74dc80b79f9d29ae0c9591f3f
SHA256

74db4ae35512c9a7be17f01544b2a5bd56b3b256edb3f179e76b59951f222175
SHA512

613b185438c693c25e55174eaf2dc5e8d36b57f462c82ab318276219b0bdadb1f145712b9dbb4bd49ad60dfc8e9176428c6cceaac3ff615c13e60e74153724c7
SSDEEP

786432:65Nre6UmdCvF4N3RtI9n1gqBf8ICtZNXDPWsUwZnb5xFTtLwSTRpf4P1wT1vdvmu:A5UmamUyqtSyctjdegUc

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	dotnet-sdk-6.0.405-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-6.0.15-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	vc_redist.x64.exe

Executes dropped EXE 9 IoCs

pid	Process
3472	windowsdesktop-runtime-6.0.15-win-x64.exe
1492	windowsdesktop-runtime-6.0.15-win-x64.exe
3848	windowsdesktop-runtime-6.0.21-win-x64.exe
1224	vc_redist.x64.exe
4184	vc_redist.x64.exe
5024	VC_redist.x64.exe
3376	dotnet-sdk-6.0.405-win-x64.exe
2148	dotnet-sdk-6.0.405-win-x64.exe
4244	dotnet-sdk-6.0.413-win-x86.exe

Loads dropped DLL 18 IoCs

pid	Process
2348	NovaInstaller.exe
2348	NovaInstaller.exe
2348	NovaInstaller.exe
1492	windowsdesktop-runtime-6.0.15-win-x64.exe
5040	MsiExec.exe
5040	MsiExec.exe
1100	MsiExec.exe
1100	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
1548	MsiExec.exe
1548	MsiExec.exe
4184	vc_redist.x64.exe
2780	VC_redist.x64.exe
2148	dotnet-sdk-6.0.405-win-x64.exe
2280	MsiExec.exe
5088	MsiExec.exe
2652	MsiExec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{901a4233-9860-4dd0-bb2d-0d86482fc5bd} = "\"C:\\ProgramData\\Package Cache\\{901a4233-9860-4dd0-bb2d-0d86482fc5bd}\\dotnet-sdk-6.0.413-win-x86.exe\" /burn.runonce"	dotnet-sdk-6.0.413-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0f39db03-9030-48f3-82ef-5384bed81d85} = "\"C:\\ProgramData\\Package Cache\\{0f39db03-9030-48f3-82ef-5384bed81d85}\\windowsdesktop-runtime-6.0.21-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{8bdfe669-9705-4184-9368-db9ce581e0e7} = "\"C:\\ProgramData\\Package Cache\\{8bdfe669-9705-4184-9368-db9ce581e0e7}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\cs\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-crt-process-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\mscordbi.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\fr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ru\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Printing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pt-BR\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pl\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pt-BR\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\cs\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\fr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pl\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-crt-runtime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-rtlsupport-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-namedpipe-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-crt-locale-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\de\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\it\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-console-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\Accessibility.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-crt-filesystem-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.WebClient.dll	msiexec.exe
File created	C:\Program Files\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.IO.Packaging.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hans\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\LICENSE.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pl\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Private.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ru\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Windows.Forms.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.Quic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Windows.Controls.Ribbon.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\tr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Drawing.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-rtlsupport-l1-1-0.dll	msiexec.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5861a6.msi	msiexec.exe
File created	C:\Windows\Installer\e5861d0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D5C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e586198.msi	msiexec.exe
File created	C:\Windows\Installer\e58619d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI92CD.tmp	msiexec.exe
File created	C:\Windows\Installer\e5861ba.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0025DD72-A959-45B5-A0A3-7EFEB15A8050}	msiexec.exe
File opened for modification	C:\Windows\Installer\e586193.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D937EF87-F11D-4778-973C-B71E178F95D0}	msiexec.exe
File created	C:\Windows\Installer\e58619c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI90F7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI34C0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI88A8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58619d.msi	msiexec.exe
File created	C:\Windows\Installer\e5861a1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5861d5.msi	msiexec.exe
File created	C:\Windows\Installer\e5861df.msi	msiexec.exe
File created	C:\Windows\Installer\e586193.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D5E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2733.tmp	msiexec.exe
File created	C:\Windows\Installer\e5861d5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D8D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97C0.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D5D19E2F-7189-42FE-8103-92CD1FA457C2}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D11.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI25F9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5861d0.msi	msiexec.exe
File created	C:\Windows\Installer\e586197.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8328.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI877F.tmp	msiexec.exe
File created	C:\Windows\Installer\e5861cf.msi	msiexec.exe
File created	C:\Windows\Installer\e586198.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D3D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6}	msiexec.exe
File created	C:\Windows\Installer\e5861d9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5861a2.msi	msiexec.exe
File created	C:\Windows\Installer\e5861d4.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EF4A37DD-21FE-43E9-89D1-1C699CC197AC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B1B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5861df.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI75D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5861ba.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B2B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EA5.tmp	msiexec.exe
File created	C:\Windows\Installer\e5861a2.msi	msiexec.exe
File created	C:\Windows\Installer\e5861b9.msi	msiexec.exe
File created	C:\Windows\Installer\e5861da.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F7E.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8D2EC92E-5903-4B25-9406-182B8EFA834F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F01.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AF6BF7DD-2B12-40C5-919C-2EC99054BBE1}	msiexec.exe
File created	C:\Windows\Installer\e5861a7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5861da.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A9F8F2E3-D3A4-4D90-9800-F689932ECE89}	msiexec.exe
File created	C:\Windows\Installer\e5861de.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD7C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5861a7.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B8ED272B-5F2D-4FF5-A7CA-C73552D7FB0F}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000326c22034809cb6a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000326c22030000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900326c2203000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d326c2203000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000326c220300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 23 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\PackageCode = "F3EE2D1AE943B6A42849618D009E9E0C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD73A4FEEF129E34981DC196C91C79CA\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\78FE739DD11F877479C37BE171F8590D\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BE3E5325A595AB443B7CED4E083B14EB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.36.32532"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD73A4FEEF129E34981DC196C91C79CA\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\Dependents\{901a4233-9860-4dd0-bb2d-0d86482fc5bd}	dotnet-sdk-6.0.413-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A036181AE3507D45E36606F9464ED83\3E2F8F9A4A3D09D489006F9839E2EC98	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\Dependents\{8bdfe669-9705-4184-9368-db9ce581e0e7}	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B272DE8BD2F55FF47AAC7C53257DBFF0\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9E9FD90E4E4505C78CAA858E06886EB9\B272DE8BD2F55FF47AAC7C53257DBFF0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E2F8F9A4A3D09D489006F9839E2EC98\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.87.64723_x64\Version = "48.87.64723"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\27DD5200959A5B540A3AE7EF1BA50805	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E29CE2D8309552B4496081B2E8AF38F4\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{901a4233-9860-4dd0-bb2d-0d86482fc5bd}\ = "{901a4233-9860-4dd0-bb2d-0d86482fc5bd}"	dotnet-sdk-6.0.413-win-x86.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD73A4FEEF129E34981DC196C91C79CA\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DD7FB6FA21B25C0419C9E29C0945BB1E\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.87.64667_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD73A4FEEF129E34981DC196C91C79CA\ProductName = "Microsoft .NET Host FX Resolver - 6.0.21 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.87.64667_x64\ = "{D937EF87-F11D-4778-973C-B71E178F95D0}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\F2E91D5D9817EF24183029DCF14A752C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\ProductName = "Microsoft .NET Runtime - 6.0.21 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\ProductName = "Microsoft .NET Host FX Resolver - 6.0.21 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD73A4FEEF129E34981DC196C91C79CA\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86	dotnet-sdk-6.0.413-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\Dependents	windowsdesktop-runtime-6.0.21-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.87.64723_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B272DE8BD2F55FF47AAC7C53257DBFF0\ProductName = "Microsoft .NET Runtime - 6.0.21 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B272DE8BD2F55FF47AAC7C53257DBFF0\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B272DE8BD2F55FF47AAC7C53257DBFF0\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\PackageCode = "44C0CE721D44C91429496EFE8E61E9A2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\ = "{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\DisplayName = "Microsoft .NET Host - 6.0.21 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7F53FF62BBDAF9C479AD9721D08BE06C\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\Language = "1033"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	NovaInstaller.exe
Token: SeShutdownPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSecurityPrivilege	1444	msiexec.exe
Token: SeCreateTokenPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeLockMemoryPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeMachineAccountPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeTcbPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSecurityPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeTakeOwnershipPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeLoadDriverPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemProfilePrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemtimePrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeProfSingleProcessPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncBasePriorityPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreatePagefilePrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreatePermanentPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeBackupPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRestorePrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeShutdownPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeDebugPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeAuditPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemEnvironmentPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeChangeNotifyPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRemoteShutdownPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeUndockPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSyncAgentPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeEnableDelegationPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeManageVolumePrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeImpersonatePrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreateGlobalPrivilege	3848	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3472	2348	NovaInstaller.exe	101
PID 2348 wrote to memory of 3472	2348	NovaInstaller.exe	101
PID 2348 wrote to memory of 3472	2348	NovaInstaller.exe	101
PID 3472 wrote to memory of 1492	3472	windowsdesktop-runtime-6.0.15-win-x64.exe	102
PID 3472 wrote to memory of 1492	3472	windowsdesktop-runtime-6.0.15-win-x64.exe	102
PID 3472 wrote to memory of 1492	3472	windowsdesktop-runtime-6.0.15-win-x64.exe	102
PID 1492 wrote to memory of 3848	1492	windowsdesktop-runtime-6.0.15-win-x64.exe	103
PID 1492 wrote to memory of 3848	1492	windowsdesktop-runtime-6.0.15-win-x64.exe	103
PID 1492 wrote to memory of 3848	1492	windowsdesktop-runtime-6.0.15-win-x64.exe	103
PID 1444 wrote to memory of 5040	1444	msiexec.exe	107
PID 1444 wrote to memory of 5040	1444	msiexec.exe	107
PID 1444 wrote to memory of 5040	1444	msiexec.exe	107
PID 1444 wrote to memory of 1100	1444	msiexec.exe	110
PID 1444 wrote to memory of 1100	1444	msiexec.exe	110
PID 1444 wrote to memory of 1100	1444	msiexec.exe	110
PID 1444 wrote to memory of 4832	1444	msiexec.exe	112
PID 1444 wrote to memory of 4832	1444	msiexec.exe	112
PID 1444 wrote to memory of 4832	1444	msiexec.exe	112
PID 1444 wrote to memory of 1548	1444	msiexec.exe	113
PID 1444 wrote to memory of 1548	1444	msiexec.exe	113
PID 1444 wrote to memory of 1548	1444	msiexec.exe	113
PID 2348 wrote to memory of 1224	2348	NovaInstaller.exe	118
PID 2348 wrote to memory of 1224	2348	NovaInstaller.exe	118
PID 2348 wrote to memory of 1224	2348	NovaInstaller.exe	118
PID 1224 wrote to memory of 4184	1224	vc_redist.x64.exe	119
PID 1224 wrote to memory of 4184	1224	vc_redist.x64.exe	119
PID 1224 wrote to memory of 4184	1224	vc_redist.x64.exe	119
PID 4184 wrote to memory of 5024	4184	vc_redist.x64.exe	120
PID 4184 wrote to memory of 5024	4184	vc_redist.x64.exe	120
PID 4184 wrote to memory of 5024	4184	vc_redist.x64.exe	120
PID 5024 wrote to memory of 2280	5024	VC_redist.x64.exe	128
PID 5024 wrote to memory of 2280	5024	VC_redist.x64.exe	128
PID 5024 wrote to memory of 2280	5024	VC_redist.x64.exe	128
PID 2280 wrote to memory of 2780	2280	VC_redist.x64.exe	129
PID 2280 wrote to memory of 2780	2280	VC_redist.x64.exe	129
PID 2280 wrote to memory of 2780	2280	VC_redist.x64.exe	129
PID 2780 wrote to memory of 5068	2780	VC_redist.x64.exe	130
PID 2780 wrote to memory of 5068	2780	VC_redist.x64.exe	130
PID 2780 wrote to memory of 5068	2780	VC_redist.x64.exe	130
PID 2348 wrote to memory of 3376	2348	NovaInstaller.exe	131
PID 2348 wrote to memory of 3376	2348	NovaInstaller.exe	131
PID 2348 wrote to memory of 3376	2348	NovaInstaller.exe	131
PID 3376 wrote to memory of 2148	3376	dotnet-sdk-6.0.405-win-x64.exe	132
PID 3376 wrote to memory of 2148	3376	dotnet-sdk-6.0.405-win-x64.exe	132
PID 3376 wrote to memory of 2148	3376	dotnet-sdk-6.0.405-win-x64.exe	132
PID 2148 wrote to memory of 4244	2148	dotnet-sdk-6.0.405-win-x64.exe	133
PID 2148 wrote to memory of 4244	2148	dotnet-sdk-6.0.405-win-x64.exe	133
PID 2148 wrote to memory of 4244	2148	dotnet-sdk-6.0.405-win-x64.exe	133
PID 1444 wrote to memory of 2280	1444	msiexec.exe	134
PID 1444 wrote to memory of 2280	1444	msiexec.exe	134
PID 1444 wrote to memory of 2280	1444	msiexec.exe	134
PID 1444 wrote to memory of 5088	1444	msiexec.exe	135
PID 1444 wrote to memory of 5088	1444	msiexec.exe	135
PID 1444 wrote to memory of 5088	1444	msiexec.exe	135
PID 1444 wrote to memory of 2652	1444	msiexec.exe	136
PID 1444 wrote to memory of 2652	1444	msiexec.exe	136
PID 1444 wrote to memory of 2652	1444	msiexec.exe	136

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\NovaInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\NovaInstaller.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.15-win-x64.exe
  "windowsdesktop-runtime-6.0.15-win-x64.exe" /S
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\Temp\{9FAAD581-E831-477F-B9EF-9AF78D47B530}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe
    "C:\Windows\Temp\{9FAAD581-E831-477F-B9EF-9AF78D47B530}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=552 /S
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\Temp\{CFFF00AA-D86B-4C2D-A586-C12DC764E3C6}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe
      "C:\Windows\Temp\{CFFF00AA-D86B-4C2D-A586-C12DC764E3C6}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe" -q -burn.elevated BurnPipe.{0E3D3F64-EB47-4B68-A447-4B0D438C4416} {EA54DD34-5183-46A9-9C5D-DD37CB741D2E} 1492
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3848
- C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe
  "vc_redist.x64.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\Temp\{AFACDBE8-F97C-414C-8EEB-8C1CB612B3F3}\.cr\vc_redist.x64.exe
    "C:\Windows\Temp\{AFACDBE8-F97C-414C-8EEB-8C1CB612B3F3}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=660 /install /quiet /norestart
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Windows\Temp\{CB365858-2725-461C-81FE-C43081F215DC}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{CB365858-2725-461C-81FE-C43081F215DC}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0222944F-7D15-441D-9F51-91BE6ED09B92} {A0F69630-D71A-46C4-8D79-E882F34266CE} 4184
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1028 -burn.embedded BurnPipe.{BBCC7B13-0327-4F35-BD0C-B10F5BC0CCF1} {787C152F-7863-4E0D-A389-8C16681F70F3} 5024
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2280
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1028 -burn.embedded BurnPipe.{BBCC7B13-0327-4F35-BD0C-B10F5BC0CCF1} {787C152F-7863-4E0D-A389-8C16681F70F3} 5024
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A4F68268-04AB-4CD0-968E-8186662EDA0D} {D92EE1B5-6BBA-47C4-AB56-C9275AD06965} 2780
        7⤵
        Modifies registry class
        
        PID:5068
- C:\Users\Admin\AppData\Local\Temp\dotnet-sdk-6.0.405-win-x64.exe
  "dotnet-sdk-6.0.405-win-x64.exe" /install /quiet
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\Temp\{1F4E29B4-6988-4528-AA07-492D2BE0F23D}\.cr\dotnet-sdk-6.0.405-win-x64.exe
    "C:\Windows\Temp\{1F4E29B4-6988-4528-AA07-492D2BE0F23D}\.cr\dotnet-sdk-6.0.405-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\dotnet-sdk-6.0.405-win-x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=552 /install /quiet
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\Temp\{90D2884A-AF0C-491F-8E29-1E2AB58D40FC}\.be\dotnet-sdk-6.0.413-win-x86.exe
      "C:\Windows\Temp\{90D2884A-AF0C-491F-8E29-1E2AB58D40FC}\.be\dotnet-sdk-6.0.413-win-x86.exe" -q -burn.elevated BurnPipe.{21205C1D-D55B-45F5-8EC7-0FDDA8CD5D88} {464296FE-5372-416A-B664-25DA7EB930E7} 2148
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      PID:4244

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D44ADF6C3D06DD5324CADB026A58CF16
  2⤵
  - Loads dropped DLL
  PID:5040
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D8E5CD43CC1C202CBEF39390C67484C7
  2⤵
  - Loads dropped DLL
  PID:1100
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E8F3F058650BCCD8AFEFA64C59F4EAE1
  2⤵
  - Loads dropped DLL
  PID:4832
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 243659957066D0F21DDEDF020019A7A1
  2⤵
  - Loads dropped DLL
  PID:1548
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E007EE59B8402F7FC1EDC3632250470E
  2⤵
  - Loads dropped DLL
  PID:2280
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 064285A719D354241B5502EA73DAA2E1
  2⤵
  - Loads dropped DLL
  PID:5088
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E33FD42F2D2045188CA875A384341405
  2⤵
  - Loads dropped DLL
  PID:2652

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4800

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e586196.rbs

Filesize
56KB

MD5
508c2d7d4fdb2fab22139c2e775db376

SHA1
ad24f8031ddf216d0c1c390e7aafcf402eebdac9

SHA256
dc73ddbd87907e02bfaaf535a2ec5d52797a5bb25b17657ae309715afaecbc16

SHA512
07e69701af4c19d969134ef83085a17d96c3154155ecd8a001068ce2058166146d1358345ad988ba284dd8be5634bc14dfbc5131e8f032c09943df5dc0603366

Download Submit
C:\Config.Msi\e58619b.rbs

Filesize
8KB

MD5
1d6657a7e85fbf6efeb56777caddeff4

SHA1
a3c30c98099d361b25da37bf7cf63b11582d86d1

SHA256
3deb189d5ad0c073e2a4a79b99e2cc00bc7b8301f4f08683313c755276ad0384

SHA512
6f44636abe74bdb8e6b7914519ee600fba8a15c8d5cc94670c8681d459b5cdf8e0274c8e1224fdedbc4fc23ee07d2ec391df622d13eac66ebb44abe41a5a96b1

Download Submit
C:\Config.Msi\e5861a0.rbs

Filesize
10KB

MD5
15057cb32d6cdf0469fa26a7e07a369a

SHA1
09514a04d42ed86cd9931fd19a1725aaf3d16782

SHA256
518da2db1c1c62d0035efcdc5b9ddff9651045349e30a998f0e1c2460b5ca1b9

SHA512
a2442f5dd8d3823b10e969a1a17bfed36ebb0be7ae20b49f3681eb4ab45b5fa5816cc5314c77b41f0cb35b0bfa8c53e118a5db26b8dfa7d1daebb6928f372168

Download Submit
C:\Config.Msi\e5861a5.rbs

Filesize
87KB

MD5
09916aef69c51b462c4249ece4c7cf85

SHA1
b79ff70a4cb4be71b57b15615d9ca3b50fa9bd36

SHA256
0f4e553673d173fa6f17c7947a8eccb7c08c7698cdf47f828d22774a7e2b8dd1

SHA512
620194749b608065632926f9f2f6f7ea5feffbc62184f631641e4443deecf8400163a72c1187764e7baa4933e0b18707d43668ddfb3ece0eb21c26fd66cf5ce3

Download Submit
C:\Config.Msi\e5861ac.rbs

Filesize
19KB

MD5
2c0a2ac68953108eb770c73165686cc2

SHA1
02d26aed79b9712fdfe61b12fd65225c9b1923f5

SHA256
71b25f1d15ff46cbeebcd72060c1bcc6bc135208bb5f53dbf8dce6ef3d1d2bf6

SHA512
6dee2639899caab8c9cc06984fd834c107ff3d333faba19f75df89fa6c0d39242058dcde3a31ec86a4dd7837ccc8278431f5efebc5436dce24beda887f06392a

Download Submit
C:\Config.Msi\e5861b8.rbs

Filesize
19KB

MD5
5d0e258d1ff1a70054e64f5d33941b85

SHA1
2a9111f8b94b9f4b72cfb0b56717284a8b31241a

SHA256
1d801ece3270bffbe1b88ef999fa8fd811904cd484f4db76c48f148eb87933bc

SHA512
6c12f11c34c11a04cafb58df4923dc082d91a2ec8c1bf2002024099d468e49684117a314e2c0f8366f4107b089e69e09c8a3426d82de04ad6fa0f4599ab2001b

Download Submit
C:\Config.Msi\e5861bf.rbs

Filesize
21KB

MD5
3e5aa369fbd92fafbbecdf6acdad9af0

SHA1
c1492d8bdcd8a461fd1f43c08ad67c54a36fe00a

SHA256
b18f3ee7e12e9097d0e12b8815af98f9b044ad8757f5ba8dd4da0f94ed51289a

SHA512
4cd71443204f670d08231b1650743fc1790809a857dbb45b22359cb5ed8ffb9a170b84aa486f4c407e6f717c6654ca0da8782e438ab04a26686b247b77afc0eb

Download Submit
C:\Config.Msi\e5861ce.rbs

Filesize
21KB

MD5
986010b50b368ed812c31ffa570c14ed

SHA1
a2e38f1318ad67711710df33c09dad29124d7ff3

SHA256
75d0ec838e4f36a455e27c22dc59d98df318c43d8602ad35aace2cb449742d30

SHA512
b1828edba5c7f433db0eaf8b756bac90e8ac630a6d7acb0e652abf64aaec7ece4b899617e1ba462e4e35131c430be3bbb7e44bfaef797344305bbc6374a07480

Download Submit
C:\Config.Msi\e5861d3.rbs

Filesize
57KB

MD5
bdebc753ad7b60567e792a95985af37b

SHA1
7edc3e45725450ca09cd4a3b695f5aece7b75226

SHA256
954d469f476cf465562580c651c601c50fe63dfdd52dd313732b28723ea0b9cb

SHA512
71d2e964ab2815abd83ec4da462508b2786443595bd07e220768f07b7ecd978275681c4c6a1e077e7adf9710e178f8fcb064224d86e0ca5ef9cdd7c5f7a705d8

Download Submit
C:\Config.Msi\e5861d8.rbs

Filesize
8KB

MD5
78fbe717c49a5f1ac4e5afc44d68e582

SHA1
557c7ff3d9eeebac4952f5701459673a2f46b839

SHA256
7cc3953eac80dfffdf90184288f947a76a7b8f5f7959281361afdcbadac609a0

SHA512
26944a733b304ad2ce85a9eb1013ffd1240688f9fb709f74fce169c290850ea9614502b9613157ebe7e900d93a7fb270ffb5f1ed317b206510a94539462ffc89

Download Submit
C:\Config.Msi\e5861dd.rbs

Filesize
9KB

MD5
88f02a5ae5341a6a6b871f015d165ae3

SHA1
8e158cea9e15d8b4b29d6b8b85eb0868b4d96107

SHA256
23e0c509a9865a80d1234bbeee93f083726384bc56f11499cc584579c82f50a2

SHA512
af17753cfdaf26520ae7355facbcb3ba7ce0ccc891a3cbbfd05aeb117930b4992670edd7bf046cc9dc271a8d8ec319dd47609243c329587fad38f0a8ee0e2657

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\ProgramData\Package Cache\{0f39db03-9030-48f3-82ef-5384bed81d85}\state.rsm

Filesize
960B

MD5
1794a09d2661c87d884c5c30e86e9557

SHA1
4e37d06b293b209bde8ba007d8705493dca08eb0

SHA256
7179fc65fbd810e2c75868a66938035183a71b719b3378dda10ab6078aedaf2e

SHA512
2ee6823e7053071a8d6639ad215499473853f2166f563dfedaa6000af28bd9a99e99a711c5c9f6a5e25a4279cb4e68d7dd2ce35c243b3922fad56008173d6140

Download Submit
C:\ProgramData\Package Cache\{0f39db03-9030-48f3-82ef-5384bed81d85}\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\state.rsm

Filesize
912B

MD5
604c0f9b5086db2352a86501ae6bdab2

SHA1
dcca0cb59a535bc19c5d0ef42e9eb0b3f6c710a8

SHA256
87ac62bf0f70117eee38e8fa5bb95ab571c765ffa7c00b85ed0cc32104e6d7f0

SHA512
5c14c27acd493a7617a3325c9a189b410074ef3e208c9a05c869982be6e93c2237a68c1d64fb0f7c40a864a388f1a6a51d3db3f4a68bf2fbcc299447a4b1e6e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\uWcU5_6FXSwQ4UMNThCcNYZC4UGolsg=\D3DCompiler_47_cor3.dll

Filesize
4.7MB

MD5
2191e768cc2e19009dad20dc999135a3

SHA1
f49a46ba0e954e657aaed1c9019a53d194272b6a

SHA256
7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

SHA512
5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\uWcU5_6FXSwQ4UMNThCcNYZC4UGolsg=\PresentationNative_cor3.dll

Filesize
1.2MB

MD5
c7bcc68b81e965fe74ef58d503c58deb

SHA1
99990f204f7318eeb8de6f9664ebcd0d42ea81b7

SHA256
06cb4da78f5cfddece86329241a2af9d6390ce1082b02f7db2e3bf320215a23e

SHA512
cab2bc27eca0ee097324a2471c8228f1723cfef5df9971359eec7710082c122b26a7aa1d1e6faab75389438a358bbff2973ad67e8dd9046455b4c4ac880d858c

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\uWcU5_6FXSwQ4UMNThCcNYZC4UGolsg=\wpfgfx_cor3.dll

Filesize
1.9MB

MD5
1b01746fe61beb761a643050823190b0

SHA1
927b12e4a733bcc51545c6a005838a24b8dc4dda

SHA256
f8c4d6eb1cfa9c5b6fb322a0c818a4f5d5ee44043c259e0262c0460513953fb8

SHA512
83eeb187e554588a5a4efbce0fcb7e9c30e718ec9f6d797a7add28036e3d4506cd3e78386522467d7ac967a60ac509a23edd79a1b9032a7e230d980b9f36080a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20231106172331_000_dotnet_runtime_6.0.21_win_x64.msi.log

Filesize
3KB

MD5
76b9d144315f53c747c0149d3e201bfb

SHA1
aade91f7ffa3f92d224602939c92f97561443c75

SHA256
e11f1fc82d6e74befdb3e9af069deb0430fba30e8a94ec39818f725a07b26ca3

SHA512
181785980dc04af797bc1b4ba798c7ca673557dc3269a78c228c9253e925c3b74efa79786453e2dab39c79d342fab9c02e13098caf2a76e4983182b4e3a45efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20231106172331_001_dotnet_hostfxr_6.0.21_win_x64.msi.log

Filesize
3KB

MD5
ad1be6d34addd58586d7f2a3581b6970

SHA1
c4e91a4d8fa6edf4c40d8ce4582e1e801d8138c6

SHA256
c2a1d61c9e49c299e7a4908784821cdab4729c7a509344f3320dc8ffe453f68d

SHA512
0ca4dfbb3e109e33a4e611edd2b6c10eb1527429435c45ffd9a8d381616f723691edb37232f798e97f956f14a6db7cd0223a3953de430516775aede6721a7f68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20231106172331_002_dotnet_host_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
cc234cb7177302d9ce3632076edf33d6

SHA1
7c3eb34c56331e1f26be98b784ccfbf3c7c8561c

SHA256
49cc38d8d76dfe7503a0fc45cdfa07316c66ae404ec354843c6594f092fde72b

SHA512
d396e4522586512ecc026851c3ca31fac0d9674392159cae3266a6d9e03c13d414263d3cbf1bb9d7c751f25330141f58f6244be971ecbf3f374ca6e5f739f547

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20231106172331_003_windowsdesktop_runtime_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
20e876be1ceb364cf5f0dd777bd61417

SHA1
c798ae46310835dcd189b71323fde15b3a38bdb4

SHA256
cff6befe41692bb245f5797d6a422f940941197af1124f153f888c8c1ee1fdad

SHA512
67fe0ec5db6fc472589dda47b142552792530c7d8334052f3e307c139f9a9303374cf84b8b1075e8fd2ce1770ab3185b43c6b7d1abc9e5eb12f4530c815e4164

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20231106172403_000_vcRuntimeMinimum_x64.log

Filesize
31KB

MD5
f5d170caa84c6d3cf2277a08d672d73e

SHA1
27ea4c2e819c7beac669e875e52994b416fbd254

SHA256
1bfe1184c7057141862afd9b0d99ca9d4612eb911e0cc4e818351a75432961da

SHA512
90987d5226db0674e7a8d986d06b41b57822ea3ed5646d1499913aa624bf166ebf9c47dff78218a6b858543c7dad2959759138591e789225b98679319635120e

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20231106172403_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
3f2e1af32ccaf2017d2248ea7b210fe3

SHA1
2b3940b73a9fed81f690f82c123748eee262fb55

SHA256
8c327a124fa2b25ca4c1679a73b2687a51f46b6a39088a61770c45977b07dde9

SHA512
115bdf3902c13fe43ce15ac67ac1e5eb83a664f085412dc9e22d11a2d4cf5eaadbc3528300643206eeac22ba14b9726186d2deb1e25b6c06e522d54e729d9348

Download Submit
C:\Users\Admin\AppData\Local\Temp\dotnet-sdk-6.0.405-win-x64.exe

Filesize
185.2MB

MD5
8e003e67ae8154be6e4efbc2f788a631

SHA1
99cf7157aba3a64ae9a5a17eb8df81453bf9fed8

SHA256
ee634896a21a1a49b811efec9da39b95a564e764b87143ce424000c0ec6cfa04

SHA512
e767cfa0664630dd325ddf045bbee5e562c8e966a588a711f0dfba0e6458430ac3f2062c400dabc9d1e94fe7a2a592340593f6fabbe75e951fd6a31cbfe10727

Download Submit
C:\Users\Admin\AppData\Local\Temp\dotnet-sdk-6.0.405-win-x64.exe

Filesize
185.2MB

MD5
8e003e67ae8154be6e4efbc2f788a631

SHA1
99cf7157aba3a64ae9a5a17eb8df81453bf9fed8

SHA256
ee634896a21a1a49b811efec9da39b95a564e764b87143ce424000c0ec6cfa04

SHA512
e767cfa0664630dd325ddf045bbee5e562c8e966a588a711f0dfba0e6458430ac3f2062c400dabc9d1e94fe7a2a592340593f6fabbe75e951fd6a31cbfe10727

Download Submit
C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe

Filesize
24.2MB

MD5
077f0abdc2a3881d5c6c774af821f787

SHA1
c483f66c48ba83e99c764d957729789317b09c6b

SHA256
917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888

SHA512
70a888d5891efd2a48d33c22f35e9178bd113032162dc5a170e7c56f2d592e3c59a08904b9f1b54450c80f8863bda746e431b396e4c1624b91ff15dd701bd939

Download Submit
C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe

Filesize
24.2MB

MD5
077f0abdc2a3881d5c6c774af821f787

SHA1
c483f66c48ba83e99c764d957729789317b09c6b

SHA256
917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888

SHA512
70a888d5891efd2a48d33c22f35e9178bd113032162dc5a170e7c56f2d592e3c59a08904b9f1b54450c80f8863bda746e431b396e4c1624b91ff15dd701bd939

Download Submit
C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
54.7MB

MD5
1a6d60add2d112dd73e83fb46dca474d

SHA1
8b374a54f508cfdb8c8176bfaef96f37edf7170b

SHA256
aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545

SHA512
49192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
54.7MB

MD5
1a6d60add2d112dd73e83fb46dca474d

SHA1
8b374a54f508cfdb8c8176bfaef96f37edf7170b

SHA256
aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545

SHA512
49192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79

Download Submit
C:\Windows\Installer\MSI6F7E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI6F7E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI7F01.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI7F01.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8328.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8328.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8328.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI88A8.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI88A8.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8D3D.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8D3D.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI92CD.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI92CD.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI97C0.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI97C0.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIAD7C.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIAD7C.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\e586197.msi

Filesize
25.7MB

MD5
0fda2bb0ba0c1dd265e9540265a035b7

SHA1
03461f9f268e5ec0a997990c05b16086a03505dc

SHA256
bb994af42653ab3738ea3b689f6870c2549f6f170f23a1a8a161c7e02ccec9b1

SHA512
acdcb21c4ac6587b7a7cc43078a075f2f06d71823ace65e175611e0ef8af2bc7c753b7618447ba6d9f24cbea63cf582bcd5f71ca3b7a79066ca6cd61c43ed7d6

Download Submit
C:\Windows\Installer\e586198.msi

Filesize
804KB

MD5
5dce0ef6b5d0bd2b850106a22b5e0264

SHA1
263cfbd815de6b877d084ab4b3d2f878d71c9b1f

SHA256
c98010f7c473bdb2a182e61aae35a20c044006fee26ffb378346cbdf255d2736

SHA512
fc7297d142cf8d0247ac86732182a031e819a4fc41b034d1b9a7dba5cdb56d73e158dd57132b6a083b3f6184859b4dca4a1a21205f6d11b2be6ca3913e89891b

Download Submit
C:\Windows\Installer\e5861a6.msi

Filesize
28.5MB

MD5
6ec2d8f7944d0766603fa3b043fe2410

SHA1
000a79c4792abbfdf65ca3b5367b7a3b02146732

SHA256
619074e13358e2c259086bf306083229ae8d3472187bc755951413858949cb68

SHA512
4f86befae9a437985e4ae491f416b0c06a72344ffccfb00c325e91d48244b46edee784003c0a519bc39fdb14409d949c7fe7cde7f51b3479d504c61d88f6371b

Download Submit
C:\Windows\Installer\e5861b9.msi

Filesize
188KB

MD5
a4075b745d8e506c48581c4a99ec78aa

SHA1
389e8b1dbeebdff749834b63ae06644c30feac84

SHA256
ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93

SHA512
0b980f397972bfc55e30c06e6e98e07b474e963832b76cdb48717e6772d0348f99c79d91ea0b4944fe0181ad5d6701d9527e2ee62c14123f1f232c1da977cada

Download Submit
C:\Windows\Installer\e5861d4.msi

Filesize
23.3MB

MD5
e79bada7cb5640f0c5c486a63fcfb75d

SHA1
b8c1fdadebd64a237ba63676e45c4702f998278b

SHA256
7d585a27e8fe15388570ea170765651189bad6ad7d2d84b6c252bf950784e516

SHA512
950f938fee3ae3328ad69ebc39e515fd0473753b1266a0f5a4c2354235526a6865661648990f90f844a4e493cef8c4b42495626e7ea8912442579ccfd3c7af36

Download Submit
C:\Windows\Temp\{1F4E29B4-6988-4528-AA07-492D2BE0F23D}\.cr\dotnet-sdk-6.0.405-win-x64.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{1F4E29B4-6988-4528-AA07-492D2BE0F23D}\.cr\dotnet-sdk-6.0.405-win-x64.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{44FAC120-6839-4A7D-88C3-5B7172AA6327}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{44FAC120-6839-4A7D-88C3-5B7172AA6327}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{90D2884A-AF0C-491F-8E29-1E2AB58D40FC}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{90D2884A-AF0C-491F-8E29-1E2AB58D40FC}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{90D2884A-AF0C-491F-8E29-1E2AB58D40FC}\.be\dotnet-sdk-6.0.413-win-x86.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{90D2884A-AF0C-491F-8E29-1E2AB58D40FC}\.be\dotnet-sdk-6.0.413-win-x86.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{90D2884A-AF0C-491F-8E29-1E2AB58D40FC}\.be\dotnet-sdk-6.0.413-win-x86.exe

Filesize
610KB

MD5
c829733fccac1d023514b6a56647d461

SHA1
eae92bb4711c6d9e1e19ebe79b3afc2de7dfabec

SHA256
fec2580479532e2a36b75e9e4d14835be00e1fb65f43166ee4b4660aae13f2bc

SHA512
dd7f1299ba1db1c3ada0110dc75e91d5b68731fae7261b6c06f330354653e1ca1e8dde2150d34843b76c4066d2328fbac18f0b9ba989446c29c86ac38f507706

Download Submit
C:\Windows\Temp\{90D2884A-AF0C-491F-8E29-1E2AB58D40FC}\AspNetCoreSharedFramework_x86

Filesize
7.5MB

MD5
759608b8db045afb303c4f66dca422b0

SHA1
f0536b100dfaec1e7de7c8c35ca7c7ad5ae6e779

SHA256
2035e3187d8b8369167ebf3e96c84f68639875eeaae7fd743379d0f4fc2eb30b

SHA512
25d6b772650a87bf428c7e1517f09876c2da789d53c4259d9a064d9f682e739226f37cc7d420653573f5fd898b0a0b6b23abef94406497bbd55852cbf7298447

Download Submit
C:\Windows\Temp\{90D2884A-AF0C-491F-8E29-1E2AB58D40FC}\Finalizer

Filesize
130KB

MD5
1ec0ef0eb7860f069bda682b0e74df8d

SHA1
12ffab75565303e970e27218efeeb364b3ecdd18

SHA256
2f6948e63b4c8e4493b32dedcaad3d871bd86940e160435bb794fb9be12e2001

SHA512
9964a24217aaf610f1bcd85ef246d9f361313090e1acddc5eaee7b2e241fc441b2ddcdb305e3cbc5591a0c6566856291ff549aab1e09c8b7acf45482df1cb71b

Download Submit
C:\Windows\Temp\{90D2884A-AF0C-491F-8E29-1E2AB58D40FC}\dotnet_host_6.0.21_win_x86.msi

Filesize
728KB

MD5
06a94b7b03fd6ddc6942959b0360551a

SHA1
6ec5e317599efa731ebd86a1fdca187391cd5f59

SHA256
837eb5ef21b543600c4dcd1905d7072e5ec88dd4ea7c177a9755df602f7aad97

SHA512
6c276e21070995f57ad2f31eeb4cdddd42e28dd1cd37405aa773883b567621c97077ef669f34dd357d15ffb3930c67b1a5950cc39ee7f78927002f3c8b2fbac8

Download Submit
C:\Windows\Temp\{90D2884A-AF0C-491F-8E29-1E2AB58D40FC}\dotnet_hostfxr_6.0.21_win_x86.msi

Filesize
784KB

MD5
1da4c6997d53b4e057eacba87395c44c

SHA1
e62f066789d3494799b3b0edd6885e8b92e59f53

SHA256
13cda8492bbcbf19f0d09582e259eab6f7b934f74b1bfb50c4250a4e27d80fde

SHA512
e2c39964a116cb14833c83a3efe09d890c8c0cac963c007a477aaf8c181230ebcfc54412953816588ac932656982ebd667739fefc135869d848ebab0f789c83f

Download Submit
C:\Windows\Temp\{90D2884A-AF0C-491F-8E29-1E2AB58D40FC}\dotnet_runtime_6.0.21_win_x86.msi

Filesize
23.3MB

MD5
e79bada7cb5640f0c5c486a63fcfb75d

SHA1
b8c1fdadebd64a237ba63676e45c4702f998278b

SHA256
7d585a27e8fe15388570ea170765651189bad6ad7d2d84b6c252bf950784e516

SHA512
950f938fee3ae3328ad69ebc39e515fd0473753b1266a0f5a4c2354235526a6865661648990f90f844a4e493cef8c4b42495626e7ea8912442579ccfd3c7af36

Download Submit
C:\Windows\Temp\{90D2884A-AF0C-491F-8E29-1E2AB58D40FC}\dotnet_targeting_pack_6.0.21_win_x86.msi

Filesize
3.4MB

MD5
c9e8294ca0f5be8af4f9a01a75c00ad6

SHA1
52a4cd485e357ae3f11d42a98f89d5a100ade07c

SHA256
dfbed44a3da64c26738eb37f66160e06c6c0d42fb0927defdb1160ee4bc3b89f

SHA512
fd1ef66c737da5c4549ea85efff22a5bfb8c3d9d2134b97145a0a63f40de270908052e492e353f6a1dcee1e2a72e3430f3f47a3e57e78bd625c3e2a52579ee51

Download Submit
C:\Windows\Temp\{9FAAD581-E831-477F-B9EF-9AF78D47B530}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{9FAAD581-E831-477F-B9EF-9AF78D47B530}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{AFACDBE8-F97C-414C-8EEB-8C1CB612B3F3}\.cr\vc_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{AFACDBE8-F97C-414C-8EEB-8C1CB612B3F3}\.cr\vc_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{CB365858-2725-461C-81FE-C43081F215DC}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{CB365858-2725-461C-81FE-C43081F215DC}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{CB365858-2725-461C-81FE-C43081F215DC}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{CB365858-2725-461C-81FE-C43081F215DC}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{CB365858-2725-461C-81FE-C43081F215DC}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{CB365858-2725-461C-81FE-C43081F215DC}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
46efc5476e6d948067b9ba2e822fd300

SHA1
d17c2bf232f308e53544b2a773e646d4b35e3171

SHA256
2de285c0fc328d30501cad8aa66a0ca9556ad5e30d03b198ebdbc422347db138

SHA512
58c9b43b0f93da00166f53fda324fcf78fb1696411e3c453b66e72143e774f68d377a0368b586fb3f3133db7775eb9ab7e109f89bb3c5e21ddd0b13eaa7bd64c

Download Submit
C:\Windows\Temp\{CB365858-2725-461C-81FE-C43081F215DC}\cab5046A8AB272BF37297BB7928664C9503

Filesize
935KB

MD5
c2df6cb9082ac285f6acfe56e3a4430a

SHA1
591e03bf436d448296798a4d80f6a39a00502595

SHA256
b8b4732a600b741e824ab749321e029a07390aa730ec59401964b38105d5fa11

SHA512
9f21b621fc871dd72de0c518174d1cbe41c8c93527269c3765b65edee870a8945ecc2700d49f5da8f6fab0aa3e4c2db422b505ffcbcb2c5a1ddf4b9cec0e8e13

Download Submit
C:\Windows\Temp\{CB365858-2725-461C-81FE-C43081F215DC}\vcRuntimeAdditional_x64

Filesize
188KB

MD5
dd070483eda0af71a2e52b65867d7f5d

SHA1
2b182fc81d19ae8808e5b37d8e19c4dafeec8106

SHA256
1c450cacdbf38527c27eb2107a674cd9da30aaf93a36be3c5729293f6f586e07

SHA512
69e16ee172d923173e874b12037629201017698997e8ae7a6696aab1ad3222ae2359f90dea73a7487ca9ff6b7c01dc6c4c98b0153b6f1ada8b59d2cec029ec1a

Download Submit
C:\Windows\Temp\{CB365858-2725-461C-81FE-C43081F215DC}\vcRuntimeMinimum_x64

Filesize
188KB

MD5
a4075b745d8e506c48581c4a99ec78aa

SHA1
389e8b1dbeebdff749834b63ae06644c30feac84

SHA256
ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93

SHA512
0b980f397972bfc55e30c06e6e98e07b474e963832b76cdb48717e6772d0348f99c79d91ea0b4944fe0181ad5d6701d9527e2ee62c14123f1f232c1da977cada

Download Submit
C:\Windows\Temp\{CFFF00AA-D86B-4C2D-A586-C12DC764E3C6}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{CFFF00AA-D86B-4C2D-A586-C12DC764E3C6}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{CFFF00AA-D86B-4C2D-A586-C12DC764E3C6}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{CFFF00AA-D86B-4C2D-A586-C12DC764E3C6}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{CFFF00AA-D86B-4C2D-A586-C12DC764E3C6}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
C:\Windows\Temp\{CFFF00AA-D86B-4C2D-A586-C12DC764E3C6}\dotnet_host_6.0.21_win_x64.msi

Filesize
736KB

MD5
12b8c5914e56f4bd933c8490f7f6cd45

SHA1
2ec135cdd97adbcfe7decb04f1a5e95b6f0614e3

SHA256
3b83682de5bfeabde75ffc34330f470df11ce5e62c2509c50b3e48e35130fa51

SHA512
ecc9ddd52d097ca6f643f7ce78399b01d37e776e30abb8b82b6278711716e6893528340b6719f8287848931759ae41427c252cb00df97742583dbe5d7ea4277a

Download Submit
C:\Windows\Temp\{CFFF00AA-D86B-4C2D-A586-C12DC764E3C6}\dotnet_hostfxr_6.0.21_win_x64.msi

Filesize
804KB

MD5
5dce0ef6b5d0bd2b850106a22b5e0264

SHA1
263cfbd815de6b877d084ab4b3d2f878d71c9b1f

SHA256
c98010f7c473bdb2a182e61aae35a20c044006fee26ffb378346cbdf255d2736

SHA512
fc7297d142cf8d0247ac86732182a031e819a4fc41b034d1b9a7dba5cdb56d73e158dd57132b6a083b3f6184859b4dca4a1a21205f6d11b2be6ca3913e89891b

Download Submit
C:\Windows\Temp\{CFFF00AA-D86B-4C2D-A586-C12DC764E3C6}\dotnet_runtime_6.0.21_win_x64.msi

Filesize
25.7MB

MD5
0fda2bb0ba0c1dd265e9540265a035b7

SHA1
03461f9f268e5ec0a997990c05b16086a03505dc

SHA256
bb994af42653ab3738ea3b689f6870c2549f6f170f23a1a8a161c7e02ccec9b1

SHA512
acdcb21c4ac6587b7a7cc43078a075f2f06d71823ace65e175611e0ef8af2bc7c753b7618447ba6d9f24cbea63cf582bcd5f71ca3b7a79066ca6cd61c43ed7d6

Download Submit
C:\Windows\Temp\{CFFF00AA-D86B-4C2D-A586-C12DC764E3C6}\windowsdesktop_runtime_6.0.21_win_x64.msi

Filesize
28.5MB

MD5
6ec2d8f7944d0766603fa3b043fe2410

SHA1
000a79c4792abbfdf65ca3b5367b7a3b02146732

SHA256
619074e13358e2c259086bf306083229ae8d3472187bc755951413858949cb68

SHA512
4f86befae9a437985e4ae491f416b0c06a72344ffccfb00c325e91d48244b46edee784003c0a519bc39fdb14409d949c7fe7cde7f51b3479d504c61d88f6371b

Download Submit
memory/2348-69-0x00000220B2540000-0x00000220B256A000-memory.dmp

Filesize
168KB

Download
memory/2348-27-0x0000022091A30000-0x0000022091AAF000-memory.dmp

Filesize
508KB

Download
memory/2348-30-0x0000022090100000-0x000002209010D000-memory.dmp

Filesize
52KB

Download
memory/2348-24-0x00000220B3E90000-0x00000220B46D2000-memory.dmp

Filesize
8.3MB

Download
memory/2348-21-0x00000220B1FC0000-0x00000220B1FFE000-memory.dmp

Filesize
248KB

Download
memory/2348-18-0x00000220B1F70000-0x00000220B1FB4000-memory.dmp

Filesize
272KB

Download
memory/2348-33-0x00000220B2000000-0x00000220B2005000-memory.dmp

Filesize
20KB

Download
memory/2348-36-0x00000220B2050000-0x00000220B2063000-memory.dmp

Filesize
76KB

Download
memory/2348-39-0x00000220B2040000-0x00000220B2047000-memory.dmp

Filesize
28KB

Download
memory/2348-42-0x00000220B20A0000-0x00000220B20B9000-memory.dmp

Filesize
100KB

Download
memory/2348-45-0x00000220B20C0000-0x00000220B20D6000-memory.dmp

Filesize
88KB

Download
memory/2348-48-0x00000220B2130000-0x00000220B2170000-memory.dmp

Filesize
256KB

Download
memory/2348-51-0x00000220B20E0000-0x00000220B20F8000-memory.dmp

Filesize
96KB

Download
memory/2348-15-0x00000220B23E0000-0x00000220B253E000-memory.dmp

Filesize
1.4MB

Download
memory/2348-54-0x00000220B2100000-0x00000220B2112000-memory.dmp

Filesize
72KB

Download
memory/2348-60-0x00000220B2640000-0x00000220B2734000-memory.dmp

Filesize
976KB

Download
memory/2348-63-0x00000220B2120000-0x00000220B2128000-memory.dmp

Filesize
32KB

Download
memory/2348-66-0x00000220B25A0000-0x00000220B25E7000-memory.dmp

Filesize
284KB

Download
memory/2348-72-0x00000220B6910000-0x00000220B712C000-memory.dmp

Filesize
8.1MB

Download
memory/2348-5-0x0000000180000000-0x0000000180A25000-memory.dmp

Filesize
10.1MB

Download
memory/2348-183-0x00007FF6E7070000-0x00007FF6E799D000-memory.dmp

Filesize
9.2MB

Download
memory/2348-12-0x00000220B21B0000-0x00000220B23D8000-memory.dmp

Filesize
2.2MB

Download
memory/2348-8-0x00000220B2F00000-0x00000220B3E88000-memory.dmp

Filesize
15.5MB

Download
memory/2348-9-0x00007FF6E7070000-0x00007FF6E799D000-memory.dmp

Filesize
9.2MB

Download