126da8120849613fd9c88b37256486b37fd100158846bc05e651dd053634ecfe

Analysis

max time kernel
171s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231222-es
resource tags

arch:x64arch:x86image:win10v2004-20231222-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28-01-2024 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

windowsdesktop-runtime-7.0.0-win-x64.exe
Size

55.1MB
MD5

8b02b04923c939303fce12a432e3aaa4
SHA1

db56882d3263c9e533ea7003d018cb7d65f11c10
SHA256

126da8120849613fd9c88b37256486b37fd100158846bc05e651dd053634ecfe
SHA512

e6281f475a58c8dc7b103d0cfd895e0f27235e25731b473514c82b77d8e555ea294f66ab3e119c5fd38c5a8f18b4a4d8508938d7cff70ab2186b47417349ea1e
SSDEEP

1572864:76lpywV27GnD1F2Yy4n9kWBrmRsnTUsQUyR0j0g/E:Wz273YNCWBGsAsTyR0gf

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-7.0.0-win-x64.exe

Executes dropped EXE 3 IoCs

pid	Process
1148	windowsdesktop-runtime-7.0.0-win-x64.exe
3816	windowsdesktop-runtime-7.0.0-win-x64.exe
4036	Galaxy Swapper v2.exe

Loads dropped DLL 63 IoCs

pid	Process
1148	windowsdesktop-runtime-7.0.0-win-x64.exe
2092	MsiExec.exe
2092	MsiExec.exe
1576	MsiExec.exe
1576	MsiExec.exe
5044	MsiExec.exe
5044	MsiExec.exe
2688	MsiExec.exe
2688	MsiExec.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4036	Galaxy Swapper v2.exe
4404	Process not Found
4404	Process not Found
4404	Process not Found
4404	Process not Found
4404	Process not Found
4404	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{01b47e23-4226-4094-9c19-400f12efee57} = "\"C:\\ProgramData\\Package Cache\\{01b47e23-4226-4094-9c19-400f12efee57}\\windowsdesktop-runtime-7.0.0-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-7.0.0-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\cs\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Threading.Tasks.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Security.Cryptography.Encoding.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Reflection.DispatchProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Threading.Overlapped.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\ko\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\ja\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\fr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\clrjit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\.version	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\pt-BR\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\PenImc_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Private.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Dynamic.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\es\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\pl\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\PresentationFramework.Royale.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\hostpolicy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\cs\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\tr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Resources.Writer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\fr\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\pl\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\System.Windows.Presentation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\ru\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\de\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Xml.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\fr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\de\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\ja\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\PresentationNative_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\zh-Hant\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\ko\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\wpfgfx_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\it\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\it\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\ru\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\PresentationFramework.AeroLite.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.ComponentModel.DataAnnotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\pt-BR\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\System.Windows.Input.Manipulations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\zh-Hans\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\cs\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Configuration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\ru\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\Microsoft.Win32.Registry.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\coreclr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\ja\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\it\WindowsBase.resources.dll	msiexec.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e577b30.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8291.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI841A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\DF8346EBECD8FC64698728A560D4AAAA\56.3.50341\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\e577b3b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI873B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D7E.tmp	msiexec.exe
File created	C:\Windows\Installer\e577b2f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DE3.tmp	msiexec.exe
File created	C:\Windows\Installer\e577b35.msi	msiexec.exe
File created	C:\Windows\Installer\e577b3f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8489.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\DF8346EBECD8FC64698728A560D4AAAA	msiexec.exe
File opened for modification	C:\Windows\Installer\e577b2b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI830F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e577b30.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\DF8346EBECD8FC64698728A560D4AAAA\56.3.50341	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\DF8346EBECD8FC64698728A560D4AAAA\56.3.50341\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A17DDA5A-F944-4E22-B578-FB860C604D21}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI81E4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI837D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e577b35.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8507.tmp	msiexec.exe
File created	C:\Windows\Installer\e577b2b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e577b3a.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F8BC94FF-FF0C-4226-AE0A-811960F93DF7}	msiexec.exe
File created	C:\Windows\Installer\e577b34.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BE6438FD-8DCE-46CF-9678-825A064DAAAA}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{192E20E1-D873-40DC-9D0B-0E46E651C583}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C54.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e577b3b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI85F2.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A5ADD71A449F22E45B87BF68C006D412\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF8346EBECD8FC64698728A560D4AAAA\ProductName = "Microsoft .NET Host - 7.0.0 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.3.50341_x64\Dependents	windowsdesktop-runtime-7.0.0-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\Version = "56.3.50341"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DF8346EBECD8FC64698728A560D4AAAA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DF8346EBECD8FC64698728A560D4AAAA\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{01b47e23-4226-4094-9c19-400f12efee57}\DisplayName = "Microsoft Windows Desktop Runtime - 7.0.0 (x64)"	windowsdesktop-runtime-7.0.0-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A5ADD71A449F22E45B87BF68C006D412\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.3.50341_x64\Dependents	windowsdesktop-runtime-7.0.0-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1E02E291378DCD04D9B0E0646E155C38\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_56.3.50353_x64	windowsdesktop-runtime-7.0.0-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{01b47e23-4226-4094-9c19-400f12efee57}\Version = "7.0.0.31819"	windowsdesktop-runtime-7.0.0-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A5ADD71A449F22E45B87BF68C006D412	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.3.50341_x64	windowsdesktop-runtime-7.0.0-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF8346EBECD8FC64698728A560D4AAAA\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{BE6438FD-8DCE-46CF-9678-825A064DAAAA}v56.3.50341\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E02E291378DCD04D9B0E0646E155C38\ProductName = "Microsoft Windows Desktop Runtime - 7.0.0 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B98C89FD9A65B5575370103EAA1B7303\A5ADD71A449F22E45B87BF68C006D412	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FF49CB8FC0FF6224EAA01891069FD37F\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E02E291378DCD04D9B0E0646E155C38\SourceList\PackageName = "windowsdesktop-runtime-7.0.0-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF8346EBECD8FC64698728A560D4AAAA\PackageCode = "486C499DEA6C92843BE88680FF51E108"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF8346EBECD8FC64698728A560D4AAAA\Language = "1033"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF8346EBECD8FC64698728A560D4AAAA\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\Dependents	windowsdesktop-runtime-7.0.0-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1E02E291378DCD04D9B0E0646E155C38	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.3.50341_x64\Dependents\{01b47e23-4226-4094-9c19-400f12efee57}	windowsdesktop-runtime-7.0.0-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF8346EBECD8FC64698728A560D4AAAA\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF49CB8FC0FF6224EAA01891069FD37F\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\ = "{BE6438FD-8DCE-46CF-9678-825A064DAAAA}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E02E291378DCD04D9B0E0646E155C38\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E02E291378DCD04D9B0E0646E155C38\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{01b47e23-4226-4094-9c19-400f12efee57}\Dependents\{01b47e23-4226-4094-9c19-400f12efee57}	windowsdesktop-runtime-7.0.0-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A5ADD71A449F22E45B87BF68C006D412	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.3.50341_x64	windowsdesktop-runtime-7.0.0-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF49CB8FC0FF6224EAA01891069FD37F\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF8346EBECD8FC64698728A560D4AAAA\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF8346EBECD8FC64698728A560D4AAAA\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF8346EBECD8FC64698728A560D4AAAA\SourceList\PackageName = "dotnet-host-7.0.0-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E02E291378DCD04D9B0E0646E155C38\Language = "1033"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E02E291378DCD04D9B0E0646E155C38\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A5ADD71A449F22E45B87BF68C006D412\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{A17DDA5A-F944-4E22-B578-FB860C604D21}v56.3.50341\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF49CB8FC0FF6224EAA01891069FD37F\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.3.50353_x64\Dependents\{01b47e23-4226-4094-9c19-400f12efee57}	windowsdesktop-runtime-7.0.0-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF49CB8FC0FF6224EAA01891069FD37F\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BD5A978AE6A585D43068C1C91FEC95A7\FF49CB8FC0FF6224EAA01891069FD37F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF49CB8FC0FF6224EAA01891069FD37F\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\DisplayName = "Microsoft .NET Host - 7.0.0 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF8346EBECD8FC64698728A560D4AAAA\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.3.50341_x64\DisplayName = "Microsoft .NET Host FX Resolver - 7.0.0 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF49CB8FC0FF6224EAA01891069FD37F\PackageCode = "3654775A9ABB4B94C96720ED70CDEBFD"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF8346EBECD8FC64698728A560D4AAAA\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.3.50353_x64\Dependents	windowsdesktop-runtime-7.0.0-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A5ADD71A449F22E45B87BF68C006D412\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A5ADD71A449F22E45B87BF68C006D412\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{A17DDA5A-F944-4E22-B578-FB860C604D21}v56.3.50341\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF49CB8FC0FF6224EAA01891069FD37F\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{F8BC94FF-FF0C-4226-AE0A-811960F93DF7}v56.3.50341\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64	windowsdesktop-runtime-7.0.0-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A5ADD71A449F22E45B87BF68C006D412\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BD5A978AE6A585D43068C1C91FEC95A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF49CB8FC0FF6224EAA01891069FD37F\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{F8BC94FF-FF0C-4226-AE0A-811960F93DF7}v56.3.50341\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E02E291378DCD04D9B0E0646E155C38\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{01b47e23-4226-4094-9c19-400f12efee57}\Dependents	windowsdesktop-runtime-7.0.0-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A5ADD71A449F22E45B87BF68C006D412\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.3.50341_x64\Version = "56.3.50341"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{01b47e23-4226-4094-9c19-400f12efee57}	windowsdesktop-runtime-7.0.0-win-x64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Galaxy Swapper v2.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3808	msiexec.exe
3808	msiexec.exe
3808	msiexec.exe
3808	msiexec.exe
3808	msiexec.exe
3808	msiexec.exe
3808	msiexec.exe
3808	msiexec.exe
4036	Galaxy Swapper v2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeSecurityPrivilege	3808	msiexec.exe
Token: SeCreateTokenPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeLockMemoryPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeMachineAccountPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeTcbPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeSecurityPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeTakeOwnershipPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeLoadDriverPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeSystemProfilePrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeSystemtimePrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeProfSingleProcessPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeIncBasePriorityPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeCreatePagefilePrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeCreatePermanentPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeBackupPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeRestorePrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeShutdownPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeDebugPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeAuditPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeSystemEnvironmentPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeChangeNotifyPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeRemoteShutdownPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeUndockPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeSyncAgentPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeEnableDelegationPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeManageVolumePrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeImpersonatePrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeCreateGlobalPrivilege	3816	windowsdesktop-runtime-7.0.0-win-x64.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe
Token: SeRestorePrivilege	3808	msiexec.exe
Token: SeTakeOwnershipPrivilege	3808	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1148	windowsdesktop-runtime-7.0.0-win-x64.exe
5784	firefox.exe
5784	firefox.exe
5784	firefox.exe
5784	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5784	firefox.exe
5784	firefox.exe
5784	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5784	firefox.exe
5784	firefox.exe
5784	firefox.exe
5784	firefox.exe
5784	firefox.exe
5784	firefox.exe
5784	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 1148	4976	windowsdesktop-runtime-7.0.0-win-x64.exe	88
PID 4976 wrote to memory of 1148	4976	windowsdesktop-runtime-7.0.0-win-x64.exe	88
PID 4976 wrote to memory of 1148	4976	windowsdesktop-runtime-7.0.0-win-x64.exe	88
PID 1148 wrote to memory of 3816	1148	windowsdesktop-runtime-7.0.0-win-x64.exe	98
PID 1148 wrote to memory of 3816	1148	windowsdesktop-runtime-7.0.0-win-x64.exe	98
PID 1148 wrote to memory of 3816	1148	windowsdesktop-runtime-7.0.0-win-x64.exe	98
PID 3808 wrote to memory of 2092	3808	msiexec.exe	100
PID 3808 wrote to memory of 2092	3808	msiexec.exe	100
PID 3808 wrote to memory of 2092	3808	msiexec.exe	100
PID 3808 wrote to memory of 1576	3808	msiexec.exe	102
PID 3808 wrote to memory of 1576	3808	msiexec.exe	102
PID 3808 wrote to memory of 1576	3808	msiexec.exe	102
PID 3808 wrote to memory of 5044	3808	msiexec.exe	103
PID 3808 wrote to memory of 5044	3808	msiexec.exe	103
PID 3808 wrote to memory of 5044	3808	msiexec.exe	103
PID 3808 wrote to memory of 2688	3808	msiexec.exe	104
PID 3808 wrote to memory of 2688	3808	msiexec.exe	104
PID 3808 wrote to memory of 2688	3808	msiexec.exe	104
PID 2652 wrote to memory of 5784	2652	firefox.exe	107
PID 2652 wrote to memory of 5784	2652	firefox.exe	107
PID 2652 wrote to memory of 5784	2652	firefox.exe	107
PID 2652 wrote to memory of 5784	2652	firefox.exe	107
PID 2652 wrote to memory of 5784	2652	firefox.exe	107
PID 2652 wrote to memory of 5784	2652	firefox.exe	107
PID 2652 wrote to memory of 5784	2652	firefox.exe	107
PID 2652 wrote to memory of 5784	2652	firefox.exe	107
PID 2652 wrote to memory of 5784	2652	firefox.exe	107
PID 2652 wrote to memory of 5784	2652	firefox.exe	107
PID 2652 wrote to memory of 5784	2652	firefox.exe	107
PID 5784 wrote to memory of 4020	5784	firefox.exe	108
PID 5784 wrote to memory of 4020	5784	firefox.exe	108
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109
PID 5784 wrote to memory of 1648	5784	firefox.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-7.0.0-win-x64.exe
"C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-7.0.0-win-x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\Temp\{007D2C8B-2AF1-4D63-B046-684A6209692C}\.cr\windowsdesktop-runtime-7.0.0-win-x64.exe
  "C:\Windows\Temp\{007D2C8B-2AF1-4D63-B046-684A6209692C}\.cr\windowsdesktop-runtime-7.0.0-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-7.0.0-win-x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=544
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\Temp\{C878BD89-9608-49AC-9E1E-4D4D48AEDFF6}\.be\windowsdesktop-runtime-7.0.0-win-x64.exe
    "C:\Windows\Temp\{C878BD89-9608-49AC-9E1E-4D4D48AEDFF6}\.be\windowsdesktop-runtime-7.0.0-win-x64.exe" -q -burn.elevated BurnPipe.{9FCFE7CB-1BF3-47D1-A109-CB9AB72209DC} {7022F985-7DA2-46CC-84F4-3A8B57556A5A} 1148
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:3816

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FA5E89EDBA6DEBC6CBF5BB22940C9567
  2⤵
  - Loads dropped DLL
  PID:2092
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ADC777DB1C987078F22C5082CB74AFDF
  2⤵
  - Loads dropped DLL
  PID:1576
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B0BE138605A2C75E12ABF523299F988A
  2⤵
  - Loads dropped DLL
  PID:5044
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D755FBBC41949F238C189B1FCC714484
  2⤵
  - Loads dropped DLL
  PID:2688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.0.1259329861\840714114" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1580 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {42a0decc-7147-4b34-bd2c-b82316d49e3d} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 1996 296177d5558 gpu
    3⤵
    PID:4020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.1.634756279\90115205" -parentBuildID 20221007134813 -prefsHandle 2368 -prefMapHandle 2356 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb229aef-fe9f-4a6a-af1a-a7c4c8f857ce} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 2396 2960af72558 socket
    3⤵
    - Checks processor information in registry
    PID:1648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.2.1546379549\1225602628" -childID 1 -isForBrowser -prefsHandle 3152 -prefMapHandle 3140 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30a26d53-c0ed-40b8-835b-27d0b5bf6068} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 2976 2961775cf58 tab
    3⤵
    PID:5836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.3.1745701359\341721776" -childID 2 -isForBrowser -prefsHandle 3576 -prefMapHandle 3572 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc7ae1a6-2aff-4e66-a8ca-9199d54e05c7} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 3588 2961a0fe258 tab
    3⤵
    PID:3940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.4.1913864325\410118873" -childID 3 -isForBrowser -prefsHandle 4308 -prefMapHandle 4292 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75d5af49-8593-4c3a-b12e-da0d10f62d27} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 4512 2961cad5358 tab
    3⤵
    PID:5264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.7.102833032\1489162281" -childID 6 -isForBrowser -prefsHandle 5320 -prefMapHandle 5324 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4984ad1-35ec-4e98-8dd6-f0181dfa68ed} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 5404 2961b863c58 tab
    3⤵
    PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.6.573067077\1694677987" -childID 5 -isForBrowser -prefsHandle 5128 -prefMapHandle 5132 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40451b52-3483-44ca-a6bc-5fb78ffece36} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 5104 2961b863058 tab
    3⤵
    PID:4232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.5.1510700148\1982261412" -childID 4 -isForBrowser -prefsHandle 4660 -prefMapHandle 4980 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad50e349-de30-494c-8309-bb5640eb0a04} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 4996 2961b862758 tab
    3⤵
    PID:2000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.8.707217156\305053727" -childID 7 -isForBrowser -prefsHandle 5740 -prefMapHandle 5800 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a8a95b4-7acd-4438-8447-bef8ab13705d} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 5788 2960af6e858 tab
    3⤵
    PID:792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.9.32438419\1659049077" -parentBuildID 20221007134813 -prefsHandle 5948 -prefMapHandle 5904 -prefsLen 29694 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {961a7cce-c1f0-4a06-bf82-3b5810692de2} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 6084 2960af5ca58 rdd
    3⤵
    PID:2736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.10.1580137955\1898206779" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6268 -prefMapHandle 6084 -prefsLen 29694 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2aa52ca0-af0a-47ef-af4d-16d87ebf3b23} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 6280 2960af5df58 utility
    3⤵
    PID:1420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.11.2117017231\1609147238" -childID 8 -isForBrowser -prefsHandle 6424 -prefMapHandle 6268 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a7db4ed-8300-40dd-8aeb-cbac44f45d4a} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 6432 2960af5fb58 tab
    3⤵
    PID:1216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.12.855036140\2138590648" -childID 9 -isForBrowser -prefsHandle 6420 -prefMapHandle 5336 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed42cca6-f37f-4a7c-a653-ce399fed902d} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 5264 2961d9e6e58 tab
    3⤵
    PID:4108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.13.326319268\1562496120" -childID 10 -isForBrowser -prefsHandle 6536 -prefMapHandle 6456 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {921ec087-8f8a-4a45-9d28-bde4b961f4f8} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 10716 2960af63258 tab
    3⤵
    PID:2944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.14.1153545855\553153841" -childID 11 -isForBrowser -prefsHandle 6648 -prefMapHandle 6644 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ad403c1-b056-446f-b3e9-7048366e703e} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 4948 2961b9c3f58 tab
    3⤵
    PID:4652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.15.2099610759\466322379" -childID 12 -isForBrowser -prefsHandle 10316 -prefMapHandle 10320 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27eca31c-369d-49d3-9fe4-32c60c4c9594} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 10332 2961e037558 tab
    3⤵
    PID:1344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.16.1429431371\177328202" -childID 13 -isForBrowser -prefsHandle 10544 -prefMapHandle 10016 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {574dc095-70e7-45ce-bcaf-2394e332a895} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 10504 29623a87458 tab
    3⤵
    PID:1636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.18.1360700111\1124840659" -childID 15 -isForBrowser -prefsHandle 9732 -prefMapHandle 9736 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a19e9200-dd08-411d-bc88-e2a09c166928} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 9692 29625628158 tab
    3⤵
    PID:4332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.17.2123924170\279608701" -childID 14 -isForBrowser -prefsHandle 10056 -prefMapHandle 10140 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8eaaa61-983e-48d5-949e-f9bcf204128b} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 9708 296230ad858 tab
    3⤵
    PID:5104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.19.181914412\1876752871" -childID 16 -isForBrowser -prefsHandle 9708 -prefMapHandle 9436 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d57055d7-bfb3-4722-9270-b46106d2700b} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 9408 296239e9b58 tab
    3⤵
    PID:744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.20.777458710\1614237466" -childID 17 -isForBrowser -prefsHandle 10600 -prefMapHandle 10564 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49f81e69-259b-42d5-a628-7bde6da5bbb4} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 6704 2961eeacf58 tab
    3⤵
    PID:5824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.22.924584710\519923196" -childID 19 -isForBrowser -prefsHandle 9056 -prefMapHandle 9052 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccf6afbf-f561-441c-8f89-5a480ecb8327} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 9272 29621f7d858 tab
    3⤵
    PID:2548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.23.466326116\1377741666" -childID 20 -isForBrowser -prefsHandle 7128 -prefMapHandle 7124 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e93b7cb-d25a-4131-adfa-42c12befe839} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 9708 296252c5658 tab
    3⤵
    PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.21.1075782997\1625946681" -childID 18 -isForBrowser -prefsHandle 9204 -prefMapHandle 9200 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af1b4bcc-34fc-4e9b-8410-903a5bfca928} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 10584 296236b8558 tab
    3⤵
    PID:464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.24.638700837\1617893798" -childID 21 -isForBrowser -prefsHandle 8652 -prefMapHandle 8696 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce713173-ffd0-47ae-930e-8afc1ff95882} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 8724 29624086c58 tab
    3⤵
    PID:3588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.26.1464657850\1631991051" -childID 23 -isForBrowser -prefsHandle 8356 -prefMapHandle 8360 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5372c9a5-5c58-4b41-93a4-0f5a9e7a97eb} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 8532 29624fede58 tab
    3⤵
    PID:6140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.27.1279130473\1140137060" -childID 24 -isForBrowser -prefsHandle 8092 -prefMapHandle 8096 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b1e6791-c485-4774-88da-31d3f9ebf820} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 8076 296237d3258 tab
    3⤵
    PID:1104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.25.1408219883\1893440382" -childID 22 -isForBrowser -prefsHandle 8724 -prefMapHandle 8696 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b96bb9e4-0229-43c3-808e-c955d8c58c95} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 8472 29624fed558 tab
    3⤵
    PID:5376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.30.1803486610\12657860" -childID 27 -isForBrowser -prefsHandle 9196 -prefMapHandle 8512 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f78483dd-7af3-485f-adce-f8fe6f79b47b} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 7296 2960af68d58 tab
    3⤵
    PID:1496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.29.471141288\593386150" -childID 26 -isForBrowser -prefsHandle 10544 -prefMapHandle 10340 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {661de52d-2606-4bc4-9311-aad4b09e191d} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 9836 2960af64458 tab
    3⤵
    PID:6076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5784.28.1848626118\120062224" -childID 25 -isForBrowser -prefsHandle 6564 -prefMapHandle 6444 -prefsLen 29694 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ebfd2fb-e47a-46e5-9f01-9920c83825a9} 5784 "\\.\pipe\gecko-crash-server-pipe.5784" 9196 2960af2ff58 tab
    3⤵
    PID:2516
- - C:\Users\Admin\Downloads\Galaxy Swapper v2.exe
    "C:\Users\Admin\Downloads\Galaxy Swapper v2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4036

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x514
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e577b2e.rbs

Filesize
47KB

MD5
9f2d394d55f238ba4c8ea2a06ecfd6c6

SHA1
4fa6c340a36edcab5ebd18b5224195344c76ca2b

SHA256
c5d1859e9496df9ad06b60b005fb75f778c664def0d630079d380ed6d89b81b1

SHA512
fe6381b9815b904df41529503a74ac21942cc0effafd72d4b18890c3661621f0595161b5e5a470edcf5d360b75f570623f43f7e3dd8714ccbcec02180fd69e12

Download Submit
C:\Config.Msi\e577b33.rbs

Filesize
9KB

MD5
20735bee7e17c3cd965302c4de00a723

SHA1
5c92b6dd3bd46b73b13b49179ddaa8d81ac13a4a

SHA256
2230d0fc9d4e7115a9ef0e4f73e7d90d3f8c45bbab4fba2b6016a024abd0fbac

SHA512
2b4e78e99fd8d2c06c1a682e978ee0e70029abb6e1dd3a0dedad629065f7589ab8aaca37783d03b7728ed380acbe02642ff7dfeade4e6108ce38250417ccf8a3

Download Submit
C:\Config.Msi\e577b38.rbs

Filesize
10KB

MD5
d1d788c6790ef8903d1bb2eb48db66c5

SHA1
2844e8c632cec854496f0d2063839fd233afcc2f

SHA256
98b00d408bd59aec666bac0a625dfba43d73e6245f4a62117fe7a84182befe9c

SHA512
92f17b4413fba6448748a931d3c04c70e19a4e3891c4df528b55542ee6739a225bba28aa6508509e49b98a266621d36eaa7bd3f92d594376cb8a4885653a80b0

Download Submit
C:\Config.Msi\e577b3e.rbs

Filesize
87KB

MD5
3ee6ba681847f941509c86e0c4238f07

SHA1
52df074827cc05b47a027f70979a8591b052ef0e

SHA256
065cefcbcf6d2b9aaa487cef5168505431eebdb2408bcc61819fb5797ec3411b

SHA512
e16ca17e4107af6d955a785e94c8265b792ce23a54f4f6f8f79d72449b7e7dd3fda18ded0b7b99e2afabc63d5d9024650d70c219625d61fa28b0aa7e12c404ab

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
85KB

MD5
481ad608d2c3b3a5a0a3a529f2b2569e

SHA1
e271613b837d2cda290808af2bbd104a8c104a10

SHA256
29aec309fa6f036be931222385612088a3d98aa07ac2356243028a3072d0ce86

SHA512
93dde6782e14ac259b8655a89b31f7efe6990f27bc560f90200f3c967645d20fc54510e8fb0346732ea54707728a7075c9b566a936e76586c50681de65c83afb

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\Microsoft.NETCore.App.deps.json

Filesize
27KB

MD5
da411e288258540ec63ceb51dd6f9a16

SHA1
0b979d598dbe2bae27645c1d1855390c2261a531

SHA256
9bca0d210c1d5d66633366cf3285ff04f396d9704d18067e9dd55e5e40a3b231

SHA512
fc99d99fa36853a20d350ffe2474f70944c032e054f6a2f4bd24108d1253b9fcc733846b3c1fd991c1e328667c39d2c424b43c36ec0caeadab16cc011c3eda7b

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\Microsoft.NETCore.App.runtimeconfig.json

Filesize
159B

MD5
01da0d56ab33c0ed0e7ac85e5244190f

SHA1
9e1e4b59e590038f769e5fa01fb326109a7f38e5

SHA256
7133274dc5efab688a6efe2f43ca33e78a2498ef39efcad231b0e07ad2c26d17

SHA512
e11967ba33c719da1681a7f98056d40f450788d9b7c8b2f580d8bc7998fc35a78c53fc970301b097c527fab79fd477adad4eafcd75b4bb376d33c3fece9e8926

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Diagnostics.Debug.dll

Filesize
15KB

MD5
9721694e8998963f5a984fe209afa4da

SHA1
2b6b0078ff1977d78f611eb1afcc309ee387bfe7

SHA256
eea3a9d6761913bac5e62b558c1ca51c64af4367d45663c33dfdb52fb87d7751

SHA512
fa37f3bd75b2cfebd58e9624b500613aa2dca512fb764820c53002150a0d7e12b90dabaff51cf04538a755cc0bf1a8bc613e37690dd6aebb3eea5d0b31041269

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Private.CoreLib.dll

Filesize
125KB

MD5
3c08aa377820fd49c9d7f8a6ecd15043

SHA1
ce68a19874cfbac11b4f29e81e182fe805bf385f

SHA256
227f536efe8382f744c1ef7f3d07dc8ea940ea6ab48a2126cc0a0fee86c14b2f

SHA512
9063b421a3556f3f29a04b73e4880bef357d48cd353fd579f29815d91b424005908765b91601d6e1aa7f0e2fedde925b7828a9e53be7629a1c39fd4e44fa3f8c

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Private.CoreLib.dll

Filesize
42KB

MD5
1067bd35223fcd3fd97f9dd525af074a

SHA1
6818020a46f805a256dc716c95924c780207b1c1

SHA256
22881d62bee50c923e9f2870b9aeeaa3b73fb1115781299f38e99a9d2de4ef76

SHA512
5be0686507814d5b4c31c4e7f0f56023f459dc3a149583fa9dcff3d3aca990d1ce0531b17cd2dbbebf4af12d56c134179f1df4b8b02bab311ea689ce08c96f07

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Private.Uri.dll

Filesize
77KB

MD5
45f1c1a6ead20be49d6fcfbc9fffc8b3

SHA1
16f2eb162e26e5da9b6bcf18812f5039012af02c

SHA256
2fa44b521e914a046fe41defcf453a37eed8bc9a2f539a17d348da39e288ba1e

SHA512
5def254043c05c1b7fbb0c15e7f669de8027d03ee07657a797f8db3888dadcf55eaf3b3bc1146391fc1f91f96696c8b8a494be1fe6d36c28588012925b03cf6c

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Private.Uri.dll

Filesize
164KB

MD5
26688010a85b3caa67e276bcd814a872

SHA1
4abd09b72a0f9bc439818511db577f49cf8fa28c

SHA256
53bfad47e53aec32ea76a60a4e385728b4c121310eb0e806243ecc25d587aaa7

SHA512
9b18266bbe5d6635347cc30f47159c8168baf20f19152d505deb6328a047f5357d11066eb99ee3ed48d66fa64cf51d7ed567be614a9002ea0abd4ecc68c2f992

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Runtime.CompilerServices.VisualC.dll

Filesize
34KB

MD5
529806901b279cb92ab68abf976fb2d7

SHA1
6e80c32325ad2072cc9f44b3f854af291a03aee3

SHA256
2d848b8723a919ef1a65444c89d3d4afc2361255bf849d052c78276b4e1b45fe

SHA512
1afca18e59deebfe9b82d9e0b2e173516bbbfe71d4afcdcb8f7a399c2243a25fd57a8c269d93a08243b5fbcf7357b62879fd4bde3c0a13433ef427844b86630c

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Runtime.Extensions.dll

Filesize
17KB

MD5
79962c9215f1c00aaeb380cf784086ed

SHA1
365dc0a2f14cf2c69b5babf93f980da026d53fa6

SHA256
530156278639110966972826872e53f0bd58d32fefe403919a1619f5a5cf02c0

SHA512
196d021d51a2193225416614ff1a0f14b2d5b409af8c99492fdfd0742708e6bab5c9a6d186c621674df83d443f1fa2852d256948270bd9b469910bdef07fc6a6

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Runtime.InteropServices.dll

Filesize
61KB

MD5
9c30c366fbc93f761bb06f54fceca015

SHA1
bd928ef8049f8f5f086100967d9615c356edbfc4

SHA256
f72ef837b02ae8cd8e0847c4af63a5619aa02b32fe548c92d984c5b46d5231b1

SHA512
a4bd428d36ec85817c64c0e31c685aa1769c18a5a34c612e4070c737c9c58b1dbe8d56740a6c13e4a9047f8b73cd5f86ff1741ccc1297c98728b00a4f7c4044e

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Runtime.InteropServices.dll

Filesize
62KB

MD5
d4ab80c6798dc8e29bdec6d3b4847e03

SHA1
30fafbb0b0eb28a5a84b114bae1f36d84832f41a

SHA256
65ad41c23b4bed56ec6e20b5ae139545d1f44e86d31daece06d6b815903dbf38

SHA512
9862166ebb7f12aceea4188edcf0533b46b1e351c881382d24c4732ca35940db0461e079a9049fc7a1e5a8bef5055b8ae3277b69cdb30289849629e31804b70a

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\System.Runtime.dll

Filesize
29KB

MD5
6ff8c260604016e66b60305f5d3e410a

SHA1
fbd6e2cce23b79f2eb51e70a7f6a1de26b028d62

SHA256
06cced01d0c6a4e01bac7a294d634ad86ee65a8cf9445a9483b687c18b6c6345

SHA512
be1f73d41b112cd9684fcb416ef37db695e93439bd11b95f6984450da378a186170681ccb26d8a93fca3ab4914ed0bb1714aa6299e42ec8b599d010de305c6f8

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\clrjit.dll

Filesize
93KB

MD5
72a5b18ef75b3c0a07ecb8e107a7baa3

SHA1
6ab17ff14f34b1bb10d1a9d27f1c6b65483d23ff

SHA256
ba8d354597d01ea8835379566eb61b9cc42196762cfcd6930475abc0b89f341e

SHA512
102d9ac247b61519e4f73423a528bd666ffee2a095c651e92210204093a1f7d51e3d38ea263a3887f6d773d21e5564a0bfe766a73a8b6351ab8a1605e55bac0f

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\clrjit.dll

Filesize
72KB

MD5
ddb392ddf82adaa4fdf57abafac5cca1

SHA1
21008da2793e30954f7111eb9eb0faa2c605b801

SHA256
7be65adf118e4210b1f468c590ab2841799b71828be253c1c0efb4a37a110d94

SHA512
ce91075b1604e3b99adeaf67590d7b0ec0006a76ca97aa8ae5cc86b322522f67b9f1dd4d92d69bae8ac4fb727817f70a99d0878f421e368a66306543ae878b29

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\coreclr.dll

Filesize
55KB

MD5
970e6314c60ed5bc697403ec10122862

SHA1
02fd7a2d90961c5916aca111924318c86fee83fa

SHA256
6f0c36742dd9c8d579d988e9dce0727ff76dae64fa8932fc235323d9840e6fa2

SHA512
7c241a7e560be1b1dea086c64fb016a1506eb81f6451bb268a8645c5e63840a67b877361d3da449bd0237952766f423d76f643adc4685be6e92a4f2bdaf4a7a4

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\coreclr.dll

Filesize
65KB

MD5
22fdcda4ed0d37312aa727fcec69c34c

SHA1
9456e86022a7639cf56567998a3ceee38e03adea

SHA256
231d6304e360ff095a2a3a1b097f269827fb3bc7bcef03495d75dbc997d7ec27

SHA512
5cb82537a64b76b4dfed4f68be98ddcbdc0365feb8832c8b2c83b24418d012b4faa1388ae6cefe5e0aa084e906b1b55e6a8d0f9c7ccbc66305245dd88689ce32

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\hostpolicy.dll

Filesize
378KB

MD5
97b9abf2cc4f70168b49083fbf6b7d68

SHA1
84070e823e6b26ace78186752e082bd852d90a66

SHA256
5c4709fa9aa6b18a790a84518cf5a59178005fa2e4539687be50af4f607f2485

SHA512
1a7ebe7d1b3bc3ebcc319fa2fd5874875e624acf1b519b899ec4b8473f7baf8a36259dc590535b0b9c7b5823959ecb023fdfc715aba3a29e5323ca790603cebb

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.0\hostpolicy.dll

Filesize
68KB

MD5
9ca34f0a0d932959afdd989a0917f932

SHA1
e5a8c7934ff05f87f367f08de3969d9ec7b067bb

SHA256
ecaac503487d59169120690d68a782b1d686263c319e02ec7e9fe420a8781926

SHA512
5a6b1203f968c35db66bf930b890b41dc677fd9be9ba1b70e3a8568ba136bc8a9fce39d59c75028205bd9293515053b42465ee5524ba05dee3df04a83d7eeda7

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\DirectWriteForwarder.dll

Filesize
111KB

MD5
f1398b2933260d5052c645579395b720

SHA1
bb42dbe7fe1993424787251064589d62f709dd10

SHA256
953db0254cd1488432305795ce3f184e3cb5c784f16886f8d72ebdb3ee307ccd

SHA512
dd7550c6d6d0821bafd66e611a0a58ce7332d70c61c90dbfb2da0d7c794ce576776312bcc151a573f5fac426e68f49aa8a198d515913b193bb12c1c297b1d557

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\DirectWriteForwarder.dll

Filesize
101KB

MD5
cb2bcdc32f213a9357e8700393aed1f2

SHA1
f345de3e0cd408d1805d39871840c931bc288f63

SHA256
9765af47013428c28ec69514efbe40abec08b8cc6ffab41fd717e65c3a75f0b7

SHA512
ef89720dc42c8af36fce6c0ba301d89052d334d771bf70ff1fd1e4bf29c25421f655dcb9742aa50c8c8b61075c78bc99f3e37f0c83d77571710facd422c8031c

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\Microsoft.WindowsDesktop.App.deps.json

Filesize
30KB

MD5
3b8d5cb5eb2fda43935044191e6da854

SHA1
7477531c231b20bde5f16728fea69a42f43b20c2

SHA256
234fc4ab4c7e1010c0f6bff1d6ffcb7c220fdeda5627f4d32b5ea803b63f11e7

SHA512
ae7c150280bdc5a2c4770a4cc78380bc8210a2d05a0ef8d98c098ac5889ab8edde01a81c718d7bd697b27fc9a2924869cb3a1e420bf91c17cc3253ae1b0327a9

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\Microsoft.WindowsDesktop.App.runtimeconfig.json

Filesize
288B

MD5
e9214b52a1433267039d4929c8194e7d

SHA1
95255a9357068e7e0f0f6aff06da98b89d8c4d30

SHA256
b4c165b270ec7ed05cd30450e0f38baf0f73dd54a45ccdf0f0534c1c60a74f68

SHA512
2a45a4c438beb20dd272271bf9b02245f64a9707ff81289b04c4bbaaac05605b88ec0a2df16a82ee9754e9c48639024e09cf5308200dea52402ce30dff01ebdc

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\PresentationCore.dll

Filesize
101KB

MD5
ea7b58bdc251e343f129ac3bdc2a7a93

SHA1
7cb3fe3ce5384fc95e1620a41a5d64d8fc69cbfe

SHA256
cfc9ca5ecabc76150a9e3a76874c63cec2cfe03e251e8f88e5969a2ffc543f8b

SHA512
c14704573d0b9c2513d23c0026daa4f80c1ddd21e99fb3b1412c00ba439eea43ded5454ec45a6bbd8adfe0224591dd15e1a62d639cd739aa2b77e40a085fd821

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\PresentationCore.dll

Filesize
216KB

MD5
05a0289324e3b468b90720af4408ce1c

SHA1
f818dde9c7e3fc75d80bf4e4bbd3e9ef5f005cc5

SHA256
e2542bd42c9e7c945b881bce8f2ee88ae8a66998e2fd9cc4fc0bdc9b17f933da

SHA512
49076354008fc3aa85ce1b030a942a48754a365d25ebf0a85f6508ee94eb7f47ec574fa8ffc7e47f36a1c13737440658aece5a12f9b6909d1e4da865dfb9d8bd

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\PresentationFramework.dll

Filesize
96KB

MD5
dcf07485a7bf916bb9f0bb42fa5bc594

SHA1
49c00ed3f8cd82a770ccad01b597e3ce89b3e1ec

SHA256
7311c016d0d69cfd0e87cb33210c900cd4aa43da4b99e85b10b669af1faa89aa

SHA512
43a510c06a8f6e19b89a242f019e338ae5b2b5722de4ddb8e213fb2fd078feb800778d41de22c5f7eeb47b1cc2d4731c673bd0c97a24f0dc286962650efba5f6

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\PresentationFramework.dll

Filesize
118KB

MD5
4846014f2b92a00006aae342f5ff43fe

SHA1
1f9575ca24d7185714e17e747ea62afc379230a6

SHA256
b86c93571c5b19f977518351388dad61400fc04ec2785fe7f23ce233bbe04edf

SHA512
3f8c4f7a2f0a22d59b66c7fdd2f309d02118688960d5fafa6a75701e442f5d8d2c26576a36de8e29452f50ef14324b095de08763ce976a73b1c6ac9e0395eb94

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\System.IO.Packaging.dll

Filesize
54KB

MD5
8aa67651aaa953b4bc4a3c78af4907a7

SHA1
9c99887baf38a24f1263336c819deb2223bc5f49

SHA256
776394fe936094093d16e875e9af951870dc924c71ab47542c36a73c976dab54

SHA512
00160086e90f4cd9218432f0e25b1c323fce11781c616cda60580f4e7af61dfcf6f4bed5c60ba73e1151865d897a8e4557bebcee6ea92334c33a3083739172db

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\System.IO.Packaging.dll

Filesize
39KB

MD5
f8de77c214c400b2373168dbd64f8034

SHA1
bb51c4f7d80fe50fee5bf78142071828b836069d

SHA256
2b13653a9d35c9221a7af4a020dd266bef2cee126c3ca377768248a2ebeef509

SHA512
eb7cd76ce6f182f7cedd8d8c18fa8f7d1c28e2001d88e7d11baeba04264739c2eda718dc901722ab862c7dd9d284ac9a303f3201208e4ad2b0707d9f9242eb36

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\System.Xaml.dll

Filesize
177KB

MD5
17b9bdfcb7fb569dadcfe01c359e5044

SHA1
a9ac5512553ca370be3fb67f12c6ceab1d74b31a

SHA256
383480ba51ddaced4338627779e5143bb5d216d39894daa0fdeebdc35e28d03c

SHA512
e9bf2b7b7c7ddeceb2e6743e6103760e12938dd5a45d04ae3832e59dda776cddd60fe0aa615d774314a80674b3f30cbbaaec47fbf9f40df5d85fe1c9e108dc92

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\System.Xaml.dll

Filesize
146KB

MD5
cfb1ba136939557b282c484962f3e66c

SHA1
e69f78d3063215d6d3e6c7f8a811bff0262a1aae

SHA256
628ff34ccd04500f2020d9a372894c68d31f3549c8a52350e70cb07e070d6bf8

SHA512
4ae14afb48f5779c167faeb1e8dabde5edaf160d60c6e64f7d26de920c6967f2b20f82e097ba9078303ec005fc1be4a7f96bd754364c277c817c83c69e623ae0

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\WindowsBase.dll

Filesize
106KB

MD5
9c60f6b5776385b18e8cb9003766f688

SHA1
e95969cbbcb76a3122f1f8e48a48b4eea7c091fe

SHA256
976feccaeced8d52a1829b3eec356b7aea75ef8af6980bda2293ec2efc43b581

SHA512
0b189edb6809bbe37fabf7f5e788fb126b64504f7756c411f04ac06f2aeed6bf0bcc54ec937876150e4e44c25be81bb983b6fd3e92dc394e81f1563afaa4c7a6

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.0\WindowsBase.dll

Filesize
55KB

MD5
a8fe4c0f5b7dbfb0f5aadb49b07cc510

SHA1
7e5336f40cfacb108228a1ef57fbb780f79c9aec

SHA256
7fbb109037f5294385b67dbdc3e98e6e74555f5905f07f5da688717c8cd11b6e

SHA512
9b9f19f8cf632322b17e3db72ac3729446b657597f135c2a448bc2835c914693bc1584eba03c9927d07e8b429f4b17c4fe9677e6d79b6eb490d46610dff375b3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\59q4zd6z.default-release\cache2\doomed\22332

Filesize
8KB

MD5
1858f55c62f174236ce7aea363b31baa

SHA1
b1eaf667fb153b00e7c744a3d470f4bec213f13e

SHA256
32cab65d18bba9ae9d8ed52345a67a7126646db0b3a0fefc40bf89f40205f2ad

SHA512
0c92046cd23c97e2a62cffb884a3e8c27bd568f300dafad7ae38c41987a6fd8d3bf9da7cbea0b5a602406da4a3c39dcc3e5972be2735415e57e1f19a9ef3988f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\59q4zd6z.default-release\cache2\entries\77FB5EE92C576E2505C8C9FF2EC417D7727F401E

Filesize
13KB

MD5
9c8a88d803e82f9dfa1cea61c201ef4c

SHA1
f242f4414f46c11bb6ed468663ef87482090a57a

SHA256
a85d20e4b53b5b2c8206cd6c693561f1337c2040e32325f7a8ade70b6b55eeac

SHA512
4c544bc58addeac359fb5440d20d806bd8f90694281918366fc28843b7df6a499bde1081c4fa2dd857f44e568f3716ff8be328e54e74ace43900c5ce88cbbc65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.0_(x64)_20240128110508_000_dotnet_runtime_7.0.0_win_x64.msi.log

Filesize
2KB

MD5
8d3b91a49f0dba553dd291268841c1ae

SHA1
fab280cd4b099a656a18f722b9d1f97f033ebbc5

SHA256
60a9375d664daceef851a2e5792726fb15f2b7c24dd68ec857e561c66f4ec8a8

SHA512
b723b63e95562d76515a19c9cba33588e602dff5b83b1732919f865b9540702ab03d5beb5bb6098ca82cea84b9d9c69ffd93ef15282de0453b68cd340ce076ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.0_(x64)_20240128110508_001_dotnet_hostfxr_7.0.0_win_x64.msi.log

Filesize
2KB

MD5
69259684778f0787b1c9bc4628a14f0e

SHA1
7173ab0a6781e718bc8ccbb1e006d3e5701eb495

SHA256
8842c5d0d87e9734122c69c8f4a889d9c6f0a29482231628cbd90a132bbea088

SHA512
cfbf2a4c534e74692b872d2ef2887a1fb00c3eae8036836b9b687accbd16ac26b4c03a4773b170005971dce19bd6407ab85cfab5e65ce07fad59060213c49930

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.0_(x64)_20240128110508_002_dotnet_host_7.0.0_win_x64.msi.log

Filesize
2KB

MD5
1ae54aae2c85818f1eace0f7fb2f8827

SHA1
1a69bf4278797988a04bf899bf395925656b8e44

SHA256
b1bc00b5288f43c608f79f76e5f73ab8b6e413d9901263f9165b72b704918190

SHA512
329dd02d307e4dee63bbf02efc3950b4b242a54eec14c3b02806a6d09c43a32ac42972d2b31ba4a69bb76542d2a8d0c28315efb0173280162ccaa2d4a5801aab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.0_(x64)_20240128110508_003_windowsdesktop_runtime_7.0.0_win_x64.msi.log

Filesize
2KB

MD5
81d3997749dd5ea4e09f640e0b2e7036

SHA1
fcbc1466a9ecc64e3672023cd6e1a2a0c9df5298

SHA256
9ce31660b07b1eaa1394e69d7c5b55224e6c312492be7ca5898e7bd6fbf69a19

SHA512
1086dde5fa42e60d317d4a22d48662a8ac70b243fcfa5696a61d5e015d16384e377cba016c3a08c686f024bcd61395b393c778bdeba8c81d8b29c39c9d87d224

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
723KB

MD5
8016714fc5cf1dc986d20ead12563073

SHA1
a77e91813bb8e99b96bdcfae85bf6ace1d2f9871

SHA256
749c67783e37a28afb31893507f0d4f754cff448c44dbef8bc3877e15350ce35

SHA512
4d87ffd791fe6151ea4136e12b5aa15baf6f89b105cedc5f2d5e8cdd201035c000c4322953f8e954d1ea7340f40728faf04a3a4fd9fe1d453812a2dc453ae049

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
6cc55e6d39736d6f5a3cb1161560e4eb

SHA1
aab97249f6eee19cc0054fa785bc2b6521a731e1

SHA256
320db6b1971dcad241953cf1f3364d147d231fac0dc8197f1e900a2e71d90a0c

SHA512
ebe6d285e41c51344d0a731a82f9127a2e0924df5194902ccfccf39585fe1db089ac8267d35607ef6482dd74c75c1cbf7442b9fcabc085dc231aa3339aa01723

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\datareporting\glean\pending_pings\2637bdd1-4763-4c90-a936-1059b5216e4f

Filesize
10KB

MD5
77e5b10406ce941c3b805d807c14a7ea

SHA1
8268c9b1de1d6e241ed01578ee0bf4ff632e2455

SHA256
14e77c61ea41d39d0fd4bbbf387d6c04f2a6b8f37f9031d5f4a343c5d158e80a

SHA512
65864702adf939f21020421d250d51e01763b04db5ca6534cfd71dd1a13cff9ecb02650b2ce345156516ff6b487710c84bb18b31a4c9ac399ddf395d5caefc65

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\datareporting\glean\pending_pings\9d249ba5-4892-4b0d-96af-9a789adfcdbb

Filesize
746B

MD5
4eaed13ccdaad1d8412b81281c6e2d88

SHA1
c2143ee77aeb319d8736c56c7f552dfe5834f7d4

SHA256
20152a1114a7babc259a63ccb5782c97d68450327e92254f93bdc0b89f8fabeb

SHA512
08f5a8326a508eeac7e2d3eb197b38018a8b126ce3962fccf8269bb67ff4b167257c9fc88373cebccfe39098276959ddc4060760c19b084c8aeb1a1bc28165d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
835KB

MD5
9158f1163faab0e764e801221345bbef

SHA1
b8a18be68893a1fc3b2183e9f0ee84ecf0af7a0e

SHA256
658beef69ed85efa9dcceb3fa6af81ca7aa39eac2c0976a9b5d99e03ea8e9a31

SHA512
81019d97c3cd2c70ba1b13c1e9361668d4f9f5917567de3208cb34dc768ed45f31fd12462c0d7a896f468da7a81bf4324f54fcf77d0cf8ba442e7fcba1f8fe6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\prefs-1.js

Filesize
9KB

MD5
6d6b879743b4878863d2591a762b2c0d

SHA1
aa1e166c254e72fd29a1cc84294e8bcf8334d75d

SHA256
ac2b77635f51bf4023cb6f85034b8a9bd57620ed1c0d82d9f6f608510d18fbc9

SHA512
c52c0534b85d51cf6883f4b42f70ca104b13cf854780d60d9e4c8af700d654d30c81898658810e2e0f893d912e229bd6a48c91e873e7459a75f9b4ba139d87e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\prefs-1.js

Filesize
7KB

MD5
900ef2067aa678d9c9a6fb5cb5ffd27d

SHA1
b3e16bb9b6d4f77f294d016e737634999556940a

SHA256
1e1d679ade5797195b0dc280999dcbd2c449fb34c70b2637e22ca0cb562a1842

SHA512
9510f8c6167e59fe84a54d97b0122ee1d5c51a2a6a978192330fe5851d9d895544711efbc27580c38382d0ea5ca9bcc0b743410e8a0f86b9c5efc0f7a545f93e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\prefs-1.js

Filesize
9KB

MD5
c3b4a96e31f9be8fca1251623a388f89

SHA1
8afcca509131b76209a6110e90a9e6b14012b695

SHA256
14ae140ee13bb92d8a1a4ada82838cbc444e24190705156faf9a4ac5be8cb566

SHA512
85295814e21eb048e32c1a1524704ab2c18c25bf36ff6b952ce56380b3dd9d2f40e5a87adfcd7ddd93686db76c41c9a30c6df357f12cdc2fd18898e35b726ec0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\prefs.js

Filesize
6KB

MD5
59763f0cb2ad0271a64c60232c5a79cb

SHA1
303835510e139595af9e4a6d3d7347c0ae0fd4f0

SHA256
b51ec25941adb7cd2da61cfe345c8c624e4751f72a403bda856100d8b1cc523e

SHA512
8c24a1e64a0344942ca32bbfe2e02e8c26d7a81c4627b5884b221648b78340b43a279cc9e35e6062c0e544caf376059dd395c29fc0c463f9c6c96983a16777e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
e7bc8c89d598fc4e51bb1884a1f21081

SHA1
96539fadcec0b45401cc32833d74935836638a8c

SHA256
dc840e2c9ee737387bc519920b6d21a229957e165e352fa3d996d3e9a83f71cf

SHA512
f778094e77f19b67661a8cb5c4451e802c4f50c34c682256ad630c59838db77db61e6ac21bf6b3c3c13d6295b2f393063b38658a98bc1e36aae42edb0bf4bce4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
bf5e20d975d0ecc22a566b8a8559cbf2

SHA1
28d6d16b80ccdb486aa18ec3a8c3b9a7a8aaaf9a

SHA256
e8bbb0ced4f8a9124583ea86007320e21b977ba7059344274964199fdffdc4bf

SHA512
373c831ba5c3787dd229f7ec43161cc195331816f23df2f43b54a02d4452e18d16f59fd4584e9657b14b8691095d4fac1afe302f284fe8d7312c3f5338473242

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
18KB

MD5
f68aa2feb5b5bc60854ca59986f0383b

SHA1
326403e844ec0ab78aed99faa93e15be21cc1b78

SHA256
c2ab3ed674c6a0d7a5b73ab4cfabf64157f61399e9e353a1fce1fa5248c88d6d

SHA512
4dfa47eeff5a1fbbe129a431e4971144a723fb230cadf6ff85a0c9ec3727ac8736d9cb4e0624fd2ac928947445c415962b29a017029d5bc9e3631fc4a26efdbd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
ae63ca910a10c3ddd47f203c8b8e8a95

SHA1
e27d1e79f6e5a330bd28c437f941f20c65cee3ff

SHA256
b62a1cae2c792ac7d8baaedfb562643764106d5c5b43a981fb8aa8e982e8ff9e

SHA512
f96a202b457bf671123ce2a144e25441694c9adbeca49d332ff392101caf5ba7d4e505bab69a122a7362cf5ed2e2b8a07fc772950c04433bc40f12679ca08918

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
bdfe305150cc0c47430385f3d610bf1b

SHA1
028dd7264e28cc1ae6b6a8ae5bb343421a0f0446

SHA256
d10cb72ad8f6cbbf7c5c2fece3abe1aa78ca2577a51bac5e1041f012c58344fc

SHA512
2bb0db0d31348ba9d36523cf2a40a8c71e48636f982d9c0276f8e5df59e2a0d10522757447a119889d2b871e536544ff1d55b24e1cd0415641a5aa9d9c92edb6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
18KB

MD5
a6c0f695b23c33a4d0909b6afac6dfb6

SHA1
fe7b854a8a1032f18f5b3e59e0ed6668419c314c

SHA256
186fc38878c8afc1d1aa1cc9c9e4cc46730bc51b8cbc33355f7dcbe1ba57b921

SHA512
8ea45ef4fd0470c7b2293c9482f0a803991dc631f554c37150639e8d085b128acbd86a7a1909ff65537647231022c235d717d647d2948ae00caed2453db3a6f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\sessionstore.jsonlz4

Filesize
17KB

MD5
30feba81e890c8909e419a50458d27b0

SHA1
eef1ba27910141d2386ca6baa31635dd2320bab0

SHA256
137e4de87a31f53a3a8c09fe728e5dd5469df57451a2705888a8090d1045043f

SHA512
f40af863cb47bd2eb464d9c0eaf0467ed5e6e2509d9e05a353922acb5175bd27132b9eb8a1c980d8434050d1408d5042a3f174e68b3e0e75798b2ba7ff9019b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\59q4zd6z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.3MB

MD5
1b467a83aa0fd7497bb9d31d5d9fd92e

SHA1
8fa0fcd18e99ac476507e767bebf8c13af9d7a40

SHA256
e6d73e76fe52bbeaa9a90b1bc3cd0c6a205c6f43b94598cd1234f060990a64d9

SHA512
60b437b423a0be5c3a35a26aad4e36aa6e553d7573bc82ea68817ee984dc01b6e573636d5cd7509d496754f390942a20ef86b92da803bbdb6687edc78f7bf0da

Download Submit
C:\Users\Admin\Downloads\Galaxy Swapper v2.R51FkCsy.exe.part

Filesize
10KB

MD5
99775af1dabdb63703873844364a8e4b

SHA1
c0c83e0c0132ad9253d0fa9cf6ec18482f32f1e6

SHA256
77a6bef5c103bf8f4ca9008b1427077e24a54904d08b27ff52565ef5fd8ed91e

SHA512
a7865420f0c1c7f446eecbec8dccb1ef3f0ee52ee3a350bb956014a025a85d2232533f9c0d8e14cf1ce6ceb3576d7d64c8caa537495d11b1bba75db6cc1ac295

Download Submit
C:\Users\Admin\Downloads\Galaxy Swapper v2.exe

Filesize
664KB

MD5
11c3a6b8274880c77844d1381e697f1c

SHA1
f474d6f51dd1f816eb14d62b4b9a5c6e50d760d2

SHA256
bcda84134ef55d7063a9a6d2060c541df2db3ca7d50949b16f0eb5f64fe60ae5

SHA512
ff76ceb0be9b002a9939474e6abb3551252f7fc3219752089798aff28bd13f15b965dfa0fb1746c79566b0fea441bcf49e2a620e2938c7a2ffb8606acf6b5752

Download Submit
C:\Users\Admin\Downloads\Galaxy Swapper v2.exe

Filesize
624KB

MD5
60d35a988b184e9832f108d0f2854494

SHA1
d1d26b63b2cb415993e2c33876137713bd38e236

SHA256
cc87d67817ee0627c883d0c1476f4b427d25b06b84bd31f4d679e69f72c4911e

SHA512
343024e17675e1c259b9843a721766e840e3ecbe7d30c8047f398ff173ae5d6fcd1be5b2620daf5aa6630883bdec360b3cd23b692920473638fb776469908116

Download Submit
C:\Windows\Installer\MSI7C54.tmp

Filesize
89KB

MD5
6112b1d9e72bd9207b780ed43ec82cbc

SHA1
7c785dc16f5ae5a14467ab81b707fd1ce1651228

SHA256
0f22eb6c264464374c6178169a497ceadf2f7721d2341edbf4e6aece11bd5451

SHA512
f6f4d9d0892b0ca22fb2d66825ae7cb2e81900ccf52d0173936a87aadc480a59c37433dae6da390ae9b8dc4a944904f0dc60a85a276e01c2bf10b323c7e4ad00

Download Submit
C:\Windows\Installer\MSI7C54.tmp

Filesize
60KB

MD5
086e1d3e34d973776fc559b2317ccb3c

SHA1
671f6d47ee4b99bebba9413b5cb79583016ee9a5

SHA256
10fb4cdb24c34ca673e6af6332944289eab35361ca4ef65cbdb7f2ad8d368cae

SHA512
4cb72a6610216f923497ddf8dbcd637ad72d3017fd978934bc77069a8bfdee71b027a232fc0b9c9798c6f0892a2509a61ab8d800e124ac3a8f349651c6af3d1e

Download Submit
C:\Windows\Installer\MSI81E4.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\e577b2f.msi

Filesize
2.6MB

MD5
6df86d515d4ee5a6d750554f1f2be34e

SHA1
c5acb228e5759202814131cba628c07e67828c43

SHA256
dddcabece3ba663b8c6ed102594e29f436a13dd76b6c4c490c65c3da9d24d110

SHA512
f70a546fbd508748e517a3082709f96963e6b33bbc97e6f3e37be5faee2db149e70681140e8635765c3cd32063697d440405e40f89220a49b60d467ee8df3b1e

Download Submit
C:\Windows\Installer\e577b30.msi

Filesize
808KB

MD5
8da84e8ad0de2574b6f90cb2d2825ddc

SHA1
76d6b066c5e6d00fefbcade716b8c7516a57022b

SHA256
aec5f0329b10a8fa95f8eb31e1f6882a2ef70d577a122f56afe3ce7ced3c3118

SHA512
1a1192eb5c6c71e50cfcd9fd2a069122467edacf180fb3f5a63b1710f8ab1b3876312769fa45c7c1cb19ad6136c3096fae45cc2250f7ca9b0d9e8f38539c28b6

Download Submit
C:\Windows\Installer\e577b3f.msi

Filesize
1.1MB

MD5
4eea6b8d54d185bc341d06d8fec00263

SHA1
22bb11b9dc8764c86b119df180c26d8016b1c6cf

SHA256
7599e7530ddcbe20e0847849744174e7c9dc573b41a39e30b80a4ca336d032df

SHA512
8b549ac05ab0eee00f59e9087e1fb94755c8e5f6bbb4f558d1e9d7db31218ec1be3273f0309d18bb2c3c7e68600a3436714ed2363ab90743371dfb69726606d9

Download Submit
C:\Windows\Temp\{007D2C8B-2AF1-4D63-B046-684A6209692C}\.cr\windowsdesktop-runtime-7.0.0-win-x64.exe

Filesize
610KB

MD5
2f3c0c475e5482f29856b4581cc0aec0

SHA1
0993859b58412d869d3698fe5d71efb401466901

SHA256
21629bb67fc580f38b2a139489e347ba53674b08cf6d16052a832396ed1a1ca4

SHA512
2d6bbbbf7322a04f729edcfc2831e5b78a5f3b89590476f4a439ee5f4e47ff0efeaaaf02a678b0c78824c218d12ed4f83c5f7ba43b61bb6a5395dbba8b31aee9

Download Submit
C:\Windows\Temp\{C878BD89-9608-49AC-9E1E-4D4D48AEDFF6}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{C878BD89-9608-49AC-9E1E-4D4D48AEDFF6}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{C878BD89-9608-49AC-9E1E-4D4D48AEDFF6}\dotnet_host_7.0.0_win_x64.msi

Filesize
744KB

MD5
e273ccc016d4df27cb4c3a27c88e7579

SHA1
fadb51933a85c83a6beb66120ca70edc30e565be

SHA256
21739522837cde0571faa19ff3ca2c5fc150d52dc02d18b2d03c4d6afe074bc7

SHA512
35f7b9adb7fa1ee89670b8aa06be6ec2853b7feafcdf6a769656b4204be72eb4da1c40af0eec2f0d4875139149e10fb91cbcdaa2223aea80d286af4a1e4fb5db

Download Submit
C:\Windows\Temp\{C878BD89-9608-49AC-9E1E-4D4D48AEDFF6}\dotnet_hostfxr_7.0.0_win_x64.msi

Filesize
641KB

MD5
6030ff0e0758a065c248ddfa79a5ad88

SHA1
d6ccabe666e226401f01f5e659d1c11805de52de

SHA256
967f09a863ff12bdc538a215d4b07f92a4a536e1e1b565e9a1336453765b2bf3

SHA512
2bd6a2524e30b7fe702f419e24d9264154fe60827dc926126739415fa304d1e77a0e51ebb74c72776fd5e100a3258d0f36419bcb8ea6e100e849c0a2e475d38c

Download Submit
C:\Windows\Temp\{C878BD89-9608-49AC-9E1E-4D4D48AEDFF6}\dotnet_runtime_7.0.0_win_x64.msi

Filesize
1.7MB

MD5
d522d28a768de3d3609014aa1ac333a0

SHA1
f31cf3202604c9cbae3938d858e9bc533909b651

SHA256
e289bcdcb66f2bbbdc1871943389d68f10eea66d087eb6a2085e2910747d3f3c

SHA512
03619ab3bed86e0b4a6b503433c4d945833c95a98284038a16acb80b1c7f8562e88c278046659909eb0c273a93aa8c7fe3bcb24543ab5ff4bf7f3436d9e20157

Download Submit
C:\Windows\Temp\{C878BD89-9608-49AC-9E1E-4D4D48AEDFF6}\windowsdesktop_runtime_7.0.0_win_x64.msi

Filesize
756KB

MD5
783e8d1afdf89c602c88c5da305fce3e

SHA1
129937f40664e312ffd71da64da7f30a3890027b

SHA256
6d7ce148214aa7f9b87382155217f0b0d1f422c76b43f0b211c8b611f331c33c

SHA512
7ad35b29f924a6185f1a9712a4575023bd1cd67d82e1dd31010ea9d753ac35c44c7e23cc345ffe2d3124620b5300b137724b9dae7e0e9b5ad51503dd43b70779

Download Submit