a179aae5d667743f7836d419866a3ffcc20b451772d7c373542bc971c777a336

Analysis

max time kernel
248s
max time network
257s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 03:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Kiwi X External/Kiwi X External.exe
Size

321KB
MD5

9fef2a301edbcd80a74670f54a88e41b
SHA1

eb7a5845b2998217f8ebd4ecec4ba554d3edb757
SHA256

02ad64a9b7a3e99337b59f54563082fbc48b26cb796fbe1cd834ce185fd63381
SHA512

afb5badae34091bf88b5e97a1742385cb7ff4839f514ada697da00ea186ee0a9e35c53edcddcabda2a7f4d0cec4e2e53ec897033ec1856c05238efda07fc05c9
SSDEEP

3072:JIl9mTYDNDK36o4zEsb3q3BIIi4bZIYl/I8Z/mKrGqx:JIvK36o44QadTWYl/IK/mKr

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-7.0.16-win-x64.exe

Executes dropped EXE 11 IoCs

pid	Process
5352	windowsdesktop-runtime-7.0.16-win-x64.exe
2656	windowsdesktop-runtime-7.0.16-win-x64.exe
5056	windowsdesktop-runtime-7.0.16-win-x64.exe
5416	windowsdesktop-runtime-7.0.16-win-x64.exe
4000	windowsdesktop-runtime-7.0.16-win-x64.exe
5328	windowsdesktop-runtime-7.0.16-win-x64.exe
2364	windowsdesktop-runtime-7.0.16-win-x64.exe
3520	windowsdesktop-runtime-7.0.16-win-x64.exe
4484	windowsdesktop-runtime-7.0.16-win-x64.exe
5820	windowsdesktop-runtime-7.0.16-win-x64.exe
5856	windowsdesktop-runtime-7.0.16-win-x64.exe

Loads dropped DLL 13 IoCs

pid	Process
5056	windowsdesktop-runtime-7.0.16-win-x64.exe
5416	windowsdesktop-runtime-7.0.16-win-x64.exe
5328	windowsdesktop-runtime-7.0.16-win-x64.exe
4484	windowsdesktop-runtime-7.0.16-win-x64.exe
5820	windowsdesktop-runtime-7.0.16-win-x64.exe
5168	MsiExec.exe
5168	MsiExec.exe
4680	MsiExec.exe
4680	MsiExec.exe
5512	MsiExec.exe
5512	MsiExec.exe
628	MsiExec.exe
628	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef5af41f-d68c-48f7-bfb0-5055718601fc} = "\"C:\\ProgramData\\Package Cache\\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\\windowsdesktop-runtime-7.0.16-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-7.0.16-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll	msiexec.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll	msiexec.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll	msiexec.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI9F44.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9F51D16B-42E8-4A4A-8228-75045541A2AE}	msiexec.exe
File opened for modification	C:\Windows\Installer\e599570.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB59F.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B61D15F98E24A4A42882574055142AEA\56.64.8781\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e59956f.msi	msiexec.exe
File created	C:\Windows\Installer\e599565.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59956a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC89.tmp	msiexec.exe
File created	C:\Windows\Installer\e599560.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e599565.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB2EE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC005.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB785.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B61D15F98E24A4A42882574055142AEA\56.64.8781	msiexec.exe
File opened for modification	C:\Windows\Installer\e599560.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE59.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3D9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB880.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B61D15F98E24A4A42882574055142AEA	msiexec.exe
File created	C:\Windows\Installer\e599574.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICAE3.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA252.tmp	msiexec.exe
File created	C:\Windows\Installer\e599564.msi	msiexec.exe
File created	C:\Windows\Installer\e599569.msi	msiexec.exe
File created	C:\Windows\Installer\e59956a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B61D15F98E24A4A42882574055142AEA\56.64.8781\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAF2.tmp	msiexec.exe
File created	C:\Windows\Installer\e599570.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\Dependents	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\ProductName = "Microsoft .NET Runtime - 7.0.16 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\DisplayName = "Microsoft Windows Desktop Runtime - 7.0.16 (x64)"	windowsdesktop-runtime-7.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0EA7D4ECABCFF6845AF8BD3A26F6EBB4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4A096B1A1834D04ABA4F3A8DCC57E79	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\PackageCode = "4D303290B805CF34A86C47A4FB5AF5B0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\SourceList\PackageName = "windowsdesktop-runtime-7.0.16-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\Version = "7.0.16.33318"	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\ProductName = "Microsoft .NET Host FX Resolver - 7.0.16 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\Dependents\{ef5af41f-d68c-48f7-bfb0-5055718601fc}	windowsdesktop-runtime-7.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_56.64.8804_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D7262B1034480C14790FF927CAF26D0A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64\Version = "56.64.8781"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.64.8781_x64\Version = "56.64.8781"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.64.8781_x64\DisplayName = "Microsoft .NET Host FX Resolver - 7.0.16 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\PackageCode = "81EE9E981EA60964C8935F11B77FED8D"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\ = "{ef5af41f-d68c-48f7-bfb0-5055718601fc}"	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B61D15F98E24A4A42882574055142AEA\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\Dependents	windowsdesktop-runtime-7.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\PackageCode = "74EEF11D81DB3C6458F196B0238079C8"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.64.8781_x64	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\ProductName = "Microsoft .NET Host - 7.0.16 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{9F51D16B-42E8-4A4A-8228-75045541A2AE}v56.64.8781\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.64.8804_x64\ = "{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\170B71A1C66553D5E351152A6AFB2626\D7262B1034480C14790FF927CAF26D0A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\Version = "943727204"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList\PackageName = "dotnet-hostfxr-7.0.16-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4E3F426DBD05F2A509C6867B91443826	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D7262B1034480C14790FF927CAF26D0A\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.64.8804_x64\Dependents	windowsdesktop-runtime-7.0.16-win-x64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 201662.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
1636	msedge.exe
1636	msedge.exe
3020	identity_helper.exe
3020	identity_helper.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
2424	msedge.exe
2424	msedge.exe
5580	msiexec.exe
5580	msiexec.exe
5580	msiexec.exe
5580	msiexec.exe
5580	msiexec.exe
5580	msiexec.exe
5580	msiexec.exe
5580	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSecurityPrivilege	5580	msiexec.exe
Token: SeCreateTokenPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeLockMemoryPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeMachineAccountPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeTcbPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSecurityPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeTakeOwnershipPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeLoadDriverPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSystemProfilePrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSystemtimePrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeProfSingleProcessPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeIncBasePriorityPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeCreatePagefilePrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeCreatePermanentPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeBackupPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeRestorePrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeShutdownPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeDebugPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeAuditPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSystemEnvironmentPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeChangeNotifyPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeRemoteShutdownPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeUndockPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSyncAgentPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeEnableDelegationPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeManageVolumePrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeImpersonatePrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeCreateGlobalPrivilege	5856	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe
Token: SeRestorePrivilege	5580	msiexec.exe
Token: SeTakeOwnershipPrivilege	5580	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1636	1776	Kiwi X External.exe	98
PID 1776 wrote to memory of 1636	1776	Kiwi X External.exe	98
PID 1636 wrote to memory of 4476	1636	msedge.exe	99
PID 1636 wrote to memory of 4476	1636	msedge.exe	99
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 4480	1636	msedge.exe	100
PID 1636 wrote to memory of 3668	1636	msedge.exe	101
PID 1636 wrote to memory of 3668	1636	msedge.exe	101
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102
PID 1636 wrote to memory of 4644	1636	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\Kiwi X External\Kiwi X External.exe
"C:\Users\Admin\AppData\Local\Temp\Kiwi X External\Kiwi X External.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=7.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffba37046f8,0x7ffba3704708,0x7ffba3704718
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
    3⤵
    PID:664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
    3⤵
    PID:828
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2512 /prefetch:8
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:1
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5848 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,5656515575200886811,5122710114077574400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2424
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe"
    3⤵
    - Executes dropped EXE
    PID:5352
  - - C:\Windows\Temp\{6F6BB5EF-5197-483A-ABE4-576C5DF84035}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe
      "C:\Windows\Temp\{6F6BB5EF-5197-483A-ABE4-576C5DF84035}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=576
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5416
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe"
    3⤵
    - Executes dropped EXE
    PID:2656
  - - C:\Windows\Temp\{83212315-A8F0-4035-B2C5-2F0D93991608}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe
      "C:\Windows\Temp\{83212315-A8F0-4035-B2C5-2F0D93991608}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5056
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe"
    3⤵
    - Executes dropped EXE
    PID:4000
  - - C:\Windows\Temp\{35CA4C15-3883-439C-8506-0D935103BC58}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe
      "C:\Windows\Temp\{35CA4C15-3883-439C-8506-0D935103BC58}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5328
    - - C:\Windows\Temp\{546A3500-5973-43E4-82DD-770D7A208A70}\.be\windowsdesktop-runtime-7.0.16-win-x64.exe
        
        "C:\Windows\Temp\{546A3500-5973-43E4-82DD-770D7A208A70}\.be\windowsdesktop-runtime-7.0.16-win-x64.exe" -q -burn.elevated BurnPipe.{BB489256-EEF6-4E1A-AF0C-0C4194D08852} {A204B00B-E394-4D58-9553-AB959240A7CC} 5328
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5856
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe"
    3⤵
    - Executes dropped EXE
    PID:3520
  - - C:\Windows\Temp\{0CA535C3-9EA6-4B1A-89F8-1C013AA63E7C}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe
      "C:\Windows\Temp\{0CA535C3-9EA6-4B1A-89F8-1C013AA63E7C}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4484
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe"
    3⤵
    - Executes dropped EXE
    PID:2364
  - - C:\Windows\Temp\{4FC2D99F-CCE5-46CD-9F52-C9E0D56C4B6A}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe
      "C:\Windows\Temp\{4FC2D99F-CCE5-46CD-9F52-C9E0D56C4B6A}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2924

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5580
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 94838B1BF77D4F37C8064EDE5C77E296
  2⤵
  - Loads dropped DLL
  PID:5168
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EC1B34647102284D102FC7F4D8CA1DDB
  2⤵
  - Loads dropped DLL
  PID:4680
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9E7D100DF0892C2AC571CDE171D753B7
  2⤵
  - Loads dropped DLL
  PID:5512
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FA529ADBF189C6DD0D58B517AA60A9D1
  2⤵
  - Loads dropped DLL
  PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e599563.rbs

Filesize
48KB

MD5
21cbf6a010ab21c1cd5e72cd81e3c738

SHA1
c60d57f37191a5753b598c6d4f87e1cd2765838a

SHA256
9622ede2b40d0ea22cb4e51be8b96226a0b3c3cc36a03e019cfde0a4914318ba

SHA512
0b686e693f9f11ce0f7b0ebcb45280fc9140eb0150c85b59d172b81ddbfa0fde066419d11575b105b0b04171f4fa103f296542dd28e2679b1a4d479fc30829b9

Download Submit
C:\Config.Msi\e599568.rbs

Filesize
9KB

MD5
14b3a92ce4a5a5c182415697827b8f50

SHA1
0251fff6e772dbaaebc44db39905a7f70a2da5bf

SHA256
a53387a10fe4af17a1815072a32aed723c23553156b762e2038278bf2b7e9b00

SHA512
b4193662ab3efc8f69fd6fb79187a6b4330e13023ca94df72dbc1c650bea22872b22b2a82938b6b8b2cbc0d691115bb9070fea6bee1759d1cd2c59bbdfb227f3

Download Submit
C:\Config.Msi\e59956d.rbs

Filesize
10KB

MD5
c5567f5dfe429b7966b97f498a67e8b6

SHA1
4bf5b7f8f90d213f2c7ab24a9d53bfb084d15e70

SHA256
85a597172f0f56b7a8a44e07fc8e6a5b4bf5f4a8169523b43d3821a943154484

SHA512
af18cf087a609f2992611736752e7ad2620b2a72fb23abca78790b586cbaa9e903654e11d39995b3d88bb3d5c78248d3211609259f9022fd48e7a97cdeed3a0a

Download Submit
C:\Config.Msi\e599573.rbs

Filesize
88KB

MD5
5ed982f6f8b36615743e9dac31a27d00

SHA1
fd30838ceb9a004b90d9f0a099436988e13f8463

SHA256
6e7fa4a60357cdf68b9a677833f13b025668c4d6956c3e5c34f5cb92fde36920

SHA512
4e76d3f85e51c696d1fb10aca1eecb7b83cd14e019c52f766fa9e1458dfe2917980fa2d0522139493cf1f480c59cd47c33b1174580b2f6028f76c9910137f636

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
85KB

MD5
5c13a5ea8c8cc3474240981d0ffa88ff

SHA1
1d8d3ce27d9dc3d9fb4fa4b06c20137d25879d80

SHA256
4f9bb3901879bafae3a17c6c4009ee5c15384a06fc234bed78937969079c77da

SHA512
32ea79ff5194d8a18e75f277aed5610b4955db15b0abbcc2664cf07f372bebfc57eb665ad078dc3da3ce5ee0d8856140c2a1bc7032b578dd103d43998d682d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
6f4f16e450a2735a38590e1b251c32e9

SHA1
f9be3098acad153455232f074271be425d24c6ef

SHA256
6ab79f7e4ffaf6ec659f19e670d3b1c29ad2c48744fc5f7fd9e217bab7023566

SHA512
baf0d67aa4d45b3702b25a586bbfc07162500deb2e6541d8ea139e16d57466cb4e16b9bada6281a2707c8de6cbe553ee83175ce030352084be532edf4dd8db56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
cd14e3167d4955aba0249b8b8cb1f102

SHA1
d9c751394a1fa1ed29bbc50fbf902b32e14e2500

SHA256
cf125595c1680cfcd83483b096ec3f3646045defe22a7ca6e24391957aff59f0

SHA512
a5fd9f3b97a80a0a135bf0ade46b88e136fd41445d77a70fc73dd500bc104a4f751c3405b467b47c4859e4e9bd6c9e4242ba5f0f20fb103aa2c10a1709e6a877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c08f63f27bbd254f55136ea2ee12309

SHA1
fb776f5f2b4e844d639009a06a0c1d82c63b449b

SHA256
85241c131ae75b456feed46d3fb9c562f8a2e2b56052e9fb25202bc998579642

SHA512
9d2b1eb2e18ac5d22a048f30d483c40bf696ed0baeac4c2f2f5cbc548a0bbd5120a63613204b62cfe543f942f7fc21608b6fbf65d898d5b6494ec6a843289b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e35f9eb4b6c215f267fc16673b331214

SHA1
d2cdca2872ef6973b5bed4346120e670b1650a4e

SHA256
e28e2a1f519694ebbcc5b500ce5ee4987fa737a230b652155ff27b1056e0e5b7

SHA512
50d06b9b32dcedb929326d37037eb2a2f442ec45b41d22f9048509fa2259dd1d0befcc345dd9bdabe19cb39ddecc34d0a2b5a5cee47c58241684ded90af2286c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cf8a74e1d44fd26668a2995528bb9c44

SHA1
56e94c137b7be806f1d589b56eb4f0834c0cda65

SHA256
9b3723c93656c74a2c4c1d0fc321986a1b0bc0765975fb994952975028a6107e

SHA512
30efb9b5ff3a08b901d26deb9c0196e0c9b23bcfe47512fb246722066ea9c4b6c3632b96d2f856076b33aae62cb1707f1fd5f2b4e2deddfc7bb0e3271cc4f0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
a145eee50b282c7be836a395b4cd710e

SHA1
d6b6050b1d0e390d87a6927c67562740a09e72ae

SHA256
55d48dbef1f9584b9659ea3b3e04a0082cb14982989bf8c4ce155357fe3ea728

SHA512
3cfb87cb87d79bb161d99da3de37bdba1f5be6a3f40a14ad2b79235be18f38dc70d591012d9cb08648d40671eecbc57421491585e9877b7b989560fd785f6e70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
a43d7dd463aefc2dcb5682dc51d29b1e

SHA1
db12b0c430dfcc3ac1f8ece7fa5bcda9bae8d56d

SHA256
db230ab030846ec715b9a826a4a02ac10516215791c93ee1cbaed99765dc1abf

SHA512
c02adfb5e34bdf023108cd1308c25b77e2d4aa77694e806d2c4f30f26aa0acf3e410c15b2a6da364da919b1c31411e2f5c1432c1f6a04b3c98d9d2bdcc285c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
00360dadd5978f2c0ad61bc006707820

SHA1
31c9a120a546d16c61b6ab95af0ecf44a42cc609

SHA256
d172f88d804419071653216e49e0f3921e26ae4bd2e43c0563f2038f8d78f9a1

SHA512
fd079a198c9eeb7761d019c7e5e6c40e7649720cf19427b6f76835214d1888ee07a1fee35eaad5116a59a04bb34dac4e63d3cb0ef2ab900ed2b4e4208600ade1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
7aef0b39ff2334360c5915c70bd1e2b9

SHA1
d73c78859d06a084396896014971131dea6ebc22

SHA256
670becf7d31670c3d05d1962f1b82bb8593150df8adf58f05a6de97e426dee49

SHA512
fe18cc9cc2ab2469132f3e9d528310516b360d4b2cd3783964d08b0e78e8ed880c9cdfc77d0c29096a9b5f561f33072108ebc7cc96e9399f8df1f50f54ee1367

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bc7a.TMP

Filesize
539B

MD5
957c5dda9dcd59e3977d898b03247ffc

SHA1
596d45a73aab0dc221c504848c15a02cd5118822

SHA256
36ec769166f462d35c1cdf0da631cbc137dda71e8eba933c8868b8a6b86a011a

SHA512
34305eea3cb7ab4db469eab1036509a82709b40495d6c61d9c2170b94d701e310102db90c5a700087a4b4ec17ca59f4d6ddc41c51952533b18b13e5524508dce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
69c4798bc461c115cca1cd986cb5b33e

SHA1
0b625d46343107ec98a25a962d339e194afbeb0f

SHA256
1a421e3f5c4c9b2824661ddf1f80739c67b2388f599d33b94f994e0071bd77a8

SHA512
1b72ef5ce3f8d5f693cad01a0e351eba7702b927278efafb8db5e2349f9ed70f74d9f77acb2d8885f0179db45738b38eb149e9f12efc06e749cbb9738af634d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b6961db2-8c7b-4f5e-9d4c-5e52b526d678.tmp

Filesize
11KB

MD5
fcb6fc228d7e1da145bb6260e7a04529

SHA1
27cff3c4029572a5ff476dc22711b5e4ade8cab7

SHA256
27b28f1053c2694f662dabccf34e61e67effb8d939137efb987a18ff2d8c6824

SHA512
fdd3c7b0cbbd5750da68c77afa1e5ebede97259cf3f0a8ba117e70c68ebcf5ef168835ecdea4ccd8378708f847c698ea9747cf73bc85df8b876eeb854995cce8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240307032529_000_dotnet_runtime_7.0.16_win_x64.msi.log

Filesize
4KB

MD5
b005fb113748af01ce21543193ba59f9

SHA1
ef7e0cd6bb90406d1b9506adc91e9a57f762b9f7

SHA256
ca9055096ae7380c93516f821189f6445901b05324d1b7bf30bbcf6f0482f197

SHA512
e5c8f167000ad69d3a7789e5be4cfe8a3d1e16c86ca525c834c0ec635aff478e96dd2cd0f05419db78515e1744b5b5abe99aadc10314850e31d3efda1240bc08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240307032529_001_dotnet_hostfxr_7.0.16_win_x64.msi.log

Filesize
2KB

MD5
6fad1f1dfc9415e0d47153805da1ff9c

SHA1
5b2fcb17cf00237dc7a88ffabbf7ece56c26087b

SHA256
72e6dbc781153548152a4306a7f0e5c0d38186a9ad1127f304a0e82f33ec2bf8

SHA512
0c477e3840aa76ec1757bc41575b0c9dd7d9f67fbab22ea6d369028198e39dcd1a5db4a7f4106d762b636d91dd97f917ebcacccfec68d5ca8323a9fb06df0e10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240307032529_002_dotnet_host_7.0.16_win_x64.msi.log

Filesize
2KB

MD5
db0c5f1feefd56403748efeac1f089a2

SHA1
73aa3317b9a6df4dc0497846923987b870f024dc

SHA256
c134702751eb32025a214336f7b8528e9a637da1599f97c74d9b5481bed92fbf

SHA512
c02797c60ab55ade3f77d9bbc7af434429983779982d2817d31c8901d35d66267d86d111432c584cb94d44985c966a8d42aec2a4aae71e6bf9f3a593e34539c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240307032529_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log

Filesize
2KB

MD5
ca52d722d167c6399ad987a9e220ce43

SHA1
13e84103d862fea01971b584e907a8fa20298cd4

SHA256
356776bc1cf07d55bfc0a8746a3d83ccfd3abeeb645968ffafb0d306c4c0c49a

SHA512
caf72df8a16f5a60cc3e622b9d2fa1898c1596136b8dc13d566fcd87a80b2277b1d234729c68f82bfc4d700985ccfde2c9ddcba5ef54a1db0d9361d36eb11a7c

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
55.2MB

MD5
cc630e12e13866026972810cc3191d3e

SHA1
6209861d147e86165af5424e5892b991f98329cf

SHA256
61a42e47f5698dddd6afc08a771043d07c39507be0251ca094eb7ed69d0368b1

SHA512
695ee6ba6002e91936c04d5be5eff620968b1846ba3effa659aa724b6e53aadc57ddddfe07256721a461ffc6363ce5634a962f5e84a1b899a57e1325a5819af5

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
10.3MB

MD5
29d284efaa2591ebd15ac0f668631a7a

SHA1
387c5c471558ba044499c5277a314ac21e482d52

SHA256
714ad72ad93867af58f476c2510806b636e1e3027fc75590736a50f51a8b0f04

SHA512
379df1bacd6d943c72cacb32de2aaa0c3a4424b056c07fb8e8dc7446ece51e36e6be401aaad4492d8457b2e5fb76f5f00f8d872f33759de04643db4dad25e3cf

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
6.1MB

MD5
0b4703cb008d753fdeb8e426d0a9b783

SHA1
018ab6fa24404986a331e6769b02944cf9733c37

SHA256
1bf0e4f8e823b2a17fc5d4430ee5551518b12ca6c7a9bcfbc02d2161f81607a2

SHA512
7226cc26c815df3186313003ecadf4c1a4ae432cebab6388fa7f5a3aa9254d03974592dd0169fe7f0b6bddcc6e6947eaa64a8b4f726feb3085b364bba7406908

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
2.8MB

MD5
4f08496c21322e144e15616d7207bc65

SHA1
587b29210954d45c68d131e77fe0ebb066e36e8d

SHA256
be8f57afc8cfca21e73a891651ca7b1d9e726196797978503805aace74fba6f3

SHA512
9912c0ff4f6d33d8d3b9ee8121be823be7bf865c18c23a79aed1000e7fe4291c1fc41ab682f6cae08863339a63bd1604f0475070b7b8d710e87e726e88c3b82b

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
4.4MB

MD5
6deb3672053d3843a56a4af708f63bc9

SHA1
7cb22aaca6f37619a262683d87170967fc952bd0

SHA256
e5e4783071fa129ac4c99c4127ed90eca200a94671c12aa23673e99c2e3248c5

SHA512
a2809f7bd159e310fdab54d65ea59820b87ca94e2271df0b34046e0f93612e2fec2358653dad54b7424a07735e862c3daecae7d28606c5f3e92783c2f898e439

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
960KB

MD5
5c8d673258ca1d990f8acee1890ca262

SHA1
58a6888f4f1f4e277a65c651c7c8a12ca5acb29e

SHA256
c01676bd86d1dfef1f06a86d0f069b17c5849ed750bfe14d05c5ca508ab9d780

SHA512
b144346b1cc5c3062d0832fcf7e1b869b7a0f689a5108d2ce3ab45649c7d769dd06d1385e6df8abeb4cd307d7a1f336dd654244541da0d44a612cd1d5d5dce60

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
896KB

MD5
2847d5956fa4f859053eb622e2a32c86

SHA1
2e245ec97aeaf80b43521e84e7f44fa86258f64f

SHA256
08e4f7b37bb38c7f9ed8db8b2c7b69825b1dab4f903e45eaf4211dfa7abadddb

SHA512
8d3377fa979558edc6ae83f55ee6922013b569f3f1ee5bee314d2c90a7ab056114127a0df99c203010aa1337275b36dd1e7aabb1540d3669785f2518feaccc80

Download Submit
C:\Windows\Installer\MSI9F44.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\e599564.msi

Filesize
12.7MB

MD5
39e9d307bb5ae90c94b80e832037af86

SHA1
87ba39b15f6025451de9cf60f07534b7a7616fe3

SHA256
9ab16592f2740d3d6d5368525d6758eb23770265f437888d7bfac3bc41266bbb

SHA512
ab5da3cf1b5d6a674bb40fbf4939b81a7a18886e01424aeb453fecc3e955a7ce6d493683b10cfd8fe383d9a11580d2d73b412c4a4d01e7f156417f323fbd8c39

Download Submit
C:\Windows\Installer\e599574.msi

Filesize
28.8MB

MD5
d079a220fbf02ab89e53ac56efc42cd4

SHA1
8a42d27748dd07d46def2045f3ea8ca9c8388ba3

SHA256
0184e4536db8bd0a57cd2f80946ed435339e1977494488ca66dcf5454fc4ed03

SHA512
7aad48a392168911f131e4270c64a0eb05902434b6dce9821c216c6544e91b25d90efda366e9c376ee9c25d9fb9431f61428ee3b05b053d8eb015cd2b8ad8bea

Download Submit
C:\Windows\Temp\{4FC2D99F-CCE5-46CD-9F52-C9E0D56C4B6A}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
384KB

MD5
319dc1759e128d8864d7c248e4ddd553

SHA1
6ebd4a0b5aef106fc9d200bb97d9f286e4c58208

SHA256
b7c6e6d61dc166c627425c5c20d7986d9fb8bf41fdcef875253c6d28ef735791

SHA512
c8bfd9fe82ad4516196c07bed0efedd5f0e4325997362666872d5804f8a90faae4b5caa33664ee019900815ea7b7c62b5c6f9829ff70aeddfdbced75f7b08534

Download Submit
C:\Windows\Temp\{4FC2D99F-CCE5-46CD-9F52-C9E0D56C4B6A}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
448KB

MD5
174eceba3c47514b6de78bb445f69aa8

SHA1
e5b607e44fb7759d40bbddb2fd195dc922d0ec36

SHA256
9d57f78ab2659bf0e82728f7a7796e0c0ecdff156b063111aa8e2b923fb03a8d

SHA512
095d8153a2ecd127b724bf18a4bcab5e02cf96afd830ed003e08bf837ebe6f8a1260bfa465daec4e10a1d3094ed874cab253fe04ef6887b3aff22c7882a54e15

Download Submit
C:\Windows\Temp\{546A3500-5973-43E4-82DD-770D7A208A70}\.ba\BootstrapperApplicationData.xml

Filesize
7KB

MD5
96fe2dca74f67c0338359a34b26a1179

SHA1
f00bc9329d4dff52ec0d41c817f80a6bbb7dad81

SHA256
149388c60d883f56ae0d11eeffe4f8265d140af750f16ab24c4fe2979d12ca94

SHA512
cf16947fa585bb2bedd04e663f083c3c24a6fbe934599fd8cdc6dd2bed83ff0d4c71a01bdc4f4e3859bab6a6a3aedaed593744f1ba3344f1b7923d5413648f06

Download Submit
C:\Windows\Temp\{546A3500-5973-43E4-82DD-770D7A208A70}\.ba\thm.xml

Filesize
11KB

MD5
302563a713b142ee41b59e3eeac53a90

SHA1
1340e90cc3c6c5fc19a7feb61d7779f4a4f0fdb5

SHA256
83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63

SHA512
c9d4dfc20802bb542178300d1044bb94b35593b834ab0b50875a32953f890e48da456199128500e2c1fee26eaaf8c2c4fcaffb308b37914215f900cdd5c4cbc8

Download Submit
C:\Windows\Temp\{546A3500-5973-43E4-82DD-770D7A208A70}\dotnet_host_7.0.16_win_x64.msi

Filesize
744KB

MD5
a1f68b5ec6da37ffc65f12f106d70f3d

SHA1
1bef05fa3f179a9ad079326a5a38b7728a81967c

SHA256
7c01b2af6cd178d88dc11b2c12840beb0b08f8dc4e8958ba8d7166759e0c64b8

SHA512
0dc65ee5f8a4720012e678dbeaaa44df10e12ad7941f4835c37a0d178abb7f282d0ee13e7b45fc56141489826c3c980020179ffb5973989a463f4aeacd188a93

Download Submit
C:\Windows\Temp\{546A3500-5973-43E4-82DD-770D7A208A70}\dotnet_hostfxr_7.0.16_win_x64.msi

Filesize
804KB

MD5
3db1b0ad874499a5bd80b9ad2ed2103f

SHA1
77f02d58918daa3cb25364960a1196ce2f711d0f

SHA256
7b32cfc57dae7fe08f7ed00d54771107aeb4b80305a7269f6b9ac2cb19710c35

SHA512
e2214799e8febb31e2dadeef8904e5692fb94f916500960642b780a4b68f9bd2d8d7e62d579418bcced9a7b0f7ff958e672783fc019617d17499e8c5e1b777e1

Download Submit
C:\Windows\Temp\{546A3500-5973-43E4-82DD-770D7A208A70}\dotnet_runtime_7.0.16_win_x64.msi

Filesize
11.1MB

MD5
7e95c981c6e913d2fdd09a77d127eeac

SHA1
ed4ad0e3874e0fe62f4a2d75885fd8ce2479745e

SHA256
21ae284bdf1152a36140ab00693acf50f63a7ee2a0bcf2dcabec744ce13166e1

SHA512
d4bf7f5ec0fc9cec6cb95a20c61962509082d8009158d715b1ccd1ea07d84f7a63b595686eee9f8d4989258e1cf31536bc8536adfad678f69b7412f5a13de55b

Download Submit
C:\Windows\Temp\{546A3500-5973-43E4-82DD-770D7A208A70}\windowsdesktop_runtime_7.0.16_win_x64.msi

Filesize
9.5MB

MD5
99eb02602d5628f63d83e33371c30749

SHA1
65b5f08b78fd5927678be35a0290f975c55267b4

SHA256
590d848328f3e8a58f2f211a8d57c8606c6733e2b440a88a6cafa6e3102acf65

SHA512
0bfd217d57496fd2b0348d71a0651f3e141699bd2f1bf519798898f39fca3b943ff1f5419b322b4ffea37b02b489d47b650d46030a88a5335259a46344acceff

Download Submit
C:\Windows\Temp\{83212315-A8F0-4035-B2C5-2F0D93991608}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
610KB

MD5
9656c3086081a41540338b94df6ae084

SHA1
dc87b2d0dde3604437d13d2f89fe9ecb7c7b0373

SHA256
6a7a85e1b9e899ce83ca29eca2e0b34126acf97675991b431b279278a03c41f2

SHA512
7bdfc5943968403b787700f5c4e12d88f34bdca4569fbff21e178c17eba40f8db68135aaf426b990617316c10b86687a08375c611c4a9e5a8db8eb2c2be3e9cc

Download Submit
C:\Windows\Temp\{8C69760E-40B7-42E7-ABE0-2F592AAB4EF8}\.ba\1033\thm.wxl

Filesize
5KB

MD5
d5070cb3387a0a22b7046ae5ab53f371

SHA1
bc9da146a42bbf9496de059ac576869004702a97

SHA256
81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a

SHA512
8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3

Download Submit
C:\Windows\Temp\{8C69760E-40B7-42E7-ABE0-2F592AAB4EF8}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{8C69760E-40B7-42E7-ABE0-2F592AAB4EF8}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{D6B586E6-3315-4EC2-BF8D-DFA6F798D77B}\.ba\1028\thm.wxl

Filesize
5KB

MD5
b9428c94444693b5e3a392c8d0b95170

SHA1
0fb22d01f1c11cf74e844c19c96c41b1c0515d71

SHA256
c0413edfd13fd27eeab7b8ce60963668236466c48f4173c29f84093011c281af

SHA512
70212889f8f8a070fbcc81ef6121999518f2bc7ef369e2a38b3f0f825870e88b9327f837de884c52e6ac0a1c750f07121cd17edc2e932c993c73a43275ac1180

Download Submit
C:\Windows\Temp\{D6B586E6-3315-4EC2-BF8D-DFA6F798D77B}\.ba\1029\thm.wxl

Filesize
6KB

MD5
27411946ef45b3b8236319421770e5ad

SHA1
d00d3e2d4fa3429f2578325de364dfcce51d8fd4

SHA256
c92d3efd72d6d14148f9931128ee4143affd1da517eb358ab88ed4138c1434a4

SHA512
ff24b47504d6e752f1fa5bd388da75338078f72b5d17094d2bc9426b35a55de097629c3ec53356723253a8d7373dcb2b2d921bdf0be6fd4a524c9aa8913277eb

Download Submit
C:\Windows\Temp\{D6B586E6-3315-4EC2-BF8D-DFA6F798D77B}\.ba\1031\thm.wxl

Filesize
6KB

MD5
b45249a2238a5568b377e58d4ce89e9a

SHA1
57a68133af7ef4062559d9144d9cda4aa28722fb

SHA256
0c4203a81dcd01d53378036af78cffcf9e9a5af7754dfbdd56584ae74c21cc61

SHA512
6485548b9f4e0cdbd2876b0fc4dca5c125d260e237e994ee67823edc72c358cdad4e1170df62e67a0d1249f54ee6bea26741cbf8eafe952154e182008f31665b

Download Submit
C:\Windows\Temp\{D6B586E6-3315-4EC2-BF8D-DFA6F798D77B}\.ba\1036\thm.wxl

Filesize
6KB

MD5
9f779700ff90df7211ae3a3340ddd5fc

SHA1
a4e05d7a489b095af4805660d7bab4f2da3af34c

SHA256
6af5c2bc88b1e5ce188a97dd9204061d66369ec2689b3657aff1dc6188f44f22

SHA512
5dca90fdb1b498bc982cc8489dd13ed492a7856b701d9fb43d46ef01d40b49d9888e7ac35bb5962dcf72241f05a4e006130f94372a7c4d7542b708e71b0663a4

Download Submit
C:\Windows\Temp\{D6B586E6-3315-4EC2-BF8D-DFA6F798D77B}\.ba\1040\thm.wxl

Filesize
6KB

MD5
347be63418f507e7f2a086726e96fca8

SHA1
e42e9ebfa654134cf243841beed2370ba12a627d

SHA256
344acd0d3665ba489eb30ebc0f902c625e1ad33a4e2b5ba7cdd7e463658d5557

SHA512
3bba2e5a3f5407274eddb076702e640646dfc7ef43ad9f08c05e99f0ecca67e6f9de2dbe4e3743a74107165b935d36c979cee23a22adcf6139d5bec47b541325

Download Submit
C:\Windows\Temp\{D6B586E6-3315-4EC2-BF8D-DFA6F798D77B}\.ba\1041\thm.wxl

Filesize
6KB

MD5
e5fd798d4bbdd419a602423a699e2854

SHA1
2ece478d5ce4de0c0a864f14cea6bd365f008d81

SHA256
00aec52b4564bc07302881fcfd510f7cca535ac9e05cfd95a86738171626f6c4

SHA512
ab3b93b635211f112d8d820861fe77e9d7c67018688a6a2a1b82532ea9a97609f02e7e9b0dc658202ce0441554a3cb2622f6edc61456e0d250aa8f3df4bcbbf5

Download Submit
C:\Windows\Temp\{D6B586E6-3315-4EC2-BF8D-DFA6F798D77B}\.ba\1042\thm.wxl

Filesize
6KB

MD5
f59a0369a337b58a797ddbb5ebbdcadc

SHA1
4e6c9501ed901b5c1d4b6713a632e899d223679b

SHA256
1b1b0700aa6677afe3581b8b3f4934bf85f4750c544a108e1d5f1b688078e1cf

SHA512
b12134295dddf5fc4f63e23c98c837aa02e5fcff5191087fdc7c0b044f472487987966282b8955421dbfd480707305e0e7af65f307655f876615ab36c24786b8

Download Submit
C:\Windows\Temp\{D6B586E6-3315-4EC2-BF8D-DFA6F798D77B}\.ba\1045\thm.wxl

Filesize
6KB

MD5
8cfbee02f1c88567cd9aa747ff27182e

SHA1
ed18f294ec1e36629900db42797f1499db080f4f

SHA256
d92b3838de7a1685ccbd04fc9c123704fbd198bfd284d8faece4a3663494e75a

SHA512
63c53c29382badb2aecfb67284755cae978af114f957a1b3466b91de8559d6dd4b2bd4b993589e3ad25ab316e90d2c99479a4589057dc8b80c88bb552e7ea519

Download Submit
C:\Windows\Temp\{D6B586E6-3315-4EC2-BF8D-DFA6F798D77B}\.ba\1046\thm.wxl

Filesize
5KB

MD5
88cb193f0b0c15023d789e0f8fce3e03

SHA1
38e1390a410d751c6376f5e23a0933fa08c8aec5

SHA256
4d6a2d306abe77e7dbdb2609f6198b4cf99b3f9dc15b9dc72951592ad2f64384

SHA512
b894e05c79c95d03481211de8fcde00d79767ad3b3483ac95d8b16421d719473d7a9829d996b60ec1abc3830048feea1cf49bacaaa3adda0dfd5971ec2ea5f1a

Download Submit
C:\Windows\Temp\{D6B586E6-3315-4EC2-BF8D-DFA6F798D77B}\.ba\1049\thm.wxl

Filesize
7KB

MD5
1d628f2e1dbaa25bdd8cf2d7f2a9caf2

SHA1
5c4f2a69772a20088779e7288fb37cfb6eaf4c42

SHA256
c7cc8e0bdd4f82da33984f553b576412df69c5e1e5b8479542d024cb6b41d050

SHA512
f6d3969f48b42a2f6eed8efda3a9eb5f5d9a4b69c6039bd7eb72cdb1e01b2c69dc4becaa8133b7ddd7a6325cbb17bc56fb11bafa7fadfd1afa9a84b6fe3ca0ec

Download Submit
C:\Windows\Temp\{D6B586E6-3315-4EC2-BF8D-DFA6F798D77B}\.ba\1055\thm.wxl

Filesize
6KB

MD5
2897baec061b9a89661744685fe3c217

SHA1
904753d6daf2ee3a05319f045e4f2028a8ab576c

SHA256
285e32e649eb71a68f29bca7321a6cade50d79f94dd89e50ece1197dd70e7633

SHA512
574f3fec930cf960dd9725ce1298501d7ad88ac59efcfb61032a2c3f3bbb12ef91bbc1ca63d1516dad93fa202c25655754ae1c5bc6607b5ca7a0209f7a55576e

Download Submit
C:\Windows\Temp\{D6B586E6-3315-4EC2-BF8D-DFA6F798D77B}\.ba\2052\thm.wxl

Filesize
5KB

MD5
ed946a363e47dcc77017ec10b1032c54

SHA1
c37b26426b51f9e5f405ef7798833fc017e653d4

SHA256
3bb9ce59ba1c4b76fa6b35f544e2b04c85387053edd8b25d8c8d4fe637fb0a85

SHA512
fc65e04a87e5add299b71f1332d47f9e4d46f7f97139bbaf101ce0a1d7df9d7db8c33e4625ca9748c7607f4d43ff93e612b57acd38dd5264fc6924446bf881be

Download Submit
C:\Windows\Temp\{D6B586E6-3315-4EC2-BF8D-DFA6F798D77B}\.ba\3082\thm.wxl

Filesize
5KB

MD5
1474c297b47c24d9e8e937ccbf50c4b2

SHA1
012226924911c23dcc220bd653c329a304b2ba58

SHA256
fab76fa9382a7793309c9b07d5baaa3efd8553172d46f8b69e22e30b635bb146

SHA512
3428682ed3ec803e709b30251c4233db7c825eefbfd718777211b6b80cd5ee36cba1d08850e6294d4c4148e8d640171fd62764cbedd7c9ac3bd628b48bf010f5

Download Submit
C:\Windows\Temp\{D6B586E6-3315-4EC2-BF8D-DFA6F798D77B}\.ba\eula.rtf

Filesize
46KB

MD5
cc06442cfc33d0ae6509143325c05110

SHA1
fc635958a57b88f63545cbee1a37e3458cc547b0

SHA256
72f2e7b06c562f1dd6cb3f6efdccd9ae620a183e598856ab3cba6d712254824a

SHA512
4d8a79347104501d89150a738de24f700dc5d54d7cb05359c853a1189bf12b42e53b9e0b0d4a963c6aaa027d46d80a01ab2740bee5d145c3597f1a7efb48d4a9

Download Submit