a96d53be05f9e323bfcb590c05844e16c2bc4965ecfa82e7d6c4b61009afa963

Resubmissions

07-05-2024 17:28

240507-v1zyvagc3x 8

07-05-2024 17:25

240507-vznt7agb7s 4

Analysis

max time kernel
147s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
07-05-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

reWASD720-9014.exe
Size

28.6MB
MD5

e0a1e477533863ba0fd9a52c9c019c3f
SHA1

3a0f67d0dda47493fad9923d355cfe9609d25f01
SHA256

a96d53be05f9e323bfcb590c05844e16c2bc4965ecfa82e7d6c4b61009afa963
SHA512

8c959c5255dbb8d59288b869c5f151740744fd10b5ea513178aae6d5f2dad009e63a7e518c8cee53ef7fafe79efdb9dbec3c678ef0ba6c55eaf1e27f0267d981
SSDEEP

786432:cb5tGlzdlWhFVqxZCf39KtOq1zU3Olf36LvHb+UtpFhA:c1YjWhixZCsOq1zaOxCvHbhZA

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\hidgamemap.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET9DEC.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET9DEC.tmp	DrvInst.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{2907caa8-4808-4b6b-b7e7-fb8c862823d2} = "\"C:\\ProgramData\\Package Cache\\{2907caa8-4808-4b6b-b7e7-fb8c862823d2}\\windowsdesktop-runtime-8.0.3-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-8.0.3-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{27b7a489-233a-488c-b81b-0cb173d4cd15} = "\"C:\\ProgramData\\Package Cache\\{27b7a489-233a-488c-b81b-0cb173d4cd15}\\AspNetCoreSharedFrameworkBundle-x86.exe\" /burn.runonce"	AspNetCoreSharedFrameworkBundle-x86.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\Windows\CurrentVersion\Run\reWASD Engine = "\"C:\\Program Files\\reWASD\\reWASDEngine.exe\""	reWASD720-9014.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	4552	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3984	netsh.exe
580	netsh.exe
4780	netsh.exe
4576	netsh.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4fea51e5-5dc8-5745-ab75-bd51d99d6e3b}\SET9CA4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hidgamemap.inf_amd64_8845ef358c3bc3e6\hidgamemap.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{194bfc0d-7a3a-0545-b204-6c8607d6811f}\SET9F24.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_d34968d7b3e6da21\ndiscap.PNF	reWASDService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_10acfa4b924dd181\netnb.PNF	reWASDService.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4fea51e5-5dc8-5745-ab75-bd51d99d6e3b}\SET9CB4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidgameflt.inf_amd64_8e66fed848d4cd22\hidgameflt.PNF	reWASDService.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4fea51e5-5dc8-5745-ab75-bd51d99d6e3b}\SET9CB5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hidgamemap.inf_amd64_8845ef358c3bc3e6\hidgamemap.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_3debe5e78bab1bca\netbrdg.PNF	reWASDService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_56c163d21e8c2b62\netserv.PNF	reWASDService.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidgamemap.inf_amd64_8845ef358c3bc3e6\hidgamemap.PNF	reWASDService.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{194bfc0d-7a3a-0545-b204-6c8607d6811f}\hidgameflt.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{194bfc0d-7a3a-0545-b204-6c8607d6811f}\hidgameflt.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\wfpcapture.PNF	reWASDService.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4fea51e5-5dc8-5745-ab75-bd51d99d6e3b}\hidgamemap.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4fea51e5-5dc8-5745-ab75-bd51d99d6e3b}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{194bfc0d-7a3a-0545-b204-6c8607d6811f}\SET9F25.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hidgameflt.inf_amd64_8e66fed848d4cd22\hidgameflt.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_72f156a5ee3f59e8\netrass.PNF	reWASDService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_8074ac14f1ab2957\netpacer.PNF	reWASDService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_0525128a3d54207e\netnwifi.PNF	reWASDService.exe
File created	C:\Windows\System32\DriverStore\Temp\{4fea51e5-5dc8-5745-ab75-bd51d99d6e3b}\SET9CA4.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4fea51e5-5dc8-5745-ab75-bd51d99d6e3b}\SET9CB4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hidgameflt.inf_amd64_8e66fed848d4cd22\hidgameflt.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{194bfc0d-7a3a-0545-b204-6c8607d6811f}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4fea51e5-5dc8-5745-ab75-bd51d99d6e3b}\hidgamemap.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{194bfc0d-7a3a-0545-b204-6c8607d6811f}\SET9F24.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_882899f2b1006416\netvwififlt.PNF	reWASDService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_bc519c177a90877a\c_netservice.PNF	reWASDService.exe
File created	C:\Windows\System32\DriverStore\Temp\{4fea51e5-5dc8-5745-ab75-bd51d99d6e3b}\SET9CB5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4fea51e5-5dc8-5745-ab75-bd51d99d6e3b}\hidgamemap.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hidgamemap.inf_amd64_8845ef358c3bc3e6\hidgamemap.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{194bfc0d-7a3a-0545-b204-6c8607d6811f}\SET9F25.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\zh-Hans\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\PresentationFramework-SystemDrawing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\ja\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\fr\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.Mvc.RazorPages.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Private.CoreLib.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\mscordbi.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.Diagnostics.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\es\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\pt-BR\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\de\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\ko\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.Extensions.Configuration.Json.dll	msiexec.exe
File created	C:\Program Files\reWASD\reWASDUACHelper.runtimeconfig.json	reWASD720-9014.exe
File created	C:\Program Files\reWASD\avrdude\avrdude.conf	reWASD720-9014.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.IO.Compression.Native.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\PresentationCore.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\cs\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\fr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.Extensions.Diagnostics.HealthChecks.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.WebUtilities.dll	msiexec.exe
File created	C:\Program Files\reWASD\CoreWCF.NetFramingBase.dll	reWASD720-9014.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\ko\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\Microsoft.WindowsDesktop.App.deps.json	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\ko\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\reWASD\reWASDEngine.exe	reWASD720-9014.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\coreclr.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.ComponentModel.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\es\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\WindowsFormsIntegration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Web.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Net.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\de\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.Extensions.Caching.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.Server.Kestrel.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.Authentication.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\Microsoft.VisualBasic.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\pl\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\cs\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\zh-Hans\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\mscorrc.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.ServiceModel.Web.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\de\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\it\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\pl\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.Extensions.Diagnostics.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.Extensions.Options.DataAnnotations.dll	msiexec.exe
File created	C:\Program Files\reWASD\reWASDCommandLine.exe	reWASD720-9014.exe
File created	C:\Program Files\reWASD\LangResources\UKR.dll	reWASD720-9014.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Net.ServicePoint.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\cs\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\ru\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\cs\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\Microsoft.Win32.SystemEvents.dll	msiexec.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5960c9.msi	msiexec.exe
File created	C:\Windows\Installer\e5960dc.msi	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8361DE5EB3BD3483.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5960c4.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF517ACBB4A025FABD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6808.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6AB213E7FEB97162.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0F564433D9B34B05.TMP	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	reWASDService.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI6C82.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8FBB.tmp	msiexec.exe
File created	C:\Windows\Installer\e5960c4.msi	msiexec.exe
File created	C:\Windows\Installer\e5960cd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6952.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{66F03628-AF73-329C-9DB7-59A701E08AB7}	msiexec.exe
File created	C:\Windows\Installer\e5960c9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5960d8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF38869C491DF0FD30.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5960d3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD9560E53A3EE0166.TMP	msiexec.exe
File created	C:\Windows\Installer\e5960ce.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5960d3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF17A789F20BFB7AD0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF91E1B0A2C09EB2D0.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A1E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA42185892B144905.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF84A127F003D53E07.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6363.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AA217943-D70A-4078-988C-31E5EC26AFE1}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C3185BE9-A193-4021-91F1-1E196C20CAB6}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD63644A6252F4022.TMP	msiexec.exe
File created	C:\Windows\Installer\e5960d8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE39BE2ACB3DACBF2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6913.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4BDD8D4B809EA8DA.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D383E279-1AD9-4DD8-9EB4-7C831665F9CC}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF486827DFB58D7060.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A7D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF44A1121C54CEF589.TMP	msiexec.exe
File created	C:\Windows\Installer\e5960d7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CE4A2F26-87B5-4569-A582-62A8D3B20BE9}	msiexec.exe
File created	C:\Windows\Installer\e5960c8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6D645CABA0DEDABB.TMP	msiexec.exe
File created	C:\Windows\Installer\e5960d2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI754D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDCB30B77777D36D5.TMP	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\SystemTemp\~DFEA99D08DABABF6BF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5960ce.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\SystemTemp\~DF5E77A83E0E32B876.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC586557926CA6B49.TMP	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem4.PNF	reWASDService.exe

Executes dropped EXE 10 IoCs

pid	Process
5000	windowsdesktop-runtime-win-x86.exe
4292	windowsdesktop-runtime-win-x86.exe
4952	windowsdesktop-runtime-8.0.3-win-x86.exe
2448	aspnetcore-runtime-x86.exe
4964	aspnetcore-runtime-x86.exe
2796	AspNetCoreSharedFrameworkBundle-x86.exe
2404	reWASDService.exe
224	reWASDService.exe
1616	reWASDService.exe
3656	reWASDService.exe

Loads dropped DLL 47 IoCs

pid	Process
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
4292	windowsdesktop-runtime-win-x86.exe
652	MsiExec.exe
3816	MsiExec.exe
1096	MsiExec.exe
4568	MsiExec.exe
4964	aspnetcore-runtime-x86.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe
3316	reWASD720-9014.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	reWASDService.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	reWASDService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	reWASDService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007968374e010db61f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007968374e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809007968374e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7968374e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007968374e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	reWASDService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	reWASDService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	reWASDService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	reWASDService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	reWASDService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	reWASDService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	reWASDService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	reWASDService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	reWASDService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	reWASDService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	reWASDService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	reWASDService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	reWASDService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	reWASDService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	reWASDService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	reWASDService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	reWASDService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	reWASDService.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\Language = "1033"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x86\DisplayName = "Microsoft .NET Host - 8.0.3 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_64.12.10377_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\ProductName = "Microsoft ASP.NET Core 8.0.3 Shared Framework (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.12.10343_x86\DisplayName = "Microsoft .NET Runtime - 8.0.3 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62F2A4EC5B7896545A28268A3D2BB09E\PackageCode = "C00FA4D3549327045BEF6B1AD9782510"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62F2A4EC5B7896545A28268A3D2BB09E\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\reWASD.config\DefaultIcon\ = "C:\\Program Files\\reWASD\\reWASD.exe,0"	reWASD720-9014.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rewasd\ = "reWASD.config"	reWASD720-9014.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rewasd	reWASD720-9014.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\reWASD.config\DefaultIcon	reWASD720-9014.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.12.10343_x86\Version = "64.12.10343"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\972E383D9DA18DD4E94BC73861569FCC\SourceList\PackageName = "windowsdesktop-runtime-8.0.3-win-x86.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.12.10343_x86\Dependents	windowsdesktop-runtime-8.0.3-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\972E383D9DA18DD4E94BC73861569FCC\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x86	windowsdesktop-runtime-8.0.3-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\972E383D9DA18DD4E94BC73861569FCC\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\972E383D9DA18DD4E94BC73861569FCC\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\972E383D9DA18DD4E94BC73861569FCC\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\reWASD.config	reWASD720-9014.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C75D4DEB6BB5AD971A9182E4AEF90603	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_64.12.10343_x86	windowsdesktop-runtime-8.0.3-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\349712AAA07D870489C8135ECE62FA1E\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\reWASD.config\shell\open\command	reWASD720-9014.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E3959C6D382567A66EA28545B978FB3A\349712AAA07D870489C8135ECE62FA1E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{AA217943-D70A-4078-988C-31E5EC26AFE1}v64.12.10343\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.12.10377_x86\Version = "64.12.10377"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.12.10377_x86\ = "{D383E279-1AD9-4DD8-9EB4-7C831665F9CC}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\SourceList\PackageName = "aspnetcore-runtime-8.0.3-servicing.24116.15-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62F2A4EC5B7896545A28268A3D2BB09E\SourceList\PackageName = "dotnet-runtime-8.0.3-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.12.10343_x86\DisplayName = "Microsoft .NET Host FX Resolver - 8.0.3 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\349712AAA07D870489C8135ECE62FA1E\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\reWASD.config\shell	reWASD720-9014.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62F2A4EC5B7896545A28268A3D2BB09E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\PackageCode = "9EBFBB50509247143B58A369BA86068D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EB5813C391A1204191FE191C602AC6B\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\PackageCode = "207A606421346D641AD75BAA7D13FA31"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rewasd\reWASD.config_backup	reWASD720-9014.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\reWASD.config\shell\open	reWASD720-9014.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.12.10343_x86\Version = "64.12.10343"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9EB5813C391A1204191FE191C602AC6B\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EB5813C391A1204191FE191C602AC6B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EB5813C391A1204191FE191C602AC6B\SourceList\PackageName = "dotnet-host-8.0.3-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\972E383D9DA18DD4E94BC73861569FCC\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9EB5813C391A1204191FE191C602AC6B\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{27b7a489-233a-488c-b81b-0cb173d4cd15}\Version = "8.0.3.24116"	AspNetCoreSharedFrameworkBundle-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{66F03628-AF73-329C-9DB7-59A701E08AB7}v8.0.3.24116\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{2907caa8-4808-4b6b-b7e7-fb8c862823d2}\Version = "8.0.3.33416"	windowsdesktop-runtime-8.0.3-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62F2A4EC5B7896545A28268A3D2BB09E\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{CE4A2F26-87B5-4569-A582-62A8D3B20BE9}v64.12.10343\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\SourceList\PackageName = "dotnet-hostfxr-8.0.3-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\82630F6637FAC923D97B957A100EA87B\FT_ProductInfo	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EB5813C391A1204191FE191C602AC6B\ProductName = "Microsoft .NET Host - 8.0.3 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EB5813C391A1204191FE191C602AC6B\Version = "1074538599"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{27b7a489-233a-488c-b81b-0cb173d4cd15}\ = "{27b7a489-233a-488c-b81b-0cb173d4cd15}"	AspNetCoreSharedFrameworkBundle-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.12.10377_x86\DisplayName = "Microsoft Windows Desktop Runtime - 8.0.3 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\972E383D9DA18DD4E94BC73861569FCC\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{D383E279-1AD9-4DD8-9EB4-7C831665F9CC}v64.12.10377\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3316	reWASD720-9014.exe
4552	msiexec.exe
4552	msiexec.exe
4552	msiexec.exe
4552	msiexec.exe
4552	msiexec.exe
4552	msiexec.exe
4552	msiexec.exe
4552	msiexec.exe
4552	msiexec.exe
4552	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3316	reWASD720-9014.exe
Token: SeShutdownPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeIncreaseQuotaPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeSecurityPrivilege	4552	msiexec.exe
Token: SeCreateTokenPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeLockMemoryPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeIncreaseQuotaPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeMachineAccountPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeTcbPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeSecurityPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeTakeOwnershipPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeLoadDriverPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeSystemProfilePrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeSystemtimePrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeProfSingleProcessPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeIncBasePriorityPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeCreatePagefilePrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeCreatePermanentPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeBackupPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeRestorePrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeShutdownPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeDebugPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeAuditPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeSystemEnvironmentPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeChangeNotifyPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeRemoteShutdownPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeUndockPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeSyncAgentPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeEnableDelegationPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeManageVolumePrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeImpersonatePrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeCreateGlobalPrivilege	4952	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe
Token: SeTakeOwnershipPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 5000	3316	reWASD720-9014.exe	82
PID 3316 wrote to memory of 5000	3316	reWASD720-9014.exe	82
PID 3316 wrote to memory of 5000	3316	reWASD720-9014.exe	82
PID 5000 wrote to memory of 4292	5000	windowsdesktop-runtime-win-x86.exe	83
PID 5000 wrote to memory of 4292	5000	windowsdesktop-runtime-win-x86.exe	83
PID 5000 wrote to memory of 4292	5000	windowsdesktop-runtime-win-x86.exe	83
PID 4292 wrote to memory of 4952	4292	windowsdesktop-runtime-win-x86.exe	84
PID 4292 wrote to memory of 4952	4292	windowsdesktop-runtime-win-x86.exe	84
PID 4292 wrote to memory of 4952	4292	windowsdesktop-runtime-win-x86.exe	84
PID 4552 wrote to memory of 652	4552	msiexec.exe	88
PID 4552 wrote to memory of 652	4552	msiexec.exe	88
PID 4552 wrote to memory of 652	4552	msiexec.exe	88
PID 4552 wrote to memory of 3816	4552	msiexec.exe	89
PID 4552 wrote to memory of 3816	4552	msiexec.exe	89
PID 4552 wrote to memory of 3816	4552	msiexec.exe	89
PID 4552 wrote to memory of 1096	4552	msiexec.exe	90
PID 4552 wrote to memory of 1096	4552	msiexec.exe	90
PID 4552 wrote to memory of 1096	4552	msiexec.exe	90
PID 4552 wrote to memory of 4568	4552	msiexec.exe	91
PID 4552 wrote to memory of 4568	4552	msiexec.exe	91
PID 4552 wrote to memory of 4568	4552	msiexec.exe	91
PID 3316 wrote to memory of 2448	3316	reWASD720-9014.exe	92
PID 3316 wrote to memory of 2448	3316	reWASD720-9014.exe	92
PID 3316 wrote to memory of 2448	3316	reWASD720-9014.exe	92
PID 2448 wrote to memory of 4964	2448	aspnetcore-runtime-x86.exe	93
PID 2448 wrote to memory of 4964	2448	aspnetcore-runtime-x86.exe	93
PID 2448 wrote to memory of 4964	2448	aspnetcore-runtime-x86.exe	93
PID 4964 wrote to memory of 2796	4964	aspnetcore-runtime-x86.exe	94
PID 4964 wrote to memory of 2796	4964	aspnetcore-runtime-x86.exe	94
PID 4964 wrote to memory of 2796	4964	aspnetcore-runtime-x86.exe	94
PID 3316 wrote to memory of 1752	3316	reWASD720-9014.exe	102
PID 3316 wrote to memory of 1752	3316	reWASD720-9014.exe	102
PID 3316 wrote to memory of 1752	3316	reWASD720-9014.exe	102
PID 3316 wrote to memory of 2884	3316	reWASD720-9014.exe	104
PID 3316 wrote to memory of 2884	3316	reWASD720-9014.exe	104
PID 3316 wrote to memory of 2884	3316	reWASD720-9014.exe	104
PID 3316 wrote to memory of 2404	3316	reWASD720-9014.exe	106
PID 3316 wrote to memory of 2404	3316	reWASD720-9014.exe	106
PID 3316 wrote to memory of 224	3316	reWASD720-9014.exe	107
PID 3316 wrote to memory of 224	3316	reWASD720-9014.exe	107
PID 2796 wrote to memory of 1936	2796	svchost.exe	109
PID 2796 wrote to memory of 1936	2796	svchost.exe	109
PID 2796 wrote to memory of 3452	2796	svchost.exe	110
PID 2796 wrote to memory of 3452	2796	svchost.exe	110
PID 2796 wrote to memory of 1576	2796	svchost.exe	113
PID 2796 wrote to memory of 1576	2796	svchost.exe	113
PID 3316 wrote to memory of 1616	3316	reWASD720-9014.exe	114
PID 3316 wrote to memory of 1616	3316	reWASD720-9014.exe	114
PID 3316 wrote to memory of 3752	3316	reWASD720-9014.exe	116
PID 3316 wrote to memory of 3752	3316	reWASD720-9014.exe	116
PID 3316 wrote to memory of 3752	3316	reWASD720-9014.exe	116
PID 3316 wrote to memory of 1668	3316	reWASD720-9014.exe	118
PID 3316 wrote to memory of 1668	3316	reWASD720-9014.exe	118
PID 3316 wrote to memory of 1668	3316	reWASD720-9014.exe	118
PID 3316 wrote to memory of 3436	3316	reWASD720-9014.exe	120
PID 3316 wrote to memory of 3436	3316	reWASD720-9014.exe	120
PID 3316 wrote to memory of 3436	3316	reWASD720-9014.exe	120
PID 3316 wrote to memory of 776	3316	reWASD720-9014.exe	122
PID 3316 wrote to memory of 776	3316	reWASD720-9014.exe	122
PID 3316 wrote to memory of 776	3316	reWASD720-9014.exe	122
PID 3316 wrote to memory of 3984	3316	reWASD720-9014.exe	124
PID 3316 wrote to memory of 3984	3316	reWASD720-9014.exe	124
PID 3316 wrote to memory of 3984	3316	reWASD720-9014.exe	124
PID 3316 wrote to memory of 3308	3316	reWASD720-9014.exe	126

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\reWASD720-9014.exe
"C:\Users\Admin\AppData\Local\Temp\reWASD720-9014.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\windowsdesktop-runtime-win-x86.exe
  "C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\windowsdesktop-runtime-win-x86.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\Temp\{A9E19A25-63D3-442F-AB26-2E01FA23CCF2}\.cr\windowsdesktop-runtime-win-x86.exe
    "C:\Windows\Temp\{A9E19A25-63D3-442F-AB26-2E01FA23CCF2}\.cr\windowsdesktop-runtime-win-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\windowsdesktop-runtime-win-x86.exe" -burn.filehandle.attached=568 -burn.filehandle.self=688 /install /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Windows\Temp\{3DB6AC7C-B192-405F-B697-9A9D8D46921E}\.be\windowsdesktop-runtime-8.0.3-win-x86.exe
      "C:\Windows\Temp\{3DB6AC7C-B192-405F-B697-9A9D8D46921E}\.be\windowsdesktop-runtime-8.0.3-win-x86.exe" -q -burn.elevated BurnPipe.{978B554E-8F4D-4B30-B2A6-51AD370DDC33} {C8485338-DF9C-4D12-B073-2085DF4F3407} 4292
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:4952
- C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe
  "C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\Temp\{A31710B2-24E4-4A5F-B733-E6E317669819}\.cr\aspnetcore-runtime-x86.exe
    "C:\Windows\Temp\{A31710B2-24E4-4A5F-B733-E6E317669819}\.cr\aspnetcore-runtime-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe" -burn.filehandle.attached=568 -burn.filehandle.self=576 /install /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\Temp\{96F5EAB8-15BB-4039-8782-6812937A6228}\.be\AspNetCoreSharedFrameworkBundle-x86.exe
      "C:\Windows\Temp\{96F5EAB8-15BB-4039-8782-6812937A6228}\.be\AspNetCoreSharedFrameworkBundle-x86.exe" -q -burn.elevated BurnPipe.{0DB83002-310D-4D04-907B-0263A826BB71} {19698A16-1C18-4B38-9535-889EC666285A} 4964
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      Modifies registry class
      PID:2796
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\System32\logman.exe" start REWASD_service -p {0CEA7670-4CD6-45B1-9133-71A9DC48464E} 0xff 255 -o "C:\Users\Public\Documents\reWASD\Logs\REWASD_service.etl" -ets
  2⤵
  PID:1752
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\System32\logman.exe" start REWASD_driver -p {CC6AEC39-B441-4BC8-A92D-2EC99B921C82} 0xff 255 -o "C:\Users\Public\Documents\reWASD\Logs\REWASD_driver.etl" -ets
  2⤵
  PID:2884
- C:\Program Files\reWASD\reWASDService.exe
  "C:\Program Files\reWASD\reWASDService.exe" -drvcheck
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Program Files\reWASD\reWASDService.exe
  "C:\Program Files\reWASD\reWASDService.exe" -drvinstall
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:224
- C:\Program Files\reWASD\reWASDService.exe
  "C:\Program Files\reWASD\reWASDService.exe" -install
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\System32\logman.exe" stop REWASD_service -ets
  2⤵
  PID:3752
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\System32\logman.exe" stop REWASD_driver -ets
  2⤵
  PID:1668
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" http add urlacl url=http://*:35474/ sddl=D:(A;;GX;;;S-1-1-0)
  2⤵
  PID:3436
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" http add urlacl url=http://localhost:35474/ sddl=D:(A;;GX;;;S-1-1-0)
  2⤵
  PID:776
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="reWASD Engine Http (In) 35474" dir=in action=allow protocol=TCP localport=35474
  2⤵
  - Modifies Windows Firewall
  PID:3984
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" http add urlacl url=http://*:35475/ sddl=D:(A;;GX;;;S-1-1-0)
  2⤵
  PID:3308
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" http add urlacl url=http://localhost:35475/ sddl=D:(A;;GX;;;S-1-1-0)
  2⤵
  PID:2016
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="reWASD Engine Http (In) 35475" dir=in action=allow protocol=TCP localport=35475
  2⤵
  - Modifies Windows Firewall
  PID:580
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" http add urlacl url=http://*:35476/ sddl=D:(A;;GX;;;S-1-1-0)
  2⤵
  PID:3780
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" http add urlacl url=http://localhost:35476/ sddl=D:(A;;GX;;;S-1-1-0)
  2⤵
  PID:4648
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="reWASD Engine Http (In) 35476" dir=in action=allow protocol=TCP localport=35476
  2⤵
  - Modifies Windows Firewall
  PID:4780
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="reWASD UDP Emulator Port <36474>" dir=in action=allow protocol=UDP localport=36474
  2⤵
  - Modifies Windows Firewall
  PID:4576

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EB636F46920B980E0A72C007D769A17F
  2⤵
  - Loads dropped DLL
  PID:652
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 75E586694525E33481C68F4A97D8650C
  2⤵
  - Loads dropped DLL
  PID:3816
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1809BC1085578A1BC12F2462C68BD50E
  2⤵
  - Loads dropped DLL
  PID:1096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 30479AE2B5CCEBDFB8D383491327C77F
  2⤵
  - Loads dropped DLL
  PID:4568

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:124

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:4036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{902f471d-16f9-034a-8420-52e229f62ef0}\hidgamemap.inf" "9" "47bb1681b" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "c:\program files\rewasd"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1936
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem3.inf" "oem3.inf:f5fe8c81ebc2f07d:Install:3.33.0.0:root\hidgamemap," "47bb1681b" "0000000000000148" "5267"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:3452
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{38145886-3cab-a744-91e5-cb626e5cdd83}\hidgameflt.inf" "9" "47391871b" "0000000000000164" "WinSta0\Default" "0000000000000148" "208" "C:\Program Files\reWASD"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1576

C:\Program Files\reWASD\reWASDService.exe
"C:\Program Files\reWASD\reWASDService.exe"
1⤵
- Executes dropped EXE
PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5960c7.rbs

Filesize
48KB

MD5
9b2545a259b59930d044648fd20b512b

SHA1
ed782a2200fef467e5f988055f868fea49c07acd

SHA256
3334d9b1c7ca795af3b5a17a890baeb6c8a217ce78ab8fdf655e227e477175e3

SHA512
cbcef608902218af34997f7587f5da00f659ba0a42580d349dea9e5d4f469ef904d0aba8df75c2f1151016cb59d61fc128dd405fc712b09ee5fd399d30dcf42c

Download Submit
C:\Config.Msi\e5960cc.rbs

Filesize
8KB

MD5
64817ab9701942bd55fcf699f4121464

SHA1
f14c7b10171193154508c890c51a710120266f24

SHA256
ee34aaeb48e9080129f5004917ebd83ede614ba4730813acda9647f3ce92262e

SHA512
e7b9cca3694f4a97896743333d4a975ae8fa863e73f502372f6080113a6b460e1dd9974cee7745d59a63d3255ecea958159b4c298b9c91c2a5f7da2035ef9fd9

Download Submit
C:\Config.Msi\e5960d1.rbs

Filesize
9KB

MD5
5d53e68181ea8d07934a8042795e3a79

SHA1
e5cd928b431c3a97c559680d0f4be3c8cbe59adf

SHA256
50e8655c30631d0854933455f8759ad68092bca880493d36b0192da9eceb0784

SHA512
c60affa4bb8f96e5a371c6b51b073a9897a5e779ac9765764b16b2917b95166bfe76bba5c9220389d1a3a3f650e2633b660047c747ad1a838bbaa47ce37e7fe2

Download Submit
C:\Config.Msi\e5960d6.rbs

Filesize
89KB

MD5
70b3d036baf8272937a883573fb96b76

SHA1
74cd6436956aa0c5fc3217809db3008dc8585868

SHA256
7085d1f06d68b5b09527d3a95bd93fa156bfad580900d84bde14bcb787ac2602

SHA512
7102501f9b4c3067d640dcc6a7a117ae7aee404868f4ac7356fb7b7590ab186d21274382fcfd00c0e2e75d44d6ec79f88b1081547046bca0b23777e07c239b49

Download Submit
C:\Config.Msi\e5960db.rbs

Filesize
41KB

MD5
68d8818fd6aea1a490f5e4f4501e9bd9

SHA1
bbe9818a92fb205fc4a415a76c1755762867cf8d

SHA256
d5fdbceb61cc9664df03babcf44c1911f43670c1466154ff2a720be93f5c7793

SHA512
80078056e3ad3e0083364caf458d6f6c2e393300928a5c51247b9fc27dadfa3eb1f858f8383bb2bb603ffe00aaa3a281d7afb5d8dc228c9c03a3e9627aa00f37

Download Submit
C:\Program Files (x86)\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt

Filesize
93KB

MD5
90630d9ee3e0a5672166a45e00f79a5f

SHA1
d1148f8c7558e9b8a81bf1f50f9e3bed89d9928c

SHA256
1271701f435f7fe4aa81dc7e273ca80b6391b73580ee20b35a956052c95de4cf

SHA512
29e10bd57d1c580ece70b9b7c4a69dc036a5a64012eb89ba360a71be6b808150610ea0737351277a3d4235c02323fabef29f092fa6b2a40f0289f55a7973e93d

Download Submit
C:\Program Files\reWASD\hidgameflt.cat

Filesize
11KB

MD5
7a072b43bcd886db2826fdafcb17deae

SHA1
e493d00191b238e122c48ec434f962231f5285ce

SHA256
706fe608b6cce289490d7571df113b32824446ff3d3f25ed2e98fb8a7bd1252d

SHA512
bc99323886b5b9101c68fcd3d6f0d529399bc339e083c22c24b72123d5f6bfaf060cd7a8a232a014ed695c1c8a7a9cb2504e94d761a4588546f9ea842b88ba28

Download Submit
C:\Program Files\reWASD\hidgameflt.inf

Filesize
925B

MD5
3124b563b536d9f6eaff99b0e14f909b

SHA1
e7f69c8f81cb8a12f88e5d6dacc9d167c1ed458f

SHA256
b5587692b20940f821ac70ed737bd2b5bc91169d4df7f88921530f0a4d6b004b

SHA512
9006df655a3cf36dfce9e0c26923a614ebf7ef718d248ba368375cd3ec546cade96a8518e7992fbf6e1ba45357f2213d0642d731afe58409a941f2acd2b2700a

Download Submit
C:\Program Files\reWASD\hidgamemap.cat

Filesize
11KB

MD5
629960dbfc03749299781daa9d25e4cc

SHA1
9b6569dd07a83757fc18a724738a2c8b1f1171f2

SHA256
3fa05c80ac66e6f3b94de9633e459272db8c538af73470f1f3952e931e2a7933

SHA512
0751027a8deb488ce884ded8bd3301617642658b93aa8503545c0d90a112e8fc721854f0368eb0d94ec2ff069aa1264a62a2ac2eb92341f6a1dd46bec1abe2ec

Download Submit
C:\Program Files\reWASD\hidgamemap.inf

Filesize
1KB

MD5
da69c23e0a18b2822f3612f1f1e6b901

SHA1
b78ee155f034340ea4873d2a38a42c511b336501

SHA256
a30281b7334c5bdf83acd7c31014b1a201991e09eb197ad650848e6894cb8790

SHA512
9fba85af228e49202539d538c55f5ab9349aa4607182f00cb1bb5a1b30fde35a7d2426eb5c013640468f6e1e975322ecb65be444aa3b0483aa52bef922f06d04

Download Submit
C:\Program Files\reWASD\hidgamemap.sys

Filesize
329KB

MD5
9f6f33469a95b6dd6ea5410ccc93df2f

SHA1
9c135d10515c0d32df10e5424f32d996c3a315c0

SHA256
2aa8a13793aaa7dc1afd899ea57e95c57f3ef1a2c7e535b6e8ce98031a8a5cba

SHA512
1b2bc176cf9ba8ab3af05e451679e064dedcb6d0b3b6fc879c7577d7a0c25574a0e30ed8a43675b5bc9f663226d87232fd5dc58279d36ff47410be86b072ac06

Download Submit
C:\Program Files\reWASD\reWASD.exe

Filesize
226KB

MD5
bbdd118c9b2d966acf0b5974d251f170

SHA1
80e1404fa513f75f962dad6b43421baeea31e48d

SHA256
7c06ff0f2022c212907c81d22cf9ccd4916764c644f47358aceec72d3fd27f20

SHA512
c394211700a3ed79b47199bbb873cb263ecba129a755da06e14f320abe43c5e6e0923a8aa546ea0b803d01df7deb7d33eccadde60e54b408bfd0a33da739b429

Download Submit
C:\Program Files\reWASD\reWASDService.exe

Filesize
2.8MB

MD5
5184b9e121cf8a04e68968c17126a34e

SHA1
eb1455390616b32a6caddde2cc2becbf6d021d0d

SHA256
b1af934e525b780b96f30c12a8478e37b71405f92c0a03df21d5a67e7399beb8

SHA512
68341cf8040a5be5f0221c7a7a123bce92fedd01cf967cf03b7fe9573ea2abe2ca6cf2b569a99c5f5226a2d576521f1e4ca6ff3480ea76ef4b21d917b1af7222

Download Submit
C:\ProgramData\Package Cache\{2907caa8-4808-4b6b-b7e7-fb8c862823d2}\state.rsm

Filesize
1KB

MD5
0cefd311d64ba68641910aa4270ce896

SHA1
d039d21c1fad18feafea0110859bec0b947ecf13

SHA256
32c2a5a711f648d246303f20a042ad2071fb8aaf4f00712346c8910f828a164a

SHA512
7211ef4a70a4d804bd07aa679d22511dfd7ec48decf6278a1cd05b129f3a1f808de7b8984edc7523b028d921a1e3a1b57677694236f001b838978b79820e0c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.3_(x86)_20240507173102_000_dotnet_runtime_8.0.3_win_x86.msi.log

Filesize
2KB

MD5
6e1ccd20a2b07626f1a0811f5555db37

SHA1
fb02c2d18689b3117c8c7a60883f12062783501a

SHA256
1efe024b4defe2fbbaec9e4ac8f52310ec1d98c4e847ec7c5c9d7b8a7fa3a3d8

SHA512
e7e3834ff74cd97a526684c457f71c1197d2bb8cd0930a12794bd7c7a51a73c1c6a9fa9522ce9194fdb54ce1b7d284fd67227f38e05254b78724412ca81b1888

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.3_(x86)_20240507173102_001_dotnet_hostfxr_8.0.3_win_x86.msi.log

Filesize
2KB

MD5
1dcb18952a72561ca349d017bb1aefeb

SHA1
75e195a3e083d5dd0da1306897be7788c9e55633

SHA256
a2b72cfb1f52e36965a06252d95e1d9648c7121da2a931cc89855a3792060d24

SHA512
830cff95c55be9207c166f4e51ba1a6f3d3fc0d2fa1d8edabe3d8e42a6f48c74426a5084b9c9e8a90bd2a93da7223950d7e060673e3e08cc13d38b741c29b119

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.3_(x86)_20240507173102_002_dotnet_host_8.0.3_win_x86.msi.log

Filesize
2KB

MD5
4d16417820e0f164c78f93dfb5b54f4c

SHA1
fec0392742ff7306c6f8f5b4131a4acab5bc43c6

SHA256
5e5c00552167d7ed4d8d07ddb386b1adb1780721d5ae4fdce11a883a40f72c3e

SHA512
d2cbb67b646f26d45d4b4ba153c88239a059d9ea6d48169ef2331a068f9e77b10622d170aeb8f41dd7b9f4278316d10422f542d5f442b7311404de00f66e0be2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.3_(x86)_20240507173102_003_windowsdesktop_runtime_8.0.3_win_x86.msi.log

Filesize
2KB

MD5
797202d23747d5fefb30687808bf66bb

SHA1
fb2562ed116c1b7c15c23c2aaab3ec323750546e

SHA256
e84a1709f0715c19c5a4d718569afd9f82ff08cd5151a8afd5368895f267fe4a

SHA512
b7c121e9acf379fa48289cf424dd82eedd9349d32f748039be717966498b7e78112dc5cf3635b37492f2e6ad41974366c97aaf850bd96f967f2aa3e1b2a94468

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\7z.dll

Filesize
155KB

MD5
ad71a5e3a757aef0329aeda567f25a00

SHA1
97c766d85c9dabfcabd5a983fe165506d227a8ac

SHA256
f6b9ae6eaaedc55db0e381ec153892c122f1f257ada80cf242a20be8a2f117ef

SHA512
6852496fb8f59bea3ae46efd507d654ae27306d9f4f2f0dc0db8b03f9f63a3712e075b12f0ebdf6ea88db081fca4dd29be1555584aa70386ccb8297beef886ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\CHS.dll

Filesize
89KB

MD5
35aa2ac6cebebede5b663342ba1f6178

SHA1
00368404a7e694d6f567fe56b7e42db43a106d8c

SHA256
fdb80c7c9bcb62c580c5e42304d2328412abded30930cd54bc2803551eaf67dc

SHA512
d506f6b92bd6b632b922ef3aee19d1780f1e90fd2642d1e9dcc214e87d0e964ca56d853da69bd5be317eda9e3c4bb618e079da8baae981dfa1202a9d21297567

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\CHT.dll

Filesize
89KB

MD5
959afc91bb1d18d8ce4f06449cc47ed1

SHA1
b2cbd7fd177ac81be801dd5063895744c7cf50a6

SHA256
75aba801a8f43e3990ff55117ff1710b0390876b380b6dada98f81d67b6ac074

SHA512
a15c6c614bb28f84876a575576fe6a3b1c93b36c22cd93b667513824ea0434a66122deb058ed96c0533c2cf6be4ee1b946fa55d5d12df16f040d473ab03a81d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\DEU.dll

Filesize
220KB

MD5
d168ba8ee986301a11737bd592560f0a

SHA1
8218942a1c7e3ef86cb38ba3b148f65ab2f80deb

SHA256
8ef30ffb2115aad13b4b2392f439c272bd84f10102b62604b9c2bdd7b1ed5176

SHA512
f53c330eca40e8ca32a54a0334b95d0bd78d3822ed1491ef8f4efd45c49d550a96613daa58adea3bff3620252ad5cdd64e5614c0258cd80ae2ebd168184019d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\ENU.dll

Filesize
184KB

MD5
c594413179355220ccc0b94b23799636

SHA1
5ca84c0dcacbdcc2568a796f51480558f3773755

SHA256
fb1c6243f44e36a5cc21c6d26740cf1baa79e33f80fc905d6669136bfc94d97d

SHA512
ab6405fffcde398f3d54d2a1e253148c1a4cf49126f079cb02983f91cf0d2d07b37c0980993a36423fdef17f16150d00562c7ebf320dde4693adf449b6ef49c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\ESN.dll

Filesize
212KB

MD5
1558df68a8da15f97f211d2d537d8950

SHA1
2c2f26cba5ce904f09a845b595e08d93a33f0594

SHA256
0001267e0e028bd17030a049a9735c4de8f1be3552fbae700d178ef7e5dd2e34

SHA512
1f6431704fac59ad13557e92c8625a80a95337dc7ca0a4ee18125cbc1a57330aca0e7dec05723d93e1e0ad0ae7e8f76ac711ea521a0d175bbd04d4e54e82c3f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\FRA.dll

Filesize
227KB

MD5
6054457d7e214be18072cdf564eccdfd

SHA1
1b94041da6cd5516ba6e8984534bf81c58d8ec21

SHA256
79472103b4f1f132133080e8c2620be4ca90004ac3b2ce103a162fe0745a7f9d

SHA512
45ee93633d75b5fdfb2199d7b4c671b5d0cb2dc5e7c80f11c1b261408fec1deb3cbc44901fd8869ff7cec8b91f269a661baed02b074af1929884f5d714325638

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\IND.dll

Filesize
201KB

MD5
008534924f27829755088166abc5965d

SHA1
333fd1dc308b3e5e52ebb2d1bab54a695fe09a85

SHA256
3d265e98dce385d26352ec05a265bc44fa601f86861a97f42638beba3a7fa1d4

SHA512
0e060a13b6df1c32d7ce32d57fb31c85e81675e781bed6e43f486b9dfb897659d6e099293a1c3cda3c589134d51b9c2617ac1d3945a20f9e93e0fd261d62d3c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\ITA.dll

Filesize
214KB

MD5
747797df5e68451e8fbc7d3f59b4ff49

SHA1
a330a564d9dcfdcaed7c2336f71147b3b94125ee

SHA256
50472ae514868bc01fee7565e1c75f5ae57c2e126d4849440ba03b9c79bddfdc

SHA512
205332b2b0b28d5a27c6ced9fe0adef21d402935df7267c8f19671b4141d2ae0148b4529c779d9735cca85d877dd9fc67fc85d761a0409488a61dd23fff32876

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\JPN.dll

Filesize
116KB

MD5
b4b72f3f3868f3058a9f559dc518c16a

SHA1
a0597dbae97198390d10789f97db311a39c242f3

SHA256
68ddaf1f9f6d16e1458377457c9390f62b99a43e53c1d4e7020c9b20ee94a6d3

SHA512
46aff00c1186021309a2c4f38b175bf2482e99c4c4c18ac1d03e20585782bd888c0dfcecd47ddaaaf367a754c33bb4e65bac83edb002c6bf5b1e0d61af2a01db

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\PLK.dll

Filesize
212KB

MD5
ca895e1c2741d2e4f28ec6bf277e95d3

SHA1
141b4f04b36789437091aaff34d8799b161549bb

SHA256
98a228b0688a2066d1dd58b62e17eb1964c3ae3d44ee76cc2b0c067a4b4f36e8

SHA512
37f96c3d4b7c4290a902830fb3f25f1dd6b90ecb3025a4757bb2e9d2b715d4ffcdc0d338418352fd47e18269df8a59ae751c35bfe226a3d76d67ab05562d6a2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\PTB.dll

Filesize
208KB

MD5
69cd8d380ab6cc33d411ac92180ddc3a

SHA1
72f0a1d0bf3c94d97968412ae66f47ac41344749

SHA256
8e195d1a0e9f7ce0af2d1e6af2c8a1fad7fdbe6d64d0280c2e3848ce3359ffed

SHA512
233821c7f0efd0f730407430272281c77cca00191be2c94810a03650e14a94382d6b62f9dc72b21afb5c074b12f08e49ebcf66339f8e87a946ec5668c8f500ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\RUS.dll

Filesize
201KB

MD5
6b1c095b92bfbf1c1d9dd7edcf331cdc

SHA1
0c8b2d9d5a40fac8ac75c9e83a60b207197155d3

SHA256
67931017d01109197c43c7a0189f07996f4f6d00746ccbebb46746afcf3e05a4

SHA512
94d176062a0aa437ef8409af25c624f2df763746ccd2e08c23a5c051d14234c1053d687ab01b97c1aee71233290810021ca19780f781178828b0c9072ad71b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\TRK.dll

Filesize
213KB

MD5
066b311f6e8a1f9f5b4fde22d1263312

SHA1
8dd21ee287415f22f161ab0bc85d1376343ada83

SHA256
565abbd3eb23191488ba81f6f1ef24fd558190d073758ca8ed3478a03be5a906

SHA512
a1ffc51bb6275838de0c6b1888fb6f0c0ecf103a871bda0734df8e14f875780a13e763ddbc8f856482a3898a9bad50bbcb4bfda3ef20fe61d9a071598c89b2e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\UKR.dll

Filesize
199KB

MD5
7a70aa6b6adb6614e48af3cd442279c2

SHA1
dac51f7bb444d3473bd1ffefef6b27ebbf9c6e8b

SHA256
c7aa59bd97cefaeae171249036cc6344170ace67132af00d6caf4a202cda7e78

SHA512
98738a5a4ad6497de2c45eab79a01f69ebe27b49ffd7a867df29b3f0a0b177c3dc8c5e6a1500944d019ff544416a0d191ccc922722879eb83f415b15d4f4eae3

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe

Filesize
9.2MB

MD5
d71c59dc3bba98e4f79f24fc52fbaa86

SHA1
371471968dbb45311e1161340ef7ed9edbfe8497

SHA256
5b03336ad38f7855611b7ccfa4beb80ec07526b9c17bc0eec27359ca8e9a60e9

SHA512
16f0226043d4ce4a47538f495cd77363273c7286b1be518b6b32ad0e2ca3cbe268b4cfb3fb43ed4a9d3a9176b1986a399fbaed7f6c432149f2d16c67105449d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\setuphlp.dll

Filesize
305KB

MD5
d23815104f35f3903efef8f769630c41

SHA1
85014f046b6e009b273eda4c19feb0304cb35349

SHA256
18256cfc62c24427ad0d02232906863b12945673b04d20be484bc21f58edcd48

SHA512
5e374e61d9f84f1d41751d092172a891acac76e46f1e36c305fe64151155d578156fa992c9e73dda8679836a217e3d0b6ea734d08e4ed1c1f90f3fa6c178b8be

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Fortnite\Controller\Double movement.rewasd

Filesize
3KB

MD5
712dfaef8373af26e0a89c8592eef0b1

SHA1
663b9164d6b35b4073ea23dbb4f71cbf73d211d7

SHA256
662756e39a5f057c5edecc5464a7b79d1f9a5494b3f4f30beca72dff5f4727f4

SHA512
49b7316203f5240cca5767b8592adcf868cce7cb557adbbbb6b04200c4a45e784399bce5e0ec647e8d9eea2110c366405c27bbf872442c8438c72fb07d3bcc0f

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Fortnite\IcoGame.png

Filesize
269KB

MD5
9ab8cbec5b61357684f7ca436deb1fa8

SHA1
626d58fcb5544b74466689297b429ba021b2dc05

SHA256
de828b711dea56563a009cc47642c54e5fc38fdea37d8a7677e8f8412bd7036a

SHA512
a05a49385b5fdb1a246cfbe84c8859a2d38c7f3b275fb87f1519aac039b0293ca31ee88498149bed249191b63f7e45566fef315d9d5dbd5657c286ba83effdbe

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Handheld\Controller\Win + DualShock 4.rewasd

Filesize
27KB

MD5
4afa72c35662fbee90060743d69f5643

SHA1
8b0587920fe01e2532ca346f84403c8acc32e156

SHA256
e2c14d6d7d374a2962358dce5c454b6ca9bee0188567734449573b63989285dd

SHA512
c74146c519a3e4e1ed96be6718227e6baa906ff2c2b2de99c18668598a588ee990ed90e01ea0a81520d7094f4d9115c812ed3611be75971ab33cc5b15c4ad063

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Handheld\Controller\Win + Xbox 360.rewasd

Filesize
27KB

MD5
aaca1b62651ac6a0032a3f116df2802e

SHA1
40f86d5d24582d1ce084356417fc6cd8e70c0b4a

SHA256
ed4b4ea60a261712b5ef0554ef66ecb107516cf0877b4d22fa205a5528e3090d

SHA512
5ddbf090e6bab4afb4890527b27c2dc9a721f5f74d92dbda0d2ea84b513285f75d1b2dcffbf16775f2baad69e94bb829b6d23d853ba3321092354491e0a82f86

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\PS4 Remote Play (2023)\Controller\For Keyboard & Mouse.rewasd

Filesize
69KB

MD5
188f2439da63508db4ee0e025b7ba918

SHA1
bf1a3c9a3c4fb09a3ff006a0dee659c2170a2f19

SHA256
bbeee0fa97e19ca6c6bf23663a4fb465507daa784714182fdb02f9aea4b07e1b

SHA512
a8b8f9ef79599bdab2d0ba5d4fec0e7ab94369f28a4a515bfac8b359318eb93904b3cba866712191cec475baac75e482408a6958344785737b3c578c1aaefae5

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\PS4 Remote Play (2023)\IcoGame.png

Filesize
453KB

MD5
ff596ab3265df6db369996ef455e90ed

SHA1
920df613e33223eeccdf07b82ffce4622bc5ca50

SHA256
e09a2f1a9a04efb485bf35c402f5adbaca1821e6ef05ba9f65414760c61473a2

SHA512
8aae92cfbdfc7dac570b6b5e5ff381a5329cfa8a3c6d0552a48dbaa2432dae104dc16b8b7edf34e0c63ed6dbc6c38bb7a519473232d1a7033a1e8452ee27a03e

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Switch console\Controller\For Any device.rewasd

Filesize
69KB

MD5
01bbdf8e66318cb24245a2be643ab670

SHA1
92c896fe8b7c2e9f6e27de7a80ef477135cf49e9

SHA256
e7efc86ef882c162fa88d2764b8b647966f5a5e1bc631ff0781baebaae143643

SHA512
9ba6c4bf82ff18d7e5f5b117d0f2e1a1213ea6504321579b45b469ed8cfa2d3c8f7860424ba9ab8cb161fe0eeefbe68e09058e98dea52d6ab3740d98ffbafc01

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Switch console\IcoGame.png

Filesize
484KB

MD5
7ba44ef4cf5b25558dfd9561b54c2449

SHA1
05ebf7587443386df5fbe0945a90c10c6f07d90b

SHA256
feea7a36e5ba70b36d2b501cdce652013f35976d049d5e154cc8b272774b9b27

SHA512
68dfad91cb16229fcc5bd8c76b3d51a34be411fc297e19fcd9a6627354470b9da38274830389529ce5918190e033799eab56762943c7559ebbd9ebdab56d571c

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Switch to Xbox 360\Controller\For Any Controller.rewasd

Filesize
406B

MD5
1ccbe7c61f22e6ca768d51c36c92b9b2

SHA1
5e829c21a646caaddaf89e600cd97b77f8c01f5d

SHA256
6c8a54e671b04a51859478e5b2c28c68f54d32936035f55d345155e6b4603418

SHA512
95681c357a40ab9d23b8d4e1484847f2636a9117b1ea0ca1cc11231b8ecccdebec4f80f23fc2bae403d2bb3422260d27ad6ae5358d3758714bb30409052c5596

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Switch to Xbox 360\IcoGame.png

Filesize
880KB

MD5
eacfdfbae6e6d7e6abecb58a73e812e4

SHA1
6b6053164db446d1d772d9ae6ea3cc0af7dfc34b

SHA256
5e0499e1f33b85867c1aa36bc1b86aa2c86aa3152814dcabaa2e8ccd0dd9e2ab

SHA512
5c3fd1f39744a6521a6de72ef805a03d9c58d06970de76c3e1741969f74e702460d0efe25f8d6d406e86c70150ec4de4e8b27b8f7f57f6756352c713540b1d63

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Valorant\Controller\Any_controller.rewasd

Filesize
22KB

MD5
95398465e031f6aa67fbde011bd23b5a

SHA1
3b4643da4365d067988f950924ae23d0837662bd

SHA256
519503549126c4a080ca0b332c76c68151180f8ac25bab1e9d2513ea02a902cd

SHA512
742471447d4b169544913139b4b158b2140275c73de8b55eaa5f486d75072a9bcbe8da39358f1314d0e3108e967b26c13f486a87963101d63a87241bd5b67093

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Valorant\IcoGame.png

Filesize
240KB

MD5
e56933d3a93b7d69deafd34dffa18d89

SHA1
5c09ea645c024bf181acf4c87e7cd3b0242e5dc5

SHA256
94e53c0aaa54729fa1d8674e40e21e2bc1ee5202c97b47f793b72db6841ef954

SHA512
1754ca46b62f18e5a58467ec3594b8f21cf113fc7549db5239f88901d4163ebdb236375740938494b39162d2e4f1bce9be601efc0015c6954d74a5f7b70c39cd

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\xCloud\Controller\Kb&Mouse for Xbox Cloud .rewasd

Filesize
67KB

MD5
a4c5806ca8cd2fcc97e82524187fcba2

SHA1
9b123e06d51a013f3d531c9ae0a98d68f515ebc1

SHA256
b967a6756ef795a0c7581d20bc2f5c277f67b0eef29ca7b0d0c0b489bb81c2dc

SHA512
1f981d2b9f2a8b1dbc635ffc996724ab469636e8ebb00229f97329a121f60854415a29891296a41cdfd75b496a343867995c281068064c9e7a38fdddcbf31a34

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\xCloud\IcoGame.png

Filesize
218KB

MD5
424b4d94227424765577ea368f34ed53

SHA1
b6f4a04014e8a1a10eb42686a3437aacf28889db

SHA256
f535c85f2365f786465c8c3218ca36180f53af5c56a3d09218abe86a30da7594

SHA512
939dfa90a6ca9ed812578922643726bf2e7119ad6e47aedd327c92d3925ae5e4706e00fe7d670f729fd962587cc313d6d21fa01da2c7206d7b5c1116d45c35e3

Download Submit
C:\Windows\Installer\MSI6808.tmp

Filesize
244KB

MD5
c0777f5c9995b8c0b08ed33cee7e1008

SHA1
12f08bb8febedb3f16b22bf94bc47c5c3910a477

SHA256
cf531f10cb410f4825bab4fd4b15df8e02cb9a18505a3a3b05c4c2f4ccaf90d3

SHA512
a3478bc42730169abcb7635f1f73bc8b1a639fe2094c7e3866d8321b6efdf0740f8867dccdd5fb1b12f73b8e89a51758280ab9c3d184d36a7b86f3f91ac9dc0a

Download Submit
C:\Windows\Installer\e5960dc.msi

Filesize
8.9MB

MD5
52b794ca478228fcf4a2991ccf2e02bf

SHA1
3d60f16a63486637c625f693401abdec2274eab0

SHA256
cd1b376c4e88866d709a06c85d0095d390f91639b29806c4820dfa2bd1f3cc34

SHA512
e2b7f4ee52cffe84e1a8af4910b0836fbceffbc860405ff409ca6ba3c181e1f6ab1956d81cfc212fe97c0a8ca81ce316b9ec53ac1bf8097413625a7c73ff2205

Download Submit
C:\Windows\Temp\{3DB6AC7C-B192-405F-B697-9A9D8D46921E}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{3DB6AC7C-B192-405F-B697-9A9D8D46921E}\.ba\wixstdba.dll

Filesize
215KB

MD5
aa531c5359ebfb8204c12e774c7ef280

SHA1
1a35e2a5d9d9c51ff59279fa3415ad0346573438

SHA256
44b362b78639baccd5c83f0b224a206730b1276fab849c77fd1fb17db2f07014

SHA512
49e13931d6575655ddbc1da4e09484dfee9c0308c5d071470b1d903ac37819730c6b7c7fe452f4425aa3c5bb18b1c0b16f189618517f81c378cce75e52b46722

Download Submit
C:\Windows\Temp\{3DB6AC7C-B192-405F-B697-9A9D8D46921E}\dotnet_host_8.0.3_win_x86.msi

Filesize
772KB

MD5
294781415f09e281929c46e09dbe6021

SHA1
8a8e76eafd473692deed53561d6e1d05fc76593e

SHA256
8436264fc25783303c0a86517d9c3c2b986401d3e4207ca81977a53820ba5247

SHA512
d42ca21da198b75c0bc3870bc1987bdc30945afe9dbe6dbeb8bf5b963cfa9b7842d6261993c1639b31eccff2211a9b8ef5a2e93d521292342d9521d861eeaa84

Download Submit
C:\Windows\Temp\{3DB6AC7C-B192-405F-B697-9A9D8D46921E}\dotnet_hostfxr_8.0.3_win_x86.msi

Filesize
828KB

MD5
f9600d32247218e2aa26f71dfc180be3

SHA1
3483901e85e60fd801542b5fabd0200578f0cf0d

SHA256
479dec4aba43cb645202cc4aeda2fee13efe84316f17ae69737ef4c97f8d5aa0

SHA512
2209712339e987369755acddf32a138b8d27f14887a5535ede41f8bcc534ec9a0bbc8f1cf08578a7a9a34d5704d78709fd37a368de870483e021d31551e4618e

Download Submit
C:\Windows\Temp\{3DB6AC7C-B192-405F-B697-9A9D8D46921E}\dotnet_runtime_8.0.3_win_x86.msi

Filesize
24.1MB

MD5
134b25b04e4539a6254a3d4c23949113

SHA1
774aaa31ac4beb1ed2019a872ec645bb97ebfa9c

SHA256
7fe867831099aa8db41325ac5b8d161a4789899df036b19852e5588208205147

SHA512
fa94be7a5894cd62a42b319a4282374e2c7d03d4ba6e6f6cbd70ff2a8a0e0713ea2f3d625a24341a12fb2345165d6222ce74ad531f972ad436de98c207d77ff6

Download Submit
C:\Windows\Temp\{3DB6AC7C-B192-405F-B697-9A9D8D46921E}\windowsdesktop_runtime_8.0.3_win_x86.msi

Filesize
26.7MB

MD5
f4e126fa58b4b8d9f7b6a2ee3bf5a441

SHA1
c98f045fb1f97dc86588c3e322b75a42dd1f0db0

SHA256
4bfc9b09c9118c226e5cbd0c861893816c3c601a24b407c898294e8944c344b4

SHA512
aeb93bd48c34047a7c5ac85e62a259e477e5c87da602be7ccb7f09e9f5b1de672cf64609bbf08ee2d7909039c1beaccece5325d3d4f9d8e8d0dc5758e85c207f

Download Submit
C:\Windows\Temp\{96F5EAB8-15BB-4039-8782-6812937A6228}\.ba\logo.png

Filesize
12KB

MD5
84709eb22e4b05688067699ca9b0d322

SHA1
7c3381d8b6a58087cda95577cc2d25e7aa2c21d8

SHA256
c8e23a42e04fbd73f5f66f3b9f2ba34a777bc4769c413a0f78335a4e757baad5

SHA512
04de70b7317ee1cbde73ac0fe84bd70983cf0ff7e769e5f9626c69eaa6e3e9724c95b14ccb7a5478ee639848d3f8c98e4dec599cc5e33ad71de638da589ba319

Download Submit
C:\Windows\Temp\{A31710B2-24E4-4A5F-B733-E6E317669819}\.cr\aspnetcore-runtime-x86.exe

Filesize
615KB

MD5
a2f197252858376280566098ac779f1e

SHA1
b9bc74545bc11839025216b43fb1bc274e8865ab

SHA256
9143e60c28fd6d82b79dcca4f5fc61876f10e2376242d81bd3df2c1677e6f01b

SHA512
50dc074f436db2242d1245b8506357b7af482a8f61e863dc272e942a9ba21a83aaa9f506e68ba3bd41278fae93eaaa6ec36d24b6d44fe8aa2fbb042d17f39935

Download Submit
C:\Windows\Temp\{A9E19A25-63D3-442F-AB26-2E01FA23CCF2}\.cr\windowsdesktop-runtime-win-x86.exe

Filesize
635KB

MD5
47b63cad653dc2adc715a83b1a97e0e8

SHA1
1e60af79534ad33b7bb4aa2dfd27c2102dd12741

SHA256
e6ba36b1824fe82c4b333896239ec69d2fdab970253882af8691f2607c72fc2e

SHA512
d6c4a693fa994dc6aae9e585ff27eb46cfd318237c544e328fd5b65ba3ff64d6a4cfd40e6f27108f69efb5df57b00964d6079d0bb28304e3390dc6ab355fc52f

Download Submit
memory/3316-110-0x0000000074DAE000-0x0000000074DAF000-memory.dmp

Filesize
4KB

Download
memory/3316-104-0x00000000078C0000-0x0000000007900000-memory.dmp

Filesize
256KB

Download
memory/3316-109-0x0000000074DA0000-0x0000000075551000-memory.dmp

Filesize
7.7MB

Download
memory/3316-0-0x0000000074DAE000-0x0000000074DAF000-memory.dmp

Filesize
4KB

Download
memory/3316-112-0x0000000074DA0000-0x0000000075551000-memory.dmp

Filesize
7.7MB

Download
memory/3316-108-0x000000000ADA0000-0x000000000AE32000-memory.dmp

Filesize
584KB

Download
memory/3316-106-0x0000000008530000-0x0000000008568000-memory.dmp

Filesize
224KB

Download
memory/3316-107-0x0000000008510000-0x000000000851E000-memory.dmp

Filesize
56KB

Download
memory/3316-105-0x0000000007900000-0x0000000007908000-memory.dmp

Filesize
32KB

Download
memory/3316-111-0x0000000074DA0000-0x0000000075551000-memory.dmp

Filesize
7.7MB

Download
memory/3316-65-0x000000006E7D0000-0x000000006E81F000-memory.dmp

Filesize
316KB

Download
memory/3316-11-0x0000000007680000-0x000000000769E000-memory.dmp

Filesize
120KB

Download
memory/3316-10-0x0000000074DA0000-0x0000000075551000-memory.dmp

Filesize
7.7MB

Download
memory/3316-9-0x0000000007600000-0x0000000007676000-memory.dmp

Filesize
472KB

Download
memory/3316-4-0x0000000007120000-0x000000000712A000-memory.dmp

Filesize
40KB

Download
memory/3316-3-0x0000000007130000-0x0000000007142000-memory.dmp

Filesize
72KB

Download
memory/3316-2-0x0000000074DA0000-0x0000000075551000-memory.dmp

Filesize
7.7MB

Download
memory/3316-1-0x00000000008F0000-0x0000000002586000-memory.dmp

Filesize
28.6MB

Download
memory/3656-1431-0x00007FFB05B00000-0x00007FFB05B10000-memory.dmp

Filesize
64KB

Download