c4f0d67d3d319fc6c9abbbe0dc17c6b2313bb89e69863d33c4a3ceb6119149dd

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nex-przegladarka-kosztorysow.exe
Size

137.5MB
MD5

44df20687e2b0a72b356c4b03e6161c7
SHA1

82814a6ba9eefd0acba6490684c71d6a4383810e
SHA256

c4f0d67d3d319fc6c9abbbe0dc17c6b2313bb89e69863d33c4a3ceb6119149dd
SHA512

1a6d11c7cc9f21256084e783652ce4390b5594f84b91db864426251d8ed60217ff1f924c044e8f71d16c2165c2ee8a18bc1882c4eb84c8898442f22467481a1e
SSDEEP

3145728:yuohiFGJ9UO5Zy5To8D4vlnbuZdPOD7n7l7/X32axp1/l:NokG8S4To8UvTD7x7/n2axp19

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d0100dac-89ac-4daa-aa2c-5ffd368cc7f3} = "\"C:\\ProgramData\\Package Cache\\{d0100dac-89ac-4daa-aa2c-5ffd368cc7f3}\\dotnet-hosting-6.0.9-win.exe\" /burn.runonce"	dotnet-hosting-6.0.9-win.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{67950e91-8f8f-4d75-9252-7cca68ccdacc} = "\"C:\\ProgramData\\Package Cache\\{67950e91-8f8f-4d75-9252-7cca68ccdacc}\\dotnet-runtime-6.0.9-win-x64.exe\" /burn.runonce"	dotnet-runtime-6.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{b223d27f-1f05-41ea-a87b-5e2862578982} = "\"C:\\ProgramData\\Package Cache\\{b223d27f-1f05-41ea-a87b-5e2862578982}\\dotnet-runtime-6.0.9-win-x86.exe\" /burn.runonce"	dotnet-runtime-6.0.9-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{e5c0fcbb-4fd4-4325-9b6b-158bbfa45fb0} = "\"C:\\ProgramData\\Package Cache\\{e5c0fcbb-4fd4-4325-9b6b-158bbfa45fb0}\\aspnetcore-runtime-6.0.9-win-x64.exe\" /burn.runonce"	aspnetcore-runtime-6.0.9-win-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ ISSetupPrerequisistes = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\nex-przegladarka-kosztorysow.exe\""	nex-przegladarka-kosztorysow.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
30	2576	msiexec.exe
32	2576	msiexec.exe
34	2576	msiexec.exe

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-crt-process-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-core-console-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\host\fxr\6.0.9\hostfxr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Security.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-crt-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Reflection.Emit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\createdump.exe	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Console.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-core-processthreads-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Reflection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-crt-runtime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Dynamic.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-core-interlocked-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-core-memory-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-crt-utility-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Runtime.CompilerServices.VisualC.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-crt-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Linq.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\LICENSE.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Threading.Channels.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Xml.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\clretwrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Security.Cryptography.OpenSsl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Configuration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Resources.Writer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\mscorrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Diagnostics.TraceSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-crt-conio-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\coreclr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-crt-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-core-processenvironment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.ComponentModel.DataAnnotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Numerics.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\netstandard.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Security.Cryptography.OpenSsl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-core-datetime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\msquic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Security.Cryptography.Cng.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Console.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\System.Net.Security.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-core-libraryloader-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.9\api-ms-win-core-file-l1-2-0.dll	msiexec.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f77f53b.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI185B.tmp	msiexec.exe
File created	C:\Windows\Installer\f77f547.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77f556.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4E0F.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\f77f562.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D0F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI24A7.tmp	msiexec.exe
File created	C:\Windows\Installer\f77f54f.msi	msiexec.exe
File created	C:\Windows\Installer\f77f559.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f77f54d.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI25D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4316.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f77f553.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI46F0.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f77f544.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77f559.ipi	msiexec.exe
File created	C:\Windows\Installer\f77f543.msi	msiexec.exe
File created	C:\Windows\Installer\f77f55c.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f77f562.msi	msiexec.exe
File created	C:\Windows\Installer\f77f541.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77f544.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2137.tmp	msiexec.exe
File created	C:\Windows\Installer\f77f55b.msi	msiexec.exe
File created	C:\Windows\Installer\f77f538.msi	msiexec.exe
File created	C:\Windows\Installer\f77f550.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4A2E.tmp	msiexec.exe
File created	C:\Windows\Installer\f77f55f.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77f55f.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f77f53b.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2234.tmp	msiexec.exe
File created	C:\Windows\Installer\f77f54a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77f55c.msi	msiexec.exe
File created	C:\Windows\Installer\f77f53e.msi	msiexec.exe
File created	C:\Windows\Installer\f77f53d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77f53e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77f547.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D60.tmp	msiexec.exe
File created	C:\Windows\Installer\f77f561.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f77f538.msi	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	dotnet-hosting-6.0.9-win.exe
File created	C:\Windows\Installer\f77f555.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77f54a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77f54d.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77f550.msi	msiexec.exe
File created	C:\Windows\Installer\f77f556.msi	msiexec.exe
File created	C:\Windows\Installer\f77f549.msi	msiexec.exe
File created	C:\Windows\Installer\f77f553.ipi	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	dotnet-runtime-6.0.9-win-x64.exe
File opened for modification	C:\Windows\Installer\MSI4A9E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f77f541.ipi	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	dotnet-runtime-6.0.9-win-x86.exe
File opened for modification	C:\Windows\WindowsUpdate.log	aspnetcore-runtime-6.0.9-win-x64.exe
File opened for modification	C:\Windows\Installer\MSIF9CE.tmp	msiexec.exe

Executes dropped EXE 13 IoCs

pid	Process
2548	nex-przegladarka-kosztorysow.exe
2948	dotnet-hosting-6.0.9-win.exe
2024	dotnet-hosting-6.0.9-win.exe
1088	dotnet-hosting-6.0.9-win.exe
2800	dotnet-runtime-6.0.9-win-x64.exe
2328	dotnet-runtime-6.0.9-win-x64.exe
600	dotnet-runtime-6.0.9-win-x64.exe
1296	dotnet-runtime-6.0.9-win-x86.exe
1320	dotnet-runtime-6.0.9-win-x86.exe
1604	dotnet-runtime-6.0.9-win-x86.exe
2724	aspnetcore-runtime-6.0.9-win-x64.exe
2544	aspnetcore-runtime-6.0.9-win-x64.exe
1660	aspnetcore-runtime-6.0.9-win-x64.exe

Loads dropped DLL 26 IoCs

pid	Process
2012	nex-przegladarka-kosztorysow.exe
2548	nex-przegladarka-kosztorysow.exe
2548	nex-przegladarka-kosztorysow.exe
2948	dotnet-hosting-6.0.9-win.exe
2024	dotnet-hosting-6.0.9-win.exe
2024	dotnet-hosting-6.0.9-win.exe
1088	dotnet-hosting-6.0.9-win.exe
2800	dotnet-runtime-6.0.9-win-x64.exe
2328	dotnet-runtime-6.0.9-win-x64.exe
2328	dotnet-runtime-6.0.9-win-x64.exe
292	MsiExec.exe
2884	MsiExec.exe
2576	msiexec.exe
2576	msiexec.exe
468	MsiExec.exe
1088	dotnet-hosting-6.0.9-win.exe
1296	dotnet-runtime-6.0.9-win-x86.exe
1320	dotnet-runtime-6.0.9-win-x86.exe
1320	dotnet-runtime-6.0.9-win-x86.exe
2224	MsiExec.exe
1040	MsiExec.exe
2632	MsiExec.exe
1088	dotnet-hosting-6.0.9-win.exe
2724	aspnetcore-runtime-6.0.9-win-x64.exe
2544	aspnetcore-runtime-6.0.9-win-x64.exe
2544	aspnetcore-runtime-6.0.9-win-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\34\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\34\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\34\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86	dotnet-runtime-6.0.9-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1960B88601ACAB30B21538F58220776\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{67950e91-8f8f-4d75-9252-7cca68ccdacc}\DisplayName = "Microsoft .NET Runtime - 6.0.9 (x64)"	dotnet-runtime-6.0.9-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B01DFDF79768479357848CB532D8F\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A036181AE3507D45E36606F9464ED83\3F74C449FCE4BF8468359E8A48413778	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{67950e91-8f8f-4d75-9252-7cca68ccdacc}\Dependents\{67950e91-8f8f-4d75-9252-7cca68ccdacc}	dotnet-runtime-6.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D247F4B074D259E47B650482223DC184\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{0B4F742D-2D47-4E95-B756-402822D31C48}v48.39.47157\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B65E377217E5AB676BCDCF1498676AD2\308B01DFDF79768479357848CB532D8F	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57A75E48E9AA6FD4BADDB2BB64C691D7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D247F4B074D259E47B650482223DC184\SourceList\PackageName = "dotnet-runtime-6.0.9-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\Dependents\{67950e91-8f8f-4d75-9252-7cca68ccdacc}	dotnet-runtime-6.0.9-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1960B88601ACAB30B21538F58220776\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.39.47157_x64\Dependents\{67950e91-8f8f-4d75-9252-7cca68ccdacc}	dotnet-runtime-6.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.39.47157_x86\DisplayName = "Microsoft .NET Host FX Resolver - 6.0.9 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\094F9C7997352096B7082D27C35AD959	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D43A690C92C4644B919E58FFE6C0ADB\SourceList\PackageName = "dotnet-runtime-6.0.9-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.39.47157_x86\Version = "48.39.47157"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F3ABA03C0C231D343B8BA9FE5DA8519D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F3ABA03C0C231D343B8BA9FE5DA8519D\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B914F09030858BB755BF3C9E531A6669\D247F4B074D259E47B650482223DC184	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B01DFDF79768479357848CB532D8F\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.39.47157_x64\Dependents	dotnet-runtime-6.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\DisplayName = "Microsoft .NET Host - 6.0.9 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57A75E48E9AA6FD4BADDB2BB64C691D7\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1960B88601ACAB30B21538F58220776	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D43A690C92C4644B919E58FFE6C0ADB\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EE1A0B17CE0524B7EC0CB91AA18D67C2\3D43A690C92C4644B919E58FFE6C0ADB	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57A75E48E9AA6FD4BADDB2BB64C691D7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{88B0691F-A106-3BAC-B012-35F885227067}\Dependents	dotnet-hosting-6.0.9-win.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.39.47157_x64	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B01DFDF79768479357848CB532D8F\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EE1A0B17CE0524B7EC0CB91AA18D67C2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.39.47157_x86\Dependents	dotnet-runtime-6.0.9-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F74C449FCE4BF8468359E8A48413778\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1960B88601ACAB30B21538F58220776\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D247F4B074D259E47B650482223DC184\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B01DFDF79768479357848CB532D8F\PackageCode = "F94C50F07ED1F4A40B1C80F8986CF743"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.39.47157_x86\Dependents	dotnet-runtime-6.0.9-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3F74C449FCE4BF8468359E8A48413778\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F74C449FCE4BF8468359E8A48413778\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F74C449FCE4BF8468359E8A48413778\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.39.47157_x64\Version = "48.39.47157"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D247F4B074D259E47B650482223DC184\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57A75E48E9AA6FD4BADDB2BB64C691D7\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\Dependents	dotnet-runtime-6.0.9-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F74C449FCE4BF8468359E8A48413778\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\76df85e0-b371-31e1-b3f1-a1c643d9acbd\Version = "6.0.9.22419"	dotnet-hosting-6.0.9-win.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.39.47157_x64	dotnet-runtime-6.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D43A690C92C4644B919E58FFE6C0ADB\ProductName = "Microsoft .NET Runtime - 6.0.9 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57A75E48E9AA6FD4BADDB2BB64C691D7\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{67950e91-8f8f-4d75-9252-7cca68ccdacc}\ = "{67950e91-8f8f-4d75-9252-7cca68ccdacc}"	dotnet-runtime-6.0.9-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3ABA03C0C231D343B8BA9FE5DA8519D\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3D43A690C92C4644B919E58FFE6C0ADB\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{e5c0fcbb-4fd4-4325-9b6b-158bbfa45fb0}	aspnetcore-runtime-6.0.9-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57A75E48E9AA6FD4BADDB2BB64C691D7\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.39.47157_x64	dotnet-runtime-6.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\76df85e0-b371-31e1-b3f1-a1c643d9acbd	dotnet-hosting-6.0.9-win.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{67950e91-8f8f-4d75-9252-7cca68ccdacc}\Version = "6.0.9.31619"	dotnet-runtime-6.0.9-win-x64.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	nex-przegladarka-kosztorysow.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	nex-przegladarka-kosztorysow.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	nex-przegladarka-kosztorysow.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	nex-przegladarka-kosztorysow.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	nex-przegladarka-kosztorysow.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	nex-przegladarka-kosztorysow.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2576	msiexec.exe
2576	msiexec.exe
2576	msiexec.exe
2576	msiexec.exe
2576	msiexec.exe
2576	msiexec.exe
2576	msiexec.exe
2576	msiexec.exe
2576	msiexec.exe
2576	msiexec.exe
2576	msiexec.exe
2576	msiexec.exe
2576	msiexec.exe
2576	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2548	nex-przegladarka-kosztorysow.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	2868	vssvc.exe
Token: SeRestorePrivilege	2868	vssvc.exe
Token: SeAuditPrivilege	2868	vssvc.exe
Token: SeRestorePrivilege	1256	DrvInst.exe
Token: SeRestorePrivilege	1256	DrvInst.exe
Token: SeRestorePrivilege	1256	DrvInst.exe
Token: SeRestorePrivilege	1256	DrvInst.exe
Token: SeRestorePrivilege	1256	DrvInst.exe
Token: SeRestorePrivilege	1256	DrvInst.exe
Token: SeRestorePrivilege	1256	DrvInst.exe
Token: SeLoadDriverPrivilege	1256	DrvInst.exe
Token: SeLoadDriverPrivilege	1256	DrvInst.exe
Token: SeLoadDriverPrivilege	1256	DrvInst.exe
Token: SeShutdownPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeIncreaseQuotaPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeRestorePrivilege	2576	msiexec.exe
Token: SeTakeOwnershipPrivilege	2576	msiexec.exe
Token: SeSecurityPrivilege	2576	msiexec.exe
Token: SeCreateTokenPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeAssignPrimaryTokenPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeLockMemoryPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeIncreaseQuotaPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeMachineAccountPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeTcbPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeSecurityPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeTakeOwnershipPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeLoadDriverPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeSystemProfilePrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeSystemtimePrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeProfSingleProcessPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeIncBasePriorityPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeCreatePagefilePrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeCreatePermanentPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeBackupPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeRestorePrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeShutdownPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeDebugPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeAuditPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeSystemEnvironmentPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeChangeNotifyPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeRemoteShutdownPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeUndockPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeSyncAgentPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeEnableDelegationPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeManageVolumePrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeImpersonatePrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeCreateGlobalPrivilege	1088	dotnet-hosting-6.0.9-win.exe
Token: SeRestorePrivilege	2576	msiexec.exe
Token: SeTakeOwnershipPrivilege	2576	msiexec.exe
Token: SeRestorePrivilege	2576	msiexec.exe
Token: SeTakeOwnershipPrivilege	2576	msiexec.exe
Token: SeRestorePrivilege	2576	msiexec.exe
Token: SeTakeOwnershipPrivilege	2576	msiexec.exe
Token: SeRestorePrivilege	2576	msiexec.exe
Token: SeTakeOwnershipPrivilege	2576	msiexec.exe
Token: SeRestorePrivilege	2576	msiexec.exe
Token: SeTakeOwnershipPrivilege	2576	msiexec.exe
Token: SeRestorePrivilege	2576	msiexec.exe
Token: SeTakeOwnershipPrivilege	2576	msiexec.exe
Token: SeRestorePrivilege	2576	msiexec.exe
Token: SeTakeOwnershipPrivilege	2576	msiexec.exe
Token: SeRestorePrivilege	2576	msiexec.exe
Token: SeTakeOwnershipPrivilege	2576	msiexec.exe
Token: SeRestorePrivilege	2576	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2548	2012	nex-przegladarka-kosztorysow.exe	28
PID 2012 wrote to memory of 2548	2012	nex-przegladarka-kosztorysow.exe	28
PID 2012 wrote to memory of 2548	2012	nex-przegladarka-kosztorysow.exe	28
PID 2012 wrote to memory of 2548	2012	nex-przegladarka-kosztorysow.exe	28
PID 2012 wrote to memory of 2548	2012	nex-przegladarka-kosztorysow.exe	28
PID 2012 wrote to memory of 2548	2012	nex-przegladarka-kosztorysow.exe	28
PID 2012 wrote to memory of 2548	2012	nex-przegladarka-kosztorysow.exe	28
PID 2548 wrote to memory of 2948	2548	nex-przegladarka-kosztorysow.exe	33
PID 2548 wrote to memory of 2948	2548	nex-przegladarka-kosztorysow.exe	33
PID 2548 wrote to memory of 2948	2548	nex-przegladarka-kosztorysow.exe	33
PID 2548 wrote to memory of 2948	2548	nex-przegladarka-kosztorysow.exe	33
PID 2548 wrote to memory of 2948	2548	nex-przegladarka-kosztorysow.exe	33
PID 2548 wrote to memory of 2948	2548	nex-przegladarka-kosztorysow.exe	33
PID 2548 wrote to memory of 2948	2548	nex-przegladarka-kosztorysow.exe	33
PID 2948 wrote to memory of 2024	2948	dotnet-hosting-6.0.9-win.exe	34
PID 2948 wrote to memory of 2024	2948	dotnet-hosting-6.0.9-win.exe	34
PID 2948 wrote to memory of 2024	2948	dotnet-hosting-6.0.9-win.exe	34
PID 2948 wrote to memory of 2024	2948	dotnet-hosting-6.0.9-win.exe	34
PID 2948 wrote to memory of 2024	2948	dotnet-hosting-6.0.9-win.exe	34
PID 2948 wrote to memory of 2024	2948	dotnet-hosting-6.0.9-win.exe	34
PID 2948 wrote to memory of 2024	2948	dotnet-hosting-6.0.9-win.exe	34
PID 2024 wrote to memory of 1088	2024	dotnet-hosting-6.0.9-win.exe	35
PID 2024 wrote to memory of 1088	2024	dotnet-hosting-6.0.9-win.exe	35
PID 2024 wrote to memory of 1088	2024	dotnet-hosting-6.0.9-win.exe	35
PID 2024 wrote to memory of 1088	2024	dotnet-hosting-6.0.9-win.exe	35
PID 2024 wrote to memory of 1088	2024	dotnet-hosting-6.0.9-win.exe	35
PID 2024 wrote to memory of 1088	2024	dotnet-hosting-6.0.9-win.exe	35
PID 2024 wrote to memory of 1088	2024	dotnet-hosting-6.0.9-win.exe	35
PID 1088 wrote to memory of 2800	1088	dotnet-hosting-6.0.9-win.exe	41
PID 1088 wrote to memory of 2800	1088	dotnet-hosting-6.0.9-win.exe	41
PID 1088 wrote to memory of 2800	1088	dotnet-hosting-6.0.9-win.exe	41
PID 1088 wrote to memory of 2800	1088	dotnet-hosting-6.0.9-win.exe	41
PID 1088 wrote to memory of 2800	1088	dotnet-hosting-6.0.9-win.exe	41
PID 1088 wrote to memory of 2800	1088	dotnet-hosting-6.0.9-win.exe	41
PID 1088 wrote to memory of 2800	1088	dotnet-hosting-6.0.9-win.exe	41
PID 2800 wrote to memory of 2328	2800	dotnet-runtime-6.0.9-win-x64.exe	42
PID 2800 wrote to memory of 2328	2800	dotnet-runtime-6.0.9-win-x64.exe	42
PID 2800 wrote to memory of 2328	2800	dotnet-runtime-6.0.9-win-x64.exe	42
PID 2800 wrote to memory of 2328	2800	dotnet-runtime-6.0.9-win-x64.exe	42
PID 2800 wrote to memory of 2328	2800	dotnet-runtime-6.0.9-win-x64.exe	42
PID 2800 wrote to memory of 2328	2800	dotnet-runtime-6.0.9-win-x64.exe	42
PID 2800 wrote to memory of 2328	2800	dotnet-runtime-6.0.9-win-x64.exe	42
PID 2328 wrote to memory of 600	2328	dotnet-runtime-6.0.9-win-x64.exe	43
PID 2328 wrote to memory of 600	2328	dotnet-runtime-6.0.9-win-x64.exe	43
PID 2328 wrote to memory of 600	2328	dotnet-runtime-6.0.9-win-x64.exe	43
PID 2328 wrote to memory of 600	2328	dotnet-runtime-6.0.9-win-x64.exe	43
PID 2328 wrote to memory of 600	2328	dotnet-runtime-6.0.9-win-x64.exe	43
PID 2328 wrote to memory of 600	2328	dotnet-runtime-6.0.9-win-x64.exe	43
PID 2328 wrote to memory of 600	2328	dotnet-runtime-6.0.9-win-x64.exe	43
PID 2576 wrote to memory of 292	2576	msiexec.exe	44
PID 2576 wrote to memory of 292	2576	msiexec.exe	44
PID 2576 wrote to memory of 292	2576	msiexec.exe	44
PID 2576 wrote to memory of 292	2576	msiexec.exe	44
PID 2576 wrote to memory of 292	2576	msiexec.exe	44
PID 2576 wrote to memory of 292	2576	msiexec.exe	44
PID 2576 wrote to memory of 292	2576	msiexec.exe	44
PID 2576 wrote to memory of 2884	2576	msiexec.exe	45
PID 2576 wrote to memory of 2884	2576	msiexec.exe	45
PID 2576 wrote to memory of 2884	2576	msiexec.exe	45
PID 2576 wrote to memory of 2884	2576	msiexec.exe	45
PID 2576 wrote to memory of 2884	2576	msiexec.exe	45
PID 2576 wrote to memory of 2884	2576	msiexec.exe	45
PID 2576 wrote to memory of 2884	2576	msiexec.exe	45
PID 2576 wrote to memory of 468	2576	msiexec.exe	46

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\nex-przegladarka-kosztorysow.exe
"C:\Users\Admin\AppData\Local\Temp\nex-przegladarka-kosztorysow.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\nex-przegladarka-kosztorysow.exe
  C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\nex-przegladarka-kosztorysow.exe -package:"C:\Users\Admin\AppData\Local\Temp\nex-przegladarka-kosztorysow.exe" -no_selfdeleter -IS_temp -media_path:"C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\" -tempdisk1folder:"C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\" -IS_OriginalLauncher:"C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\nex-przegladarka-kosztorysow.exe"
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\{D70CD057-6D12-4EAA-8B6D-E229591EB69C}\dotnet-hosting-6.0.9-win.exe
    "C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\{D70CD057-6D12-4EAA-8B6D-E229591EB69C}\dotnet-hosting-6.0.9-win.exe" /q /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\Temp\{C9379E71-FD44-4D1D-B97A-5ADDED07CA34}\.cr\dotnet-hosting-6.0.9-win.exe
      "C:\Windows\Temp\{C9379E71-FD44-4D1D-B97A-5ADDED07CA34}\.cr\dotnet-hosting-6.0.9-win.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\{D70CD057-6D12-4EAA-8B6D-E229591EB69C}\dotnet-hosting-6.0.9-win.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /q /norestart
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2024
    - - C:\Windows\Temp\{74E07E9D-BF2B-4CA3-85B1-3AFC58BB4E84}\.be\dotnet-hosting-6.0.9-win.exe
        
        "C:\Windows\Temp\{74E07E9D-BF2B-4CA3-85B1-3AFC58BB4E84}\.be\dotnet-hosting-6.0.9-win.exe" -q -burn.elevated BurnPipe.{5FC35A46-DEBF-476E-BFCA-5D0A43FE5854} {232A969C-8D52-41A2-8773-D6C00FC2D9E4} 2024
        5⤵
        Adds Run key to start application
        Drops file in Windows directory
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1088
      - C:\ProgramData\Package Cache\A1D4B9ADF3928F004AA0643DAF17158D4CDEAD76\dotnet-runtime-6.0.9-win-x64.exe
        
        "C:\ProgramData\Package Cache\A1D4B9ADF3928F004AA0643DAF17158D4CDEAD76\dotnet-runtime-6.0.9-win-x64.exe" /quiet /norestart
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\Temp\{10D78516-FD0D-46E0-A83B-5FCDBD4C8DFF}\.cr\dotnet-runtime-6.0.9-win-x64.exe
        
        "C:\Windows\Temp\{10D78516-FD0D-46E0-A83B-5FCDBD4C8DFF}\.cr\dotnet-runtime-6.0.9-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\A1D4B9ADF3928F004AA0643DAF17158D4CDEAD76\dotnet-runtime-6.0.9-win-x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /quiet /norestart
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2328
        
        C:\Windows\Temp\{6DA69F82-80FD-4C62-ACDE-A283BE81253D}\.be\dotnet-runtime-6.0.9-win-x64.exe
        
        "C:\Windows\Temp\{6DA69F82-80FD-4C62-ACDE-A283BE81253D}\.be\dotnet-runtime-6.0.9-win-x64.exe" -q -burn.elevated BurnPipe.{48BD0EDC-6B47-4C34-8405-DAC291A3D847} {E1E66898-7159-4D63-ADA6-52EC43E4AE06} 2328
        8⤵
        Adds Run key to start application
        Drops file in Windows directory
        Executes dropped EXE
        Modifies registry class
        
        PID:600
      - C:\ProgramData\Package Cache\1419164A3FBEA58BCFACEEECE63460D7461AD879\dotnet-runtime-6.0.9-win-x86.exe
        
        "C:\ProgramData\Package Cache\1419164A3FBEA58BCFACEEECE63460D7461AD879\dotnet-runtime-6.0.9-win-x86.exe" /quiet /norestart
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1296
        
        C:\Windows\Temp\{35E07621-0370-4E9B-8983-D20CE23BA675}\.cr\dotnet-runtime-6.0.9-win-x86.exe
        
        "C:\Windows\Temp\{35E07621-0370-4E9B-8983-D20CE23BA675}\.cr\dotnet-runtime-6.0.9-win-x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\1419164A3FBEA58BCFACEEECE63460D7461AD879\dotnet-runtime-6.0.9-win-x86.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /quiet /norestart
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1320
        
        C:\Windows\Temp\{3930D55F-3CC2-4349-A259-691BB34906DB}\.be\dotnet-runtime-6.0.9-win-x86.exe
        
        "C:\Windows\Temp\{3930D55F-3CC2-4349-A259-691BB34906DB}\.be\dotnet-runtime-6.0.9-win-x86.exe" -q -burn.elevated BurnPipe.{00CC278C-AF0E-42FD-8926-2C8785B3EB9B} {8BCAFA35-A064-4D0B-8000-29339B02DC34} 1320
        8⤵
        Adds Run key to start application
        Drops file in Windows directory
        Executes dropped EXE
        Modifies registry class
        
        PID:1604
      - C:\ProgramData\Package Cache\45509A1E220C63B8F65D6F72E165174CCDC59070\aspnetcore-runtime-6.0.9-win-x64.exe
        
        "C:\ProgramData\Package Cache\45509A1E220C63B8F65D6F72E165174CCDC59070\aspnetcore-runtime-6.0.9-win-x64.exe" /quiet /norestart
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2724
        
        C:\Windows\Temp\{FDC79244-DBDE-4D4F-AA5B-EBA5F27A0082}\.cr\aspnetcore-runtime-6.0.9-win-x64.exe
        
        "C:\Windows\Temp\{FDC79244-DBDE-4D4F-AA5B-EBA5F27A0082}\.cr\aspnetcore-runtime-6.0.9-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\45509A1E220C63B8F65D6F72E165174CCDC59070\aspnetcore-runtime-6.0.9-win-x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /quiet /norestart
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2544
        
        C:\Windows\Temp\{55FC637E-E6FF-4B6E-A711-3DAABEAEF0FB}\.be\aspnetcore-runtime-6.0.9-win-x64.exe
        
        "C:\Windows\Temp\{55FC637E-E6FF-4B6E-A711-3DAABEAEF0FB}\.be\aspnetcore-runtime-6.0.9-win-x64.exe" -q -burn.elevated BurnPipe.{41A380FB-A84E-4F0F-9EE7-C2C9ABE249AD} {991F1FFA-D11A-4FE4-9C54-9566F892E0D8} 2544
        8⤵
        Adds Run key to start application
        Drops file in Windows directory
        Executes dropped EXE
        Modifies registry class
        
        PID:1660

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000031C" "0000000000000578"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 86B234152EDB5FAD6E51A5D0E963F1A9
  2⤵
  - Loads dropped DLL
  PID:292
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F3177A307120DFBBFCDC710315ED81A3
  2⤵
  - Loads dropped DLL
  PID:2884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7D5AB6F7C076EA0D1B6FCEA02D037149
  2⤵
  - Loads dropped DLL
  PID:468
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 31330E85E9BA5234C50ECFDC8E12116A
  2⤵
  - Loads dropped DLL
  PID:2224
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C14E9F27DA5C29CEF429ECDD0D598C30
  2⤵
  - Loads dropped DLL
  PID:1040
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 991C5118F4A8C948ED914EF10ED189F5
  2⤵
  - Loads dropped DLL
  PID:2632

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot20" "" "" "65dbac317" "0000000000000000" "00000000000004A0" "000000000000056C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f77f53c.rbs

Filesize
7KB

MD5
8d7f5b9fac1f6f5c0e01f2f01f13b62a

SHA1
cfb0fcbe5aff01ace3a3c606c9378ca1f8401197

SHA256
bd24b19b2e83c57d96b94a24f09f644dbef228748868b81628c98b0e8fb1f346

SHA512
4b9a0995b88a17f9f440bf9909c68a026dd7efd3df12d13207d9a8a50eee540e4b9ddccfdd8047231e4d4f347f9cbcd9246cc21ea9643de6b82b236e2504b008

Download Submit
C:\Config.Msi\f77f542.rbs

Filesize
54KB

MD5
2e8e345726279d7b23270751361900b4

SHA1
007e535d4ce78ef4c0f0dbe7e562dedd845b66a2

SHA256
ae3ae09f46bf6789c6a43e2421618383a9de4eee17bd642e54f6e1f0bf1ecdd4

SHA512
35a26689261c2c080a7e303c874c0aa9c5a1d3dcafde3b09687c74163eecb518e8ec4c30f5e73f059a01c51940dc13a0e1b6c91757c1fc01a53577ae258953b5

Download Submit
C:\Config.Msi\f77f548.rbs

Filesize
8KB

MD5
9780ba278606bc03909f90fd6ea00d8b

SHA1
44063a46fc1e9e48440de2082d266d644092d8aa

SHA256
001946fe7bcb60b08a36dae7fe8929f9059f9cd46ece91bc18a029b1b501a37b

SHA512
95d6fa729d3a245e03f38417894a1ef2f7f7f51545df18067e4392ec5c5045706ca5ae1667d5842fbfb66b49ddaf5d03f04e63542729193faeefb52e2889c4c2

Download Submit
C:\Config.Msi\f77f54e.rbs

Filesize
9KB

MD5
4ee94f44b409404195cb00db5148f7a8

SHA1
3b264747ae09cf183058feb9088d47f4a8d29275

SHA256
17f7615d68b70038da3d73d28e92d9a80740ebb76812e247d464506389d9a399

SHA512
88f4e4a2dc682d0bb9c2bca94612de35c73cfc51436f309aa30699e936fab42f53bb502c09e0eb9dd66bfa9c569daf7ef5ec0ef9016f88e73eed50c93b29422d

Download Submit
C:\Config.Msi\f77f554.rbs

Filesize
56KB

MD5
35c20ece33b0d1a5290645b075cb314f

SHA1
99b93c32e52af713f02991a7815e6e29137a9f36

SHA256
b302d4fa32a2dfcbdb02e25d853c854e3de3d00868972b370bdfef6f1fc2a928

SHA512
2bd43ae7612db7eaa2ff2bb856e5151d43d49746e33b16cec265871d81281bcc59726f5262641c6e304d75d8be98e543520c985b8d493971f8d576e2ac9d39aa

Download Submit
C:\Config.Msi\f77f55a.rbs

Filesize
8KB

MD5
7459379041e054b9e2fa86b6f4e41f93

SHA1
83613e27e877aca3b0b3446065c15526fc059d68

SHA256
9cade407cbdc5a546039bdabd2caafa7a40953fbeaff6b9df1fc52d9a1277534

SHA512
0fa2b5ac2c056ad3bb1e3b7e1b182519af4e6950f6b9b085e35dc5a946fa952d23554a0330d70d30e0ec0029f3506d24f772ffe2894e10337b22b3e82026ea0e

Download Submit
C:\Config.Msi\f77f560.rbs

Filesize
9KB

MD5
6865d6cda7b55bf067ec58989aa88ada

SHA1
74ea3820bc03677c7956c9d4d3d2bab73ea96478

SHA256
e94e3112d60072e7f9fbd1497c98613e853b6994589cc67739a5d3cda122e5be

SHA512
6cfb50fac58425422b3a378d3f0b8260c3dfd473bb92b8d76b32b87f2e36a9ce69f1dfe6cc1e5b5a1bd1060a4a1aab8069fc7ea3ea6ca53108f44c1c00e268c5

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\ProgramData\Package Cache\{d0100dac-89ac-4daa-aa2c-5ffd368cc7f3}\state.rsm

Filesize
1KB

MD5
7347e353e8176e464ecfe0b7f5008c6d

SHA1
3a862d6934804655a3428b6165943fa4be86304c

SHA256
cfa2ebd4d4205e4e0d3d886ba73839e7c35722e61926dd7c6f706c1cbb4c6cee

SHA512
4aecf63b777d7f83ef05a2fb0bcabfc22c2c6e27cae7efc8f8f4dcd6decda46158d17b123b47b2776c81f86296819ec81970b3a1a62000ceb2a78434509f06ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aec9e50aac3b23aedd754761b24decb

SHA1
e93e02461713dfc4ff0d45401013995f35465d5a

SHA256
f2f580c71ee10eee54f84370d801384851ae2432ab5667814b1b72b88e210298

SHA512
e0784ecfab0192c04f10e48585586ebc81af681a6b995611d5fda6fdc5e7ef907aaf68bf59a5cf35e350be98dfc8c0481e69da5e647b84e8d66b1b30ac21c449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12538660ea41416ca21f4cb70ca9e03e

SHA1
fd084add95e2c77c2c602c6ac32bdbca4bbd399e

SHA256
d1a48fb5f9b06d401e152990e2de87062ba09d341131e46fd15882d4d52b63f9

SHA512
1750df8673491c8986028b31dfa642274853b7a25af6d486c4ee641b239f53a20e03976827f31c65a198d080c093c1b146e8106e3f38829716c3c5f38c49e6cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2c288fd3724e82bd032235e95f92d7a

SHA1
84eeffc848cefd97f906ac54d66041dc55456a6f

SHA256
d7bf012670267d81c9967e75f0a284cdfe82816f863eb53079688709ac209e36

SHA512
99f553f3d2cd001c809333c083089186207e5ff11fd6b1868bf8194b558f001ea7621ea9a7c3f7c144f1b9586a3c9cd834ac84079f1fb97ac1364e09a3f4b7f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c59de38ac7e5672b9fcd8d1d52571b1e

SHA1
798763a17634d611e8abebca8718a26bc07f8dde

SHA256
d3a835e2170a5144026bd1112130d6da160c3b1d51b686493b99be8530c32ec3

SHA512
fa45337f9724134525ff6b97276506bf193b3855e9472d6883294b36b0791c966dfedc460ecc4c8012392e801e02f7520c5dbd0b2701a4a57b4998e660ea2d22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ec6b23088876a5023df6c7d2a7d9e1a

SHA1
7dc8d232ff749fac25880fa6d6c7f3b12e99e7c9

SHA256
bc8b0750b7d98ccd71060aa8f231ad4b84d95ebef737bbf591bb2241263a224c

SHA512
6e42e64479a32b699ad5679fd6fcc7165ae3b2262d38c6459fb725f3c1eee8e0458a6dd7e777ce4166968d13209ee377bb06b37308427c4bd6041f2514451fd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eed196a2d482ff4a59eebd1c02a87812

SHA1
b87e4f65e7fd43a0f8c125dd322d5655b1ece8f9

SHA256
6dbd3872a9b3d2c621b9a23fde5732f8337d4be9c9b451a4e041b8c8182d80ee

SHA512
fba5f0cc991ac4976aa43d5003772be6b0c78eee6ca3ce5c630e168d3717bb8bf97258f14b1ea78d20cbe31a28538454044c068ddd444069896fb978a5f0e598

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18b0b609447892f8d75093c21c01d630

SHA1
f7ab37c552f79e4b208a4ed607abaa4e0d311e5d

SHA256
a405175f8b5d8dd80b5b41732257f2febd64634f542aa5b4a69c15f0b4234bc0

SHA512
28efa02ec0ccca545ff5e1e67634f074fdfb2ab1ab8891b7d26acef00d2f73045646bc52b9c416e15a2704f450516e1eddb62c4dc4414c699f274a06246a5712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e870e5851608950e58cac8f8112c3df

SHA1
851597436d331400bf619170079caba15ad7b677

SHA256
8a007d40e1a1f58714f3bde6e4e6ea7a387ae6c146ac1dd6ebdc41804d1152b7

SHA512
f4c55918b7abb670185f4815a4d0eb76d1589810b2e73e685f78e0ff16600e12e7ce59ebc91401ba0c6ef6b0feea54c00dbd44be1b79cbd43c9a2855fcb78141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8eaf7f45cddd11ce3fe8bf746bdd37de

SHA1
6e47c735e4cf3d42a64c09161619faa703c934b7

SHA256
d9cdec425c04dbabce081124f135e21b4e6e9520ab5e94cad16a4fe05c690f2f

SHA512
40eb9aa4790944669e49fef82577b129b49fc4c09e57b3e3bf479853d25cadbcb457840a71868330815981b5b1711b925a04f416b00db95cc65812fcbc2f42ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.9_(x64)_20240514074137_000_dotnet_runtime_6.0.9_win_x64.msi.log

Filesize
2KB

MD5
c011e39130f17ef05e9183429a72517b

SHA1
9017c04043d50b98b85d21e6b8b95453f047fdaa

SHA256
8eaf7ad4f2521b7fe1cf8a53d7708eca904ae0a7007f5a9e5bd7e9bd08f11d16

SHA512
a187b26816f30418ab86027ebdfcc27298a722c1371d5d2b62e6be6f908cbb9709a35ae58882a5d96eaff512c2a420d4c3c507058a2402d1bcf8a2ee45bb4f83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.9_(x64)_20240514074137_001_dotnet_hostfxr_6.0.9_win_x64.msi.log

Filesize
2KB

MD5
dbb5b92368b88e6066f35d01d7aa5991

SHA1
ac4e1062b5a5319688cb363f0d86d196fc8c4930

SHA256
dbfc4ed2c36f131031360d0d8b5f8df9f270079d4b59354bddf8d484dab123a0

SHA512
94857d4c8e364ca4f1db10b9f3fc1a50a7f8bd00bef1a1240311be9cf55c2e3012e198329bbd8f4cebd2d4c8d7755e80f01046b97e706f8145995879981e282f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.9_(x64)_20240514074137_002_dotnet_host_6.0.9_win_x64.msi.log

Filesize
2KB

MD5
d805bbdbf3f079c7470bb74623800b0d

SHA1
15c419cedf8046858c45a5d0b0ac6c8d85a1c3de

SHA256
61f578e6d0ddaa0e58b5dc26062ea4c0728b3313cd0ec4dd0d1d285ae1e8def0

SHA512
cc3bcdbf84cfef6d5a61aff5938619ae9f326cf2866b52b66ee46f0492a887a1bbc9d3193b9a10c21cd173bc718a3a873e966f0c661e96e301033a439af05e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar791D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_dd_DotNetCoreWinSvrHosting__20240514074123_000_WindowsServerHostingBundleOptions.msi.log

Filesize
2KB

MD5
c076d0e50554b00d4c465d3c06988d81

SHA1
549577442aed85efb2540b932dadb6d73cff459c

SHA256
aa1db64ba60630132669bfe5a2af3e771dfc428d9a3396b7b6908324e632d1ea

SHA512
797062f558df86422dac0c97e911298a7e2afcf8b866fa50a0c399d4071c5f470bfeedfd1cc74b50c0f18149b7e6d51ed59113f079f369a993c7843e465235ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\0x0415.ini

Filesize
23KB

MD5
67d15753e278de2d6d607be083a4dea5

SHA1
bad1cf703f79d84c5987b5eb84f4390cecfd9f82

SHA256
7e9c1e9787364be6ccbf026c1a842ab56279ab26c7dca428d875e983e84ee58c

SHA512
40acf9049f34c9f1a2b4ba63873a8a5f1cc386ea066dbb3549390be705aac13ca86ec14272354d5c63592255eda1f1144e8636d60dc62b9e7381e95f0505d177

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\ISSetup.dll

Filesize
1.6MB

MD5
e0ce31d6f470551986d79daacb165d12

SHA1
424d5e877098484553c5ad8b71c09fa1f9616409

SHA256
0f37ea5dd7176741ae0bde40c828cf0117bd25b34d097da1085acab6db2c0b84

SHA512
465139c0296b25adb01e336803a552ec70069213828c27042e0da88fd067be1e4f3fdc2e00d419e5571fa74b0e4a4af7d0a6ae4b14771f2b4a219c64addaed5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\ISSetupPrerequisites\Microsoft .NET Core Runtime 6.0.9 - Windows Hosting Bundle.prq

Filesize
1KB

MD5
c13027a61ca610a51e6caf1d481c38a6

SHA1
aae80c76b723b0121004705cb15977306c9b0b43

SHA256
c2082e722fd9b184f33ba1f3762257f06aa2fad7feba28d169b4759f181e15f1

SHA512
e4ab836f3a32e7700da0a5905982a4c1bbad13902fd5382fe4ee1da29f6f0456363a79082aa6676ed8ba2fcf208b19d547106d9cf77d78242c3e1e7990a75b31

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\ISSetupPrerequisites\Microsoft .NET Framework 4.8 Full.prq

Filesize
1KB

MD5
68e0a2bbc9fc3ea276a98a196a121700

SHA1
c6f28886f6749901ac0a1f6e8f019b23ba9b4d3b

SHA256
050c96f99f2038c65bb9e036912e6cdb6fcae840362e1693f9b09f6ec76ed9cf

SHA512
1ca225425ad2c8753d41035c332a4a3152107615a0fff348d4006610999920cf68ec5d5b30943882affc13b4ccf1ca46204761724f065eb8e452ef179db63e06

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\ISSetupPrerequisites\Microsoft Edge WebView2 Runtime (x64).prq

Filesize
1KB

MD5
1bffee1f29bbffaaddf3f2c3bafcdfa4

SHA1
26bb1ff6a13088799c9898abd8e08539437da0d1

SHA256
73e5e0f3c4e95e8f4ecf3981a5f2ecc019f56f0b7b28fdc1262f878fd7632cca

SHA512
c00580d42fd05a20d440541ed2eb0219fe6c3626b061f441e55a783a4d1c31caed6892b0a486842faf8061671bdf375b41c4bebd0ad9253b505ea21503e2425e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\ISSetupPrerequisites\Microsoft Edge WebView2 Runtime (x86).prq

Filesize
1KB

MD5
a8d54fbdf61058c3023ecd3dafa8c7d7

SHA1
c17216140d99035d32bb92693d0fdfea4094a3cc

SHA256
c031ff8826a0a60d272ab737c82ab66681eb9cbda169f573eac7b0ca8bb72dba

SHA512
2231b09a6c9e39481e397eb4957751a7d99a9bea29a9b4ac9ec6a12b25a6b3f1e737099b66f5bbe690ab2d3fffd17a9d3ca4252bf3c126f29fb69b4e43c50395

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\ISSetupPrerequisites\Microsoft Visual C++ 2010 SP1 Redistributable Package (x64 - dla Windows 7 i nowszych).prq

Filesize
1KB

MD5
4bd876838fff417cc4164ce11085ed7f

SHA1
32e2f9a830ee75ed180371d46efa2d5c39209d4c

SHA256
4e9a8da246bb10deebf33eb59daa8302476fe533a7941b19ffb0872eec56c767

SHA512
4bab43e46181e0a2d0fad4f8a16fb9f779ba9a8c3d58aee72e8189741ad69c3f31d1d3bf3f574b29919cafbb43d1326734d1e882f596370d41b43986f4db4c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\ISSetupPrerequisites\Microsoft Visual C++ 2010 SP1 Redistributable Package (x86 - dla Windows 7 i nowszych).prq

Filesize
1KB

MD5
3d408817c0d27236362209c02b6822c1

SHA1
908f059067228e8fd4b8913ac8779ff64483e578

SHA256
8ae442bb400bee9a8a796ce5212ec312dcc310170e04cdbecdf60ed5e7ee55cc

SHA512
8362a02c6688adccb916ab12441c2de5b2707d33557fbfc0127cfc3ab6a657b8b94c4dc35e8a65d590c5d158c86ab54c45c3d15dabdce5094562c106c7c60a91

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\ISSetupPrerequisites\Microsoft Visual C++ 2015-2019 Redistributable Package (x64 - dla Windows 7 i nowszych).prq

Filesize
1KB

MD5
44e2474a34f98a8da9f943e6d2a18f78

SHA1
7929f4f4c422eac7dfe49962366b23216f453ee7

SHA256
28b4d37f46268a988485aeef3c0aa8268d68df495bde44b63f419997f3756f48

SHA512
6cbe8ca8665a4c7b15c309f0d3bbe2ef9a44af14ccb493ebdba22d6d5b723f0f69b262907237e0cb0d382ae7b99035b27d2551ea03d8dbef9ea8d697564d1d81

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\ISSetupPrerequisites\Microsoft Visual C++ 2015-2019 Redistributable Package (x86 - dla Windows 7 i nowszych).prq

Filesize
1KB

MD5
15cc34925105f45516f01127f7d8c7ff

SHA1
8117cd308d48d398fdb8a3f9a870eacce6bd544a

SHA256
66e131a72aca7a4372fd46824fd3e7bb5b39509ba9b38165954685a9a26eee24

SHA512
b6baf90d0cd6f7cdf0374ef4307fc3c72d72068e035474520b812d5d6c266ad84be201cccfe4143b2efdad3da161084d47b242210be090262eb6b979e0271ab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\ISSetupPrerequisites\Windows Installer 3.1 (x86).prq

Filesize
1KB

MD5
00ba1d21ed4422dcd63a8b5583d379f3

SHA1
7b41d2e4d5cbe0b7d73cd69c6a651a19c38e5abe

SHA256
e2620a4dd3ba69b294a7018937fdf5c3951161d4ffbea0a6a9a9e6367bc22b29

SHA512
189902e13f0c8dcb3ce4819f27a566c50fdf3641a6f7b27122bba96cfd47b2424aaec197f6524faa1e805b9352762096b16574bda8be7095cc2e38e94972a004

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\ISSetupPrerequisites\Windows Installer 3.1 for Windows Server 2003 SP1 (x64).prq

Filesize
1KB

MD5
5c28ca116fb3211283b6504816106ea7

SHA1
47689a09eb12def4421faa358806b75f25df57a9

SHA256
894135be3be0a5d032914ddb15798688ba3483bea3c123d6de69e78239328f49

SHA512
8372332b41f5b24c1afeb730c41bef8b9e0a4e4d91df8e325d801854ea355207b38d1de0f1720aa39069a4b3bc846abac422272e5355ebf6c441918a36087206

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\ISSetupPrerequisites\Windows Installer 3.1 for Windows XP (x64).prq

Filesize
1KB

MD5
86eb07bad3e63e1b967f6c6f04ca7432

SHA1
3bca6243d594160394bc3df617c58e8c857eb6e0

SHA256
a80c401ee3fdc648442bfc1343bdbc0d555528673d53e215cae41e1803c358b8

SHA512
25fcbd21e91796358b7c874bd61eed4f303850b05990e07b5dae915ce1371daf4a7af05b798882c8738b053524aaa2be7fe5f2b37800ae8c5b1357bb143798a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\Disk1\nex-przegladarka-kosztorysow.exe

Filesize
944KB

MD5
8720848aca8b44e631ab3ac25b7787ff

SHA1
3571ca071f8e6f2e5afb5abc54d9005f12c0a9f0

SHA256
f2043f840cc91cc603190809929954cc88287752b6d58a9d381cd28f1747b1e8

SHA512
06854a0b9a0b688161d7a4d43809789a9aa2fb79e70a9c38fbb9bf7f6695445ff4d9cdc7bdc0047e43c5859cdb8edd81662c82bf3a275b33ec6eb35631ff6fb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86C1BC27-34DB-4BED-849F-E5F79313A046}\setup.ini

Filesize
4KB

MD5
5e0911e96fa3a07d1c3be35b73f6e8ec

SHA1
8700f1bc93efa02931419e02c5e92fd173df5116

SHA256
655039ead46ff0ae167938182c35683d1f6971e7a04181927680ed12d722149a

SHA512
6b9688415800668c131208c7590d0c5f31c68754e7b2cca053ac0e0a1a813ddce9807b837cc3abc7a70c01cc77fe2dad57fab85c2d003153aacab9604b4628e8

Download Submit
C:\Windows\Installer\MSI1D0F.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\f77f555.msi

Filesize
23.7MB

MD5
be00cfa1c1c00e0bf9a0e72256d4400d

SHA1
c8674eaf587398e9a3935ac335d038bbe5ce20f1

SHA256
f7eb9a79c883c031af8088fbe092c5385e25c14fa99162f96e40cb8bd90dee1a

SHA512
97c7ca8505577d53e6d86eadc50133466bce548b9cac78b6dbf9a190e4380a162a6b9ef162b3f7ad7aa3d761f8f892c5dbabb58bb695b3a262d5380d7c99b925

Download Submit
C:\Windows\Temp\{3930D55F-3CC2-4349-A259-691BB34906DB}\.ba\1033\thm.wxl

Filesize
5KB

MD5
f44c2959eeeff784d8aca917a909d906

SHA1
6eb702ff663a96eb915c31402345fab970d389d6

SHA256
835aa38b22480e84ccdf9f925ef2cd640e015bc2077674a6313c5175ea3db5be

SHA512
5ce766ad44454efd56f05461cb2ba019da0eacbdf938e8e803bd9296a48dd8eb7dc47d602a4ca9b210839a6e58fc19ea7ae1d9ef5f1f07b4cc6297214733496e

Download Submit
C:\Windows\Temp\{3930D55F-3CC2-4349-A259-691BB34906DB}\.be\dotnet-runtime-6.0.9-win-x86.exe

Filesize
609KB

MD5
daab4f7b31106690bd5c693f29382d39

SHA1
9d6eafe78ac9f7011c9e4c951fbb02406694dfa4

SHA256
8330060b0c9ac811bd24e4a0f3c37910a269de26909205098f5e13f017a4ddd9

SHA512
7cbe7db27dac6e1f4633a822c9b371fbd6f3eacf32d709321db7b86a59e35c077fb71e7f034025de4bffcfe3cc91652d51ebd73c0bcf797c9338654ee4f5a160

Download Submit
C:\Windows\Temp\{55FC637E-E6FF-4B6E-A711-3DAABEAEF0FB}\.be\aspnetcore-runtime-6.0.9-win-x64.exe

Filesize
593KB

MD5
8493e2e36fe68332841a3a2a95bfce0f

SHA1
8ab06a9d720f95dac1c51ab411075d80dcdc39c9

SHA256
dd2efa6598bc8456769c97b9fd2c552d1a34309f46ed4908021c023336a97783

SHA512
e4089675e6e62389755514b5897b6c3271938c63b6215400be9286d5edd0efbca23072e6e0288fd52c4e5d112b536aa01e31feb7e2d0ac94d2ba08acf74d62e9

Download Submit
C:\Windows\Temp\{6DA69F82-80FD-4C62-ACDE-A283BE81253D}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{6DA69F82-80FD-4C62-ACDE-A283BE81253D}\dotnet_host_6.0.9_win_x64.msi

Filesize
736KB

MD5
e5f80f960e2abd43d482a790a2959a9a

SHA1
32652cffdc38ae6db0962c7d57cf4dfa601af35b

SHA256
ab5bf859c7a0ea849d91130e07b3eac67d17cd53b04f3834f687c138cf38a1d1

SHA512
d4a2ddc51ff58d582be6bd04e0afd16dc3aa99fa56e32b74f3f21663168f1f5950b609db66de0257ddccc186c812c327b35159a47587c856cf22a1928c943c56

Download Submit
C:\Windows\Temp\{6DA69F82-80FD-4C62-ACDE-A283BE81253D}\dotnet_hostfxr_6.0.9_win_x64.msi

Filesize
804KB

MD5
5a3188e6b652dd98a36a6f767d2e63ca

SHA1
0b4bda83f6c96b517dab0eaaf6dcb85dcbaa9e00

SHA256
08f547fb8e9aa111c1d2d47b1a901580de2be768991c9abb6e2b3e70bc1c0a65

SHA512
9b5f46c0a99d630af3a68ca102f5d47d23bb6065254186b7c3ea6bdd324e0559beb1c5005371c69d105e360cb888566ba5e33c60074661585803e7a748cb1b25

Download Submit
C:\Windows\Temp\{6DA69F82-80FD-4C62-ACDE-A283BE81253D}\dotnet_runtime_6.0.9_win_x64.msi

Filesize
25.7MB

MD5
1f7bed49d2624871cf21edf8b12b7566

SHA1
4b777b92b2b59694684afb8ef09db5c71d58dc58

SHA256
97a51823412a43bbc732ee55a599a1d5549b4121bb1064a63a9b8568208c7fb0

SHA512
1f29b2e7a0b028083b56ed75942a347f861220e0c73f711e7c731b4c8e8897c89ab1618e87a1532d10b6300b27beca04826bb47ac20ac316f522e7de7fcdc0ae

Download Submit
C:\Windows\Temp\{74E07E9D-BF2B-4CA3-85B1-3AFC58BB4E84}\.ba\logo.png

Filesize
12KB

MD5
84709eb22e4b05688067699ca9b0d322

SHA1
7c3381d8b6a58087cda95577cc2d25e7aa2c21d8

SHA256
c8e23a42e04fbd73f5f66f3b9f2ba34a777bc4769c413a0f78335a4e757baad5

SHA512
04de70b7317ee1cbde73ac0fe84bd70983cf0ff7e769e5f9626c69eaa6e3e9724c95b14ccb7a5478ee639848d3f8c98e4dec599cc5e33ad71de638da589ba319

Download Submit
C:\Windows\Temp\{74E07E9D-BF2B-4CA3-85B1-3AFC58BB4E84}\DotNetRedistLts_x64

Filesize
26.6MB

MD5
2ff0fd0275d79b236ac64a1ccad64bb7

SHA1
a1d4b9adf3928f004aa0643daf17158d4cdead76

SHA256
1bfac43fd0261b702456596053410b03508186ad32303b309fc3b87172096e8f

SHA512
5f4a73342b3563937f2efb576aa101c29c0ad4908413ba87c415a733239b9af196ff04778f2e8bf5845508b069812c13ca281ea5e912552aab5227e7841e502d

Download Submit
C:\Windows\Temp\{74E07E9D-BF2B-4CA3-85B1-3AFC58BB4E84}\DotNetRedistLts_x86

Filesize
24.6MB

MD5
5997400ace5a664eb90d31e1609ac437

SHA1
1419164a3fbea58bcfaceeece63460d7461ad879

SHA256
aadd999314742c0f5b230cc63356b6d8e0b4aa71cc6faa43638d786ba2377d0d

SHA512
4a5ee2e0297140fb4b6064540cbb9d520c1b3bef474f8342dfc5aaed0fd85b7fe26c49f85d17686e85540d421da57eb2ae4d2b402c5184a6ef2eaded33b097a9

Download Submit
C:\Windows\Temp\{74E07E9D-BF2B-4CA3-85B1-3AFC58BB4E84}\SharedFxRedist_x64

Filesize
8.6MB

MD5
7ed77c5bb8f008e6765dae1c103fb14b

SHA1
45509a1e220c63b8f65d6f72e165174ccdc59070

SHA256
76cddc8cf1ef4956531d6bccb65df5dfe59be22cc439e4d6686595fac054564b

SHA512
e3fae121878e5d98f49aeaa0a20b03ece760fcf75429256b7af13b78608eeaa2d2485578ed952a410cc590008023e62584233bad0e34e9fa632d445bce7fa1f5

Download Submit
C:\Windows\Temp\{74E07E9D-BF2B-4CA3-85B1-3AFC58BB4E84}\SharedFxRedist_x86

Filesize
7.9MB

MD5
44c2a3c76ea69b8f1c0b1db395757952

SHA1
2566e657c9967df19e516608767a3ddc6933ce55

SHA256
442888bb8764833f71864d48d6bfbd441ff7db464e2ccaf61a6439e432091d71

SHA512
493d9a5388a0e6bef4fed091465b58a5cc6d9c148478e5a9822d76eca61395cffa93ebadaec78c9f7e1da5ccecc00881baf10b757ca9c4eb9d475fb8ede7fc53

Download Submit
C:\Windows\Temp\{74E07E9D-BF2B-4CA3-85B1-3AFC58BB4E84}\WindowsServerHostingBundleOptions.msi

Filesize
44KB

MD5
08e63351868d34b340fcfcd8d5c52b75

SHA1
9539d03e58a779d27500ae019685942cb6d4a743

SHA256
ef0622655a54e338ed869c66e48c8824c03b5743646b0db380d8b5a2fcd7fec0

SHA512
b511711006ddd8f55d9d310aa57b0ab043e118b68c73087f8ee6f3c4e431921867784127559e276bbd9597633e5b045b32153d841008796fbc873e42d6a3aa38

Download Submit
C:\Windows\WindowsUpdate.log

Filesize
16KB

MD5
10cc9b1c3c46a0314edf7a8fc033fd8c

SHA1
d1d8d205063f280ef677e30febdafa211ff2a807

SHA256
00f2920d4a5ad4de2b6f26f87a81b7a814b0fb1c005b00a1586e0f47a4ee7537

SHA512
1c35af6ffd794be926f9d8bdc81019db9a79014978bb7b820e4f53eaf27d1a2e496bc29ecc41b10000a868682af46d46706d6ffe9d1b812a1aec7402c89689e5

Download Submit
\Program Files\dotnet\dotnet.exe

Filesize
133KB

MD5
a5b1796fee4ff7434fdcd854a05f067f

SHA1
ee8c72a40d479a2fab174f4a7b38b966a738ccb3

SHA256
80ca1322d87b2c812f021d3902989c0586f1aeab44c42c3e1485562d34aa59d2

SHA512
e64bd9540bfb761cb567fafe58a9a3ca93c2f6b315c14bd431bd66afe78a1386398332488198889f9b516539b76468594ce317f1a2b92717db9b453d7fa6ba9b

Download Submit
\Windows\Temp\{10D78516-FD0D-46E0-A83B-5FCDBD4C8DFF}\.cr\dotnet-runtime-6.0.9-win-x64.exe

Filesize
609KB

MD5
eb4202a5d3a8b7a4b9a49a9b78089545

SHA1
749946a511c97237c58c915a932fc15d8bd8f321

SHA256
f91cd40595eab85e74fa82cb295b361b41130e32fbb31083c8be2e9a561cc50e

SHA512
343e057e25cf0072eb919614c201f071c1f7af635fe9191f1ac8d70c90accf587e455914a0c9810dbd2136ba9bd841ada4c118cd20b285fcf2e6e07fcc5dda3f

Download Submit
\Windows\Temp\{74E07E9D-BF2B-4CA3-85B1-3AFC58BB4E84}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
\Windows\Temp\{C9379E71-FD44-4D1D-B97A-5ADDED07CA34}\.cr\dotnet-hosting-6.0.9-win.exe

Filesize
602KB

MD5
b9810e74bd6b9b49825d55031bb37f8b

SHA1
eaf6cc87cb8aceda354453b88b5f62982b384afb

SHA256
6652e34aeb25b439c8c1040002271e649bea5ccd398bf52213b27be1d7cdd9bd

SHA512
ec5f55a3d8e585f232c83e336f1c9a236ac84a2e68fc50e121da51d021aeef99cd927318f966e5fe351a779b3a35f9dda22575e36ab6dfeb5f36311bffca7d21

Download Submit