Overview

overview

8

Static

static

3

auto-creamapi.exe

windows10-1703-x64

8

auto-creamapi.exe

windows11-21h2-x64

1

Analysis

  • max time kernel
    85s
  • max time network
    99s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/08/2024, 11:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    auto-creamapi.exe

  • Size

    4.9MB

  • MD5

    2b4c2827a5e0afa08d55014d5d9f3976

  • SHA1

    6b182cda0dcb1511d0cf426eaa0126de2066af92

  • SHA256

    7f6e8ac3c2747443f91c0c2c7c7e3ca7335ba9090275b70619b5903316d537e0

  • SHA512

    f168c3123f1bc7a5d11b09332be13c8371ad2ad3fa9a8811727505212123d73d0d150924a7aa1386475048e69516b1b266633760c5403417d572858bb09a87f7

  • SSDEEP

    98304:siR6LPHMssoiHhKbWiVbMqhVvu8o9pcLFwiS:siUzM0iHhWWiVbMOVvu8ovcLFwiS

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\auto-creamapi.exe
    "C:\Users\Admin\AppData\Local\Temp\auto-creamapi.exe"
    1⤵
    • Checks computer location settings
    PID:3328
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4116
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-8.0.7-win-x64.exe
      "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-8.0.7-win-x64.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4864
      • C:\Windows\Temp\{5226A8EE-FBCF-4FE1-A998-11251416D077}\.cr\windowsdesktop-runtime-8.0.7-win-x64.exe
        "C:\Windows\Temp\{5226A8EE-FBCF-4FE1-A998-11251416D077}\.cr\windowsdesktop-runtime-8.0.7-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-8.0.7-win-x64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=584
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:592
        • C:\Windows\Temp\{7835309A-160D-4F55-B793-271AD8AC70DC}\.be\windowsdesktop-runtime-8.0.7-win-x64.exe
          "C:\Windows\Temp\{7835309A-160D-4F55-B793-271AD8AC70DC}\.be\windowsdesktop-runtime-8.0.7-win-x64.exe" -q -burn.elevated BurnPipe.{17F7DFFB-0E78-4A82-9827-BB25E57972E1} {2365379A-AA5B-4876-8CD4-4995CF0CC21B} 592
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4376
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4952
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4592
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:4604
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding BB8C0AD20D1778525075D942931A13A5
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4208
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding FB13EC6493C497588DDB6C98A17D94AB
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1556
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 937193C7F81CD1A451A6829D34FC748F
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2536
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 771CB200064B1F71A59406EC36D64872
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:200
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:5072
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\These.docx" /o ""
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:868

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e582b25.rbs
      Filesize

      47KB

      MD5

      99a8a783c767455295f4150b23e60a05

      SHA1

      af13fd089b2d16926b44262ef6e44024606fefa0

      SHA256

      8fe71f8f3ec1c75416faafd37c7b61ec20a6ad9286eba008c8f88cd1a2c2307a

      SHA512

      a1ba12dbc3360da31ef92f706d2ab2584805f1bf93b653c3a895a2dad76a9289ebe87c38a7385c0cc232b3036d888435c61311c7a122128bc2906ffabcfc970a

      Download Submit

    • C:\Config.Msi\e582b2a.rbs
      Filesize

      8KB

      MD5

      2079f7927043c92ca2aaecb19e7135a7

      SHA1

      9f2b6228f7834a6f3368cde49cdf0e9fd43a60b1

      SHA256

      0988ad35bf8bf1d2fc886464ebeb20a415be124b0bfccb5fc5c18f2b9967acda

      SHA512

      6de9a3eaf3e633f409c831ba88ea1071c5fbc71132426df673823b0ada1cf2b82843eb590b16e1967bb89150fc3f3819724469002914564452b0929c995debbc

      Download Submit

    • C:\Config.Msi\e582b2f.rbs
      Filesize

      9KB

      MD5

      eed5c710419d18146e2e8a249002609b

      SHA1

      4756c91d25d4807ab401759e8b7c0248d6820374

      SHA256

      cbd2d8f5303730c4c77806ca66bb134b02ebbcdd63eda288b222ccb51d754cc5

      SHA512

      05b0735db46929f402be843590a63346168ece37333ed2a3dee4618ade9082a8ec8a29e185825c0a9da1be9cf424520203b8a76ce45426519a2c1950bbf0c60a

      Download Submit

    • C:\Config.Msi\e582b34.rbs
      Filesize

      85KB

      MD5

      06339f82ef991d107a8174cff850baa5

      SHA1

      a8c23a8c806b3076022d1274f9a633d3516f2274

      SHA256

      194740b6745699c1448eaa8a0ff148bc84d4aaa9d4ad5422a703155806b06674

      SHA512

      d90398f68f954dbeb31375dba1c69af2bdb370af3a565273566cb3ed0b0c99b0ba1d88a876cf155d45e0e7c8db63815d370c042c7ceafeb2e3ae967f361aba8d

      Download Submit

    • C:\Program Files\dotnet\LICENSE.txt
      Filesize

      9KB

      MD5

      31c5a77b3c57c8c2e82b9541b00bcd5a

      SHA1

      153d4bc14e3a2c1485006f1752e797ca8684d06d

      SHA256

      7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

      SHA512

      ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

      Download Submit

    • C:\Program Files\dotnet\ThirdPartyNotices.txt
      Filesize

      93KB

      MD5

      90630d9ee3e0a5672166a45e00f79a5f

      SHA1

      d1148f8c7558e9b8a81bf1f50f9e3bed89d9928c

      SHA256

      1271701f435f7fe4aa81dc7e273ca80b6391b73580ee20b35a956052c95de4cf

      SHA512

      29e10bd57d1c580ece70b9b7c4a69dc036a5a64012eb89ba360a71be6b808150610ea0737351277a3d4235c02323fabef29f092fa6b2a40f0289f55a7973e93d

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E49JWOHD\edgecompatviewlist[1].xml
      Filesize

      74KB

      MD5

      d4fc49dc14f63895d997fa4940f24378

      SHA1

      3efb1437a7c5e46034147cbbc8db017c69d02c31

      SHA256

      853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

      SHA512

      cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\WUMFPYR3\dotnet.microsoft[1].xml
      Filesize

      13B

      MD5

      c1ddea3ef6bbef3e7060a1a9ad89e4c5

      SHA1

      35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

      SHA256

      b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

      SHA512

      6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\WUMFPYR3\dotnet.microsoft[1].xml
      Filesize

      84B

      MD5

      57324eb135e493da5986107f3f4e36f2

      SHA1

      f3a948e0de74c6c20b6f9aa343e1e9b97fb7d697

      SHA256

      60c73b1d684f6c9cb2fd3ee36c2c67a346b26e81ae4676f8a1f19415775e5d7e

      SHA512

      5700426ca3a45f9484b55b52f178604802b4da3f1005438500fbd3f9bee9c131e3d6ead5ae2bcc58adb23df41168b189db67001dfb6b3745270f07ada4c3f823

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\YWCI917P\suggestions[1].en-US
      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\DAT0HHQ0\windowsdesktop-runtime-8.0.7-win-x64[1].exe
      Filesize

      112KB

      MD5

      39f57231d00be49ce10ca00bfba87938

      SHA1

      002005b37a4b3c15d105936d7c6f552d50d4100e

      SHA256

      40518396f71c06ff06dc0c0ab53720447f41638e64acdddf83d25421ae1992c5

      SHA512

      c1503e1d1e64fcc0d558893d6f370ed198ca54e49a46a79b6402f10d9492f29cd7d6d7b414d0d4f38735942a320eeae71b221c1c6d5443c0013f92c936d76fdb

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.7_(x64)_20240812113321_000_dotnet_runtime_8.0.7_win_x64.msi.log
      Filesize

      2KB

      MD5

      5292e037453722729920dff335bcc6c0

      SHA1

      172c3167ab3f583bb6c6935a8c1375e6026d9612

      SHA256

      f14e9f3765f49df494766fe6e407f355f71ec179b84cd1c066276c953ddbaee1

      SHA512

      e5e46d91832348bc0f4f7ceb26a6b24ad963cad317f123312ba94f570aab6a26fc95979376535ea7a214f1f2510b322066aace66fb35e1eddeab923ae685bd64

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.7_(x64)_20240812113321_001_dotnet_hostfxr_8.0.7_win_x64.msi.log
      Filesize

      2KB

      MD5

      ab223d2aa085597ed69b1c94aca5ba9b

      SHA1

      139923fc249a3ddb3366b1bf9601dbea2689d533

      SHA256

      85c89a419b33f9534536be680cc11b237c41c2908f2e0d6f540a8448ea104e90

      SHA512

      ac7ffb6fd94e8c739e4359c630dde447d6c6a7cbba06ff401fbbcd1f619b47859b714810a8a6132b0fa952d9c70a78a27838f31738cbc9ea763157f62c75aa0b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.7_(x64)_20240812113321_002_dotnet_host_8.0.7_win_x64.msi.log
      Filesize

      2KB

      MD5

      5ec7d18eb9cefd1a3fc505f80317f5fa

      SHA1

      a6efa52ea55854b6fbf9e1140c48a1a3269e3753

      SHA256

      c9cef5d14718069321c8328f60359185228ae88588ee83f3b1eb47e65ac10fcc

      SHA512

      cf9b69e0e563a7f66d648032f26878219a7c6b0cd9d3639f1aeeb8a28932cd4247528b988d5ffa6cb0b54f3fe4b53faa28a367183355680c759564c528955c6e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.7_(x64)_20240812113321_003_windowsdesktop_runtime_8.0.7_win_x64.msi.log
      Filesize

      2KB

      MD5

      ed99c30ad5566ef1c848373921824da8

      SHA1

      f06cb03c58e6f9feadda6572ac26d991a342c44c

      SHA256

      f5a4b9b80ae7a987dad18559fc241534f941a420a84b60973ce19d0f788bbfc9

      SHA512

      691808f55e9959d3977b8da17408c8cb9c9468a2e5c9137b755fe24d7faa1ac417f0ebd3db81d03eda8ccba3890bd3552e8869485506f1c43c6bc054819597f9

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
      Filesize

      224B

      MD5

      e66d36cbcfd69fdf8db6e5c649137ef1

      SHA1

      c1ce08cca33347fe58f95f78f61c31ac6501f511

      SHA256

      15376656ff62df570727bcac73caf451fbe0599729bb4bf648b5e65b3e97f5f4

      SHA512

      78a8c44885ce2f1a035a3075a50027d6eff5c1adbc4d4d134880b1aced5e5d0f70fb6ca8cb037327ec4890a392b3be84eb85c72f38d4cfac985afab64b7c81bc

      Download Submit

    • C:\Windows\Installer\MSI2FB6.tmp
      Filesize

      244KB

      MD5

      60e8c139e673b9eb49dc83718278bc88

      SHA1

      00a3a9cd6d3a9f52628ea09c2e645fe56ee7cd56

      SHA256

      b181b6b4d69a53143a97a306919ba1adbc0b036a48b6d1d41ae7a01e8ef286cb

      SHA512

      ac7cb86dbf3b86f00da7b8a246a6c7ef65a6f1c8705ea07f9b90e494b6239fb9626b55ee872a9b7f16575a60c82e767af228b8f018d4d7b9f783efaccca2b103

      Download Submit

    • C:\Windows\Temp\{5226A8EE-FBCF-4FE1-A998-11251416D077}\.cr\windowsdesktop-runtime-8.0.7-win-x64.exe
      Filesize

      635KB

      MD5

      1021bcdda151fb3bad0513d8311dff8c

      SHA1

      fc93405fc3d52f48f13375e2aa637fdc64afd5c9

      SHA256

      ab0d30eeaad5eb3d1c697097e6099fe81cd303c5ba26d7d88168201163b1fff4

      SHA512

      d4500e7a7ecfac6aa0e944de3b197f7336db3327b012b5ed48ba1dd9f3f892e243da7a1785f60dd29895c0853d6313bbe9a6f131b95f91a75b9f92fcee01e361

      Download Submit

    • C:\Windows\Temp\{7835309A-160D-4F55-B793-271AD8AC70DC}\.ba\bg.png
      Filesize

      4KB

      MD5

      9eb0320dfbf2bd541e6a55c01ddc9f20

      SHA1

      eb282a66d29594346531b1ff886d455e1dcd6d99

      SHA256

      9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

      SHA512

      9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

      Download Submit

    • C:\Windows\Temp\{7835309A-160D-4F55-B793-271AD8AC70DC}\dotnet_host_8.0.7_win_x64.msi
      Filesize

      780KB

      MD5

      52f0cb6ac56340fedbf77a9d1653d919

      SHA1

      268b00119515945b5750ec9ae4576fca24fa479f

      SHA256

      d2c403c8806e8ed4a079d7c67207583adaca5fc4ab6506c18fe2ab20e1b6a101

      SHA512

      03fcde710450ed9dd3cdf1d4ee053d53a8ae98f24cff9fcdf633dd655833a42c4dfeb025bc436a1a354b320ce794896d8b361bb37702f4a34c459b1a72b06c2f

      Download Submit

    • C:\Windows\Temp\{7835309A-160D-4F55-B793-271AD8AC70DC}\dotnet_hostfxr_8.0.7_win_x64.msi
      Filesize

      848KB

      MD5

      252e3786ee9fc41797fbcf5d3db65d74

      SHA1

      bca98a5e954f25c9d2e6a64c2b1a7c73607de9c6

      SHA256

      c4ba08d8e05f2edb85f92571d20dbaecac55ce90531539dd60e591c113e96ba5

      SHA512

      4dd35a7d601505ad029b4f1e116dab34be43fb725673d8a3de6e851e6fef1967a4f7e8fb1a06250f66d779ce0ec818fc42e809205741055eb9152bebca799f6b

      Download Submit

    • C:\Windows\Temp\{7835309A-160D-4F55-B793-271AD8AC70DC}\dotnet_runtime_8.0.7_win_x64.msi
      Filesize

      26.3MB

      MD5

      cedca35d058e4e4f50bf65e3c969f3bd

      SHA1

      605620ebf5e037811cca56516bb34fecefada830

      SHA256

      bed9f4dcf3e5f2631f0dc85ff02d6e4f94355b5eae06797d1c3b59efa3ffcccf

      SHA512

      82ed592a17c09c0552c7eed85c19989cc743cf43a7369297c73815d289d02b3c3e2255159a29e2dfe0358f302c39f136ae93a4c2f915f1186b1f4f647aaa1b63

      Download Submit

    • C:\Windows\Temp\{7835309A-160D-4F55-B793-271AD8AC70DC}\windowsdesktop_runtime_8.0.7_win_x64.msi
      Filesize

      29.1MB

      MD5

      ca48e6e1ad0edbb9100d0e6377fac11c

      SHA1

      d87f353747ee47721636ca6dc252b9c5c5db6fde

      SHA256

      0ed78af29c5e9c5fd79c1e68c3ab08996435312dae5ef3aeb079a5503e6d701e

      SHA512

      b2ed00f935654eaf8dabaa37a0499bf4253aa9d2f0236ff494910fa232c37437013ed87793b2e7e1481ab636bbed7735e9fb8cc014b1bd39a398550977920bf4

      Download Submit

    • \Windows\Temp\{7835309A-160D-4F55-B793-271AD8AC70DC}\.ba\wixstdba.dll
      Filesize

      215KB

      MD5

      f68f43f809840328f4e993a54b0d5e62

      SHA1

      01da48ce6c81df4835b4c2eca7e1d447be893d39

      SHA256

      e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

      SHA512

      a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

      Download Submit

    • memory/868-1152-0x00007FFC4EDD0000-0x00007FFC4EDE0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/868-1149-0x00007FFC4EDD0000-0x00007FFC4EDE0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/868-1150-0x00007FFC4EDD0000-0x00007FFC4EDE0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/868-1151-0x00007FFC4EDD0000-0x00007FFC4EDE0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/868-1155-0x00007FFC4BFF0000-0x00007FFC4C000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/868-1156-0x00007FFC4BFF0000-0x00007FFC4C000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4116-35-0x0000019D19C90000-0x0000019D19C92000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4116-1127-0x0000019D236E0000-0x0000019D236E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4116-1128-0x0000019D236F0000-0x0000019D236F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4116-16-0x0000019D1C720000-0x0000019D1C730000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4116-0-0x0000019D1C620000-0x0000019D1C630000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4592-42-0x000001FAA71C0000-0x000001FAA72C0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4592-43-0x000001FAA71C0000-0x000001FAA72C0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4604-358-0x000001C13EE10000-0x000001C13EE12000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-168-0x000001C143EB0000-0x000001C143EB2000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-174-0x000001C1440A0000-0x000001C1440A2000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-176-0x000001C1440C0000-0x000001C1440C2000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-178-0x000001C1440E0000-0x000001C1440E2000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-164-0x000001C143E70000-0x000001C143E72000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-166-0x000001C143E90000-0x000001C143E92000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-162-0x000001C143E50000-0x000001C143E52000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-170-0x000001C143EC0000-0x000001C143EC2000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-172-0x000001C143EE0000-0x000001C143EE2000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-184-0x000001C13F780000-0x000001C13F880000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4604-271-0x000001C144C00000-0x000001C144C20000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4604-356-0x000001C13EE00000-0x000001C13EE02000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-354-0x000001C143C90000-0x000001C143C92000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-352-0x000001C143C80000-0x000001C143C82000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-350-0x000001C143C70000-0x000001C143C72000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-347-0x000001C13EF10000-0x000001C13EF12000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4604-319-0x000001C144980000-0x000001C1449A0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4604-234-0x000001C144370000-0x000001C144470000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4604-272-0x000001C144C00000-0x000001C144C20000-memory.dmp

      Filesize

      128KB

      Download