hxxps://zomeowrara[.]b-cdn[.]net/meowrara2[.]6[.]ziphxxps://download[.]visualstudio[.]microsoft[.]com/download/pr/93961dfb-d1e0-49c8-9230-abcba1ebab5a/811ed1eb63d7652325727720edda26a8/dotnet-sdk-8[.]0[.]100-win-x64[.]exehxxps://aka[.]ms/vs/17/release/vc_redist[.]x64[.]exe

Analysis

max time kernel
784s
max time network
783s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://zomeowrara.b-cdn.net/meowrara2.6.ziphttps://download.visualstudio.microsoft.com/download/pr/93961dfb-d1e0-49c8-9230-abcba1ebab5a/811ed1eb63d7652325727720edda26a8/dotnet-sdk-8.0.100-win-x64.exehttps://aka.ms/vs/17/release/vc_redist.x64.exe

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	dotnet-sdk-8.0.100-win-x64.exe

Executes dropped EXE 6 IoCs

pid	Process
440	VC_redist.x64.exe
636	VC_redist.x64.exe
4384	VC_redist.x64.exe
4796	dotnet-sdk-8.0.100-win-x64.exe
4244	dotnet-sdk-8.0.100-win-x64.exe
4624	dotnet-sdk-8.0.100-win-x64.exe

Loads dropped DLL 64 IoCs

pid	Process
636	VC_redist.x64.exe
1212	VC_redist.x64.exe
4244	dotnet-sdk-8.0.100-win-x64.exe
1148	MsiExec.exe
1148	MsiExec.exe
2676	MsiExec.exe
2676	MsiExec.exe
4264	MsiExec.exe
4264	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
180	MsiExec.exe
180	MsiExec.exe
4028	MsiExec.exe
4028	MsiExec.exe
4904	MsiExec.exe
2492	MsiExec.exe
2492	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
2532	MsiExec.exe
1712	MsiExec.exe
4048	MsiExec.exe
3492	MsiExec.exe
4780	MsiExec.exe
1656	MsiExec.exe
3908	MsiExec.exe
4556	MsiExec.exe
552	MsiExec.exe
4532	MsiExec.exe
640	MsiExec.exe
1848	MsiExec.exe
4604	MsiExec.exe
4532	MsiExec.exe
5012	MsiExec.exe
2488	MsiExec.exe
844	MsiExec.exe
3748	dotnet.exe
3748	dotnet.exe
3748	dotnet.exe
3748	dotnet.exe
3748	dotnet.exe
3748	dotnet.exe
3748	dotnet.exe
3748	dotnet.exe
3748	dotnet.exe
3748	dotnet.exe
3748	dotnet.exe
3748	dotnet.exe
3748	dotnet.exe
3748	dotnet.exe
2488	MsiExec.exe
2920	MsiExec.exe
4920	ZoraraUI.exe
4920	ZoraraUI.exe
4920	ZoraraUI.exe
532	ZoraraUI.exe
532	ZoraraUI.exe
532	ZoraraUI.exe
532	ZoraraUI.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
432	firefox.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{5af95fd8-a22e-458f-acee-c61bd787178e} = "\"C:\\ProgramData\\Package Cache\\{5af95fd8-a22e-458f-acee-c61bd787178e}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4ed4e1d0-c247-4755-a5e1-154125b40f68} = "\"C:\\ProgramData\\Package Cache\\{4ed4e1d0-c247-4755-a5e1-154125b40f68}\\dotnet-sdk-8.0.100-win-x64.exe\" /burn.runonce"	dotnet-sdk-8.0.100-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 22 IoCs

pid	Process
4920	ZoraraUI.exe
4920	ZoraraUI.exe
532	ZoraraUI.exe
532	ZoraraUI.exe
2616	ZoraraUI.exe
2616	ZoraraUI.exe
1520	ZoraraUI.exe
1520	ZoraraUI.exe
5624	ZoraraUI.exe
5624	ZoraraUI.exe
6116	ZoraraUI.exe
6116	ZoraraUI.exe
4216	ZoraraUI.exe
4216	ZoraraUI.exe
640	ZoraraUI.exe
640	ZoraraUI.exe
5740	ZoraraUI.exe
5740	ZoraraUI.exe
5192	ZoraraUI.exe
5192	ZoraraUI.exe
5300	ZoraraUI.exe
5300	ZoraraUI.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\8.0.0\analyzers\dotnet\cs\pt-BR\Microsoft.Interop.LibraryImportGenerator.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\analyzers\build\config\analysislevelmaintainability_8_minimum.globalconfig	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\analyzers\build\config\analysislevelperformance_9_none_warnaserror.globalconfig	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\TestHostNetFramework\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\8.0.0\ref\net8.0\System.ServiceProcess.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\TestHostNetFramework\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\tools\net8.0\zh-Hant\Microsoft.NET.Build.Tasks.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\analyzers\build\config\analysislevelperformance_7_all_warnaserror.globalconfig	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\tools\net8.0\fr\Microsoft.NET.Build.Tasks.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk.WindowsDesktop\targets\Microsoft.WinFX.targets	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Extensions\zh-Hans\Microsoft.TestPlatform.TestHostRuntimeProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\analyzers\build\config\analysislevelmaintainability_7_recommended.globalconfig	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\System.CommandLine.dll	msiexec.exe
File created	C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\8.0.0\ref\net8.0\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\8.0.0\ref\net8.0\Microsoft.Extensions.Diagnostics.Abstractions.dll	msiexec.exe
File created	C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\8.0.0\ref\net8.0\Microsoft.Extensions.Logging.EventSource.xml	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\TestHostNetFramework\fr\Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\codestyle\cs\ru\Microsoft.CodeAnalysis.CSharp.CodeStyle.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\tools\net8.0\pt-BR\Microsoft.DotNet.ApiSymbolExtensions.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Console.dll	msiexec.exe
File created	C:\Program Files\dotnet\packs\Microsoft.NETCore.App.Ref\8.0.0\analyzers\dotnet\cs\tr\Microsoft.Interop.ComInterfaceGenerator.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\NuGet.props	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Containers\tasks\net8.0\de\System.CommandLine.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\pl\NuGet.Build.Tasks.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\8.0.0\ref\net8.0\Microsoft.Extensions.Configuration.UserSecrets.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\pt-BR\NuGet.Packaging.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Microsoft\Microsoft.NET.Build.Extensions\net471\lib\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\DotnetTools\dotnet-format\Microsoft.Extensions.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\.version	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Microsoft\Microsoft.NET.Build.Extensions\net461\lib\System.ComponentModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\8.0.0\ref\net8.0\Microsoft.AspNetCore.Mvc.RazorPages.dll	msiexec.exe
File created	C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\8.0.0\ref\net8.0\Microsoft.Extensions.Configuration.CommandLine.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\zh-Hans\NuGet.Build.Tasks.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\pl\NuGet.Localization.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\DotnetTools\dotnet-watch\8.0.100-rtm.23551.6\tools\net8.0\any\cs\Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\es\Microsoft.VisualStudio.TestPlatform.Common.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\targets\Microsoft.NET.GenerateSupportedRuntime.targets	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\tools\net472\cs\Microsoft.DotNet.ApiCompat.Task.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Microsoft\Microsoft.NET.Build.Extensions\net461\lib\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\TestHostNetFramework\fr\Microsoft.TestPlatform.Utilities.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\de\NuGet.DependencyResolver.Core.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\TestHostNetFramework\testhost.net472.x86.exe	msiexec.exe
File created	C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\8.0.0\ref\net8.0\Microsoft.AspNetCore.WebSockets.xml	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\tr\dotnet.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\fr\NuGet.DependencyResolver.Core.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk.StaticWebAssets\targets\Microsoft.NET.Sdk.StaticWebAssets.Pack.targets	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\tools\net8.0\de\Microsoft.Deployment.DotNet.Releases.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\packs\NETStandard.Library.Ref\2.1.0\ref\netstandard2.1\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\packs\Microsoft.AspNetCore.App.Ref\8.0.0\ref\net8.0\Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\pl\NuGet.VisualStudio.Contracts.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\TestHostNetFramework\ko\Microsoft.TestPlatform.CoreUtilities.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\NuGet.Build.Tasks.Pack\Desktop\tr\NuGet.Build.Tasks.Pack.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\analyzers\build\config\analysislevelreliability_9_recommended_warnaserror.globalconfig	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\pt-BR\MSBuild.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.SourceLink.Bitbucket.Git\tools\core\tr\Microsoft.SourceLink.Bitbucket.Git.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Containers\tasks\net472\es\Microsoft.NET.Build.Containers.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\analyzers\build\config\analysislevelinteroperability_7_all.globalconfig	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk.Razor\tasks\net472\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Containers\containerize\cs\Microsoft.DotNet.Cli.Utils.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\tools\net472\System.Reflection.MetadataLoadContext.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIAA45.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a6456.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3C7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a6479.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE501.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE93.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B01.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{94F8FDDD-75C8-4F48-A3AC-72BFA6F2E48C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC195.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a6460.msi	msiexec.exe
File created	C:\Windows\Installer\e5a648c.msi	msiexec.exe
File created	C:\Windows\Installer\e5a63fb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE727.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C2F3E829-9288-4084-8C79-07138BBBA7AA}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9CE4EBE1-15A9-3826-8A52-FED034B90D4E}	msiexec.exe
File created	C:\Windows\Installer\e5a6465.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a6488.msi	msiexec.exe
File created	C:\Windows\Installer\e5a6469.msi	msiexec.exe
File created	C:\Windows\Installer\e5a647d.msi	msiexec.exe
File created	C:\Windows\Installer\e5a6491.msi	msiexec.exe
File created	C:\Windows\Installer\e5a64a1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED59.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{14D90F72-E3CF-4794-97F9-5DA50D7DBC76}	msiexec.exe
File created	C:\Windows\Installer\e5a6438.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB71D.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a6474.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0B0701B8-EC7A-4311-A718-A0636F4EF6DE}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE550.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2D62FC42-AA39-47C2-A75F-0BC87BD0965F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC24.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a647e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB14.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEED2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a6451.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a6465.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{711D22DB-11E2-42CC-9731-7A513864C5FD}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A7036CFB-B403-4598-85FF-D397ABB88173}	msiexec.exe
File created	C:\Windows\Installer\e5a6447.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE009.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE98C.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a6428.msi	msiexec.exe
File created	C:\Windows\Installer\e5a642d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE153.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE406.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a6479.msi	msiexec.exe
File created	C:\Windows\Installer\e5a6482.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI69E7.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{34375ABA-16A8-4315-A661-AF352F333BC3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC02D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a646a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5AEF.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6C211254-1E07-422D-8786-72F8A2642B9A}	msiexec.exe
File created	C:\Windows\Installer\e5a6424.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI958E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3BD.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a6437.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE26D.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a6487.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a649c.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B821693C-E093-4A71-A221-2A2D6A299795}	msiexec.exe
File created	C:\Windows\Installer\e5a6473.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5a640e.msi	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\dotnet-sdk-8.0.100-win-x64.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-sdk-8.0.100-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-sdk-8.0.100-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-sdk-8.0.100-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 61 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\44	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\42	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\41	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\43	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\39	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\38	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\40	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\42	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\36	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\40	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\41	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\43	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\F84DEC95EFBEC084A883CF70C9B2CEF0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\048607A32882C32409BE3B51542ECBA7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\68BA497DB65D6344ABF591433BBBE5CC	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F01E87B9F014AC4D9E17B9ABF50AB22\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA573438A6151346A16FA53F233B33C\ProductName = "Microsoft .NET AppHost Pack - 8.0.0 (x64_arm64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.0.5329_x64\DisplayName = "Microsoft Windows Desktop Runtime - 8.0.0 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDA0C311DB9B59F46935F4B55C04DE30\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.NET.Workload.Mono.ToolChain.net6,8.0.100,8.0.0,x64\ = "{9C4F31F1-8819-4E71-BE7A-39785F88EBC8}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9801109FE4BA8A349068364015FDBA5\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_64.0.5329_x64	dotnet-sdk-8.0.100-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F627D57B2F2698542A3505ABE25C09C3\Version = "3974105504"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F627D57B2F2698542A3505ABE25C09C3\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1F13F4C9918817E4EBA79387F588BE8C\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\64773797328752435A17AC382AEADCD1\928E3F2C88294804C8977031B8BB7AAA	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\IconSize = "48"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\PackageCode = "A40E8013387385E43AA0F61A9357B166"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1EBE4EC99A516283A825EF0D439BD0E4\SourceList\PackageName = "aspnetcore-targeting-pack-8.0.0-rtm.23531.12-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1EBE4EC99A516283A825EF0D439BD0E4\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3FB2F18AA08BE237B7EE0B9D4DBDA90\9B088578824AFCF4A954C5F37C9DC511	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9801109FE4BA8A349068364015FDBA5\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.NET.Sdk.Android,8.0.100-rc.2,34.0.0-rc.2.468,x64	dotnet-sdk-8.0.100-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C396128B390E17A42A12A2D2A6927959\Version = "1073745629"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.NET.Workload.Emscripten.Current,8.0.100,8.0.0,x64\Dependents	dotnet-sdk-8.0.100-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\928E3F2C88294804C8977031B8BB7AAA\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1EBE4EC99A516283A825EF0D439BD0E4\FT_AspNetCoreTargetingPack	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A214A7F0BB036664D9A89750C392E54A\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD22D1172E11CC247913A71583465CDF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24CF26D293AA2C747AF5B08CB70D69F5\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27F09D41FC3E4974799FD55AD0D7CB67\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F84DEC95EFBEC084A883CF70C9B2CEF0\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\68BA497DB65D6344ABF591433BBBE5CC\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.AspNetCore.TargetingPack_x64_en_US.UTF-8,v8.0.0-rtm.23531.12\DisplayName = "Microsoft ASP.NET Core 8.0.0 Targeting Pack (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3F01E87B9F014AC4D9E17B9ABF50AB22\ProductName = "Microsoft.NET.Sdk.iOS.Manifest-8.0.100-rc.2 (x64)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3BAEED67F2211324387CC05363D3209F\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F627D57B2F2698542A3505ABE25C09C3\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24CF26D293AA2C747AF5B08CB70D69F5\PackageCode = "5D191849CA47D73458221BA2127C7155"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption."	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDA0C311DB9B59F46935F4B55C04DE30\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.NET.Sdk.Aspire,8.0.100,8.0.0-preview.1.23551.7,x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D9801109FE4BA8A349068364015FDBA5\FT_ProductInfo	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\048607A32882C32409BE3B51542ECBA7\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68BA497DB65D6344ABF591433BBBE5CC\ProductName = "Microsoft .NET AppHost Pack - 8.0.0 (x64_x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\048607A32882C32409BE3B51542ECBA7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA573438A6151346A16FA53F233B33C\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_8.1.23.55115_x64\Version = "32.6.61899"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings."	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\70F18F74BD256A37057A458CA106486B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\31449DD3AE135714AB54806AEC4D6DD8\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.NET.Workload.Mono.ToolChain.Current,8.0.100,8.0.0,x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9801109FE4BA8A349068364015FDBA5\Version = "134217728"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27F09D41FC3E4974799FD55AD0D7CB67\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.0.4211_x64\Dependents\{4ed4e1d0-c247-4755-a5e1-154125b40f68}	dotnet-sdk-8.0.100-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68BA497DB65D6344ABF591433BBBE5CC\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{D794AB86-D56B-4436-BA5F-1934B3BB5ECC}v64.0.4211\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24CF26D293AA2C747AF5B08CB70D69F5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1F13F4C9918817E4EBA79387F588BE8C\ProductName = "Microsoft.NET.Workload.Mono.Toolchain.net6.Manifest (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.NET.Workload.Mono.ToolChain.net6,8.0.100,8.0.0,x64\Dependents	dotnet-sdk-8.0.100-win-x64.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\meowrara2.6.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\dotnet-sdk-8.0.100-win-x64.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4788	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe
664	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5888	OpenWith.exe
4788	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	firefox.exe
Token: SeDebugPrivilege	4656	firefox.exe
Token: SeDebugPrivilege	4656	firefox.exe
Token: SeDebugPrivilege	4656	firefox.exe
Token: SeDebugPrivilege	4656	firefox.exe
Token: SeDebugPrivilege	4656	firefox.exe
Token: SeBackupPrivilege	1904	vssvc.exe
Token: SeRestorePrivilege	1904	vssvc.exe
Token: SeAuditPrivilege	1904	vssvc.exe
Token: SeShutdownPrivilege	4384	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	4384	VC_redist.x64.exe
Token: SeSecurityPrivilege	664	msiexec.exe
Token: SeCreateTokenPrivilege	4384	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	4384	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	4384	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	4384	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	4384	VC_redist.x64.exe
Token: SeTcbPrivilege	4384	VC_redist.x64.exe
Token: SeSecurityPrivilege	4384	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	4384	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	4384	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	4384	VC_redist.x64.exe
Token: SeSystemtimePrivilege	4384	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	4384	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	4384	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	4384	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	4384	VC_redist.x64.exe
Token: SeBackupPrivilege	4384	VC_redist.x64.exe
Token: SeRestorePrivilege	4384	VC_redist.x64.exe
Token: SeShutdownPrivilege	4384	VC_redist.x64.exe
Token: SeDebugPrivilege	4384	VC_redist.x64.exe
Token: SeAuditPrivilege	4384	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	4384	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	4384	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	4384	VC_redist.x64.exe
Token: SeUndockPrivilege	4384	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	4384	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	4384	VC_redist.x64.exe
Token: SeManageVolumePrivilege	4384	VC_redist.x64.exe
Token: SeImpersonatePrivilege	4384	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	4384	VC_redist.x64.exe
Token: SeRestorePrivilege	664	msiexec.exe
Token: SeTakeOwnershipPrivilege	664	msiexec.exe
Token: SeRestorePrivilege	664	msiexec.exe
Token: SeTakeOwnershipPrivilege	664	msiexec.exe
Token: SeRestorePrivilege	664	msiexec.exe
Token: SeTakeOwnershipPrivilege	664	msiexec.exe
Token: SeRestorePrivilege	664	msiexec.exe
Token: SeTakeOwnershipPrivilege	664	msiexec.exe
Token: SeRestorePrivilege	664	msiexec.exe
Token: SeTakeOwnershipPrivilege	664	msiexec.exe
Token: SeRestorePrivilege	664	msiexec.exe
Token: SeTakeOwnershipPrivilege	664	msiexec.exe
Token: SeRestorePrivilege	664	msiexec.exe
Token: SeTakeOwnershipPrivilege	664	msiexec.exe
Token: SeRestorePrivilege	664	msiexec.exe
Token: SeTakeOwnershipPrivilege	664	msiexec.exe
Token: SeRestorePrivilege	664	msiexec.exe
Token: SeTakeOwnershipPrivilege	664	msiexec.exe
Token: SeRestorePrivilege	664	msiexec.exe
Token: SeTakeOwnershipPrivilege	664	msiexec.exe
Token: SeRestorePrivilege	664	msiexec.exe
Token: SeTakeOwnershipPrivilege	664	msiexec.exe
Token: SeRestorePrivilege	664	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
636	VC_redist.x64.exe
4244	dotnet-sdk-8.0.100-win-x64.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
3472	firefox.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of SetWindowsHookEx 44 IoCs

pid	Process
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
4656	firefox.exe
3472	firefox.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
5888	OpenWith.exe
4560	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4656	4928	firefox.exe	83
PID 4928 wrote to memory of 4656	4928	firefox.exe	83
PID 4928 wrote to memory of 4656	4928	firefox.exe	83
PID 4928 wrote to memory of 4656	4928	firefox.exe	83
PID 4928 wrote to memory of 4656	4928	firefox.exe	83
PID 4928 wrote to memory of 4656	4928	firefox.exe	83
PID 4928 wrote to memory of 4656	4928	firefox.exe	83
PID 4928 wrote to memory of 4656	4928	firefox.exe	83
PID 4928 wrote to memory of 4656	4928	firefox.exe	83
PID 4928 wrote to memory of 4656	4928	firefox.exe	83
PID 4928 wrote to memory of 4656	4928	firefox.exe	83
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3520	4656	firefox.exe	84
PID 4656 wrote to memory of 3180	4656	firefox.exe	85
PID 4656 wrote to memory of 3180	4656	firefox.exe	85
PID 4656 wrote to memory of 3180	4656	firefox.exe	85
PID 4656 wrote to memory of 3180	4656	firefox.exe	85
PID 4656 wrote to memory of 3180	4656	firefox.exe	85
PID 4656 wrote to memory of 3180	4656	firefox.exe	85
PID 4656 wrote to memory of 3180	4656	firefox.exe	85
PID 4656 wrote to memory of 3180	4656	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://zomeowrara.b-cdn.net/meowrara2.6.ziphttps://download.visualstudio.microsoft.com/download/pr/93961dfb-d1e0-49c8-9230-abcba1ebab5a/811ed1eb63d7652325727720edda26a8/dotnet-sdk-8.0.100-win-x64.exehttps://aka.ms/vs/17/release/vc_redist.x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://zomeowrara.b-cdn.net/meowrara2.6.ziphttps://download.visualstudio.microsoft.com/download/pr/93961dfb-d1e0-49c8-9230-abcba1ebab5a/811ed1eb63d7652325727720edda26a8/dotnet-sdk-8.0.100-win-x64.exehttps://aka.ms/vs/17/release/vc_redist.x64.exe
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c514cb7d-c108-446d-a2b2-8a48f68c1e72} 4656 "\\.\pipe\gecko-crash-server-pipe.4656" gpu
    3⤵
    PID:3520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {696f3b9b-5949-4205-bd23-767f57f3498c} 4656 "\\.\pipe\gecko-crash-server-pipe.4656" socket
    3⤵
    - Checks processor information in registry
    PID:3180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3200 -childID 1 -isForBrowser -prefsHandle 3208 -prefMapHandle 3352 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d345a55-566d-4f97-941e-12cf33a6b7e6} 4656 "\\.\pipe\gecko-crash-server-pipe.4656" tab
    3⤵
    PID:4612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3624 -childID 2 -isForBrowser -prefsHandle 3616 -prefMapHandle 3612 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b7440cc-d78a-4bda-a11f-d390d49721b4} 4656 "\\.\pipe\gecko-crash-server-pipe.4656" tab
    3⤵
    PID:1064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4424 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4332 -prefMapHandle 4456 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45991e4f-9d5d-4bf7-82df-32145bba4c82} 4656 "\\.\pipe\gecko-crash-server-pipe.4656" utility
    3⤵
    - Checks processor information in registry
    PID:2424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5452 -childID 3 -isForBrowser -prefsHandle 5436 -prefMapHandle 5428 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {747968a3-6af6-4d10-a7eb-e15d900fb044} 4656 "\\.\pipe\gecko-crash-server-pipe.4656" tab
    3⤵
    PID:3008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 4 -isForBrowser -prefsHandle 5588 -prefMapHandle 5592 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc50fb6a-8ec4-479f-bc47-f728d763bbd9} 4656 "\\.\pipe\gecko-crash-server-pipe.4656" tab
    3⤵
    PID:3424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5772 -childID 5 -isForBrowser -prefsHandle 5780 -prefMapHandle 5784 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11f74bc6-c5f0-4ef4-86a9-cde99950899b} 4656 "\\.\pipe\gecko-crash-server-pipe.4656" tab
    3⤵
    PID:1864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3928 -childID 6 -isForBrowser -prefsHandle 5236 -prefMapHandle 5044 -prefsLen 30532 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ce0c604-4d88-4194-896f-a1d50035edf7} 4656 "\\.\pipe\gecko-crash-server-pipe.4656" tab
    3⤵
    PID:3832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6532 -childID 7 -isForBrowser -prefsHandle 6536 -prefMapHandle 6524 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dc53351-7e0c-480c-8735-016900a60d25} 4656 "\\.\pipe\gecko-crash-server-pipe.4656" tab
    3⤵
    PID:3564
- - C:\Users\Admin\Downloads\VC_redist.x64.exe
    "C:\Users\Admin\Downloads\VC_redist.x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:440
  - - C:\Windows\Temp\{B69ED7D9-8AAA-46A9-B6F7-846E1228CE15}\.cr\VC_redist.x64.exe
      "C:\Windows\Temp\{B69ED7D9-8AAA-46A9-B6F7-846E1228CE15}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=576 -burn.filehandle.self=676
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:636
    - - C:\Windows\Temp\{7209E27D-89C7-49F3-BF18-4F9CD6134E9C}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{7209E27D-89C7-49F3-BF18-4F9CD6134E9C}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D06C4B9F-EF0E-4BE4-A0D7-ACFECD9CCCDD} {216A074C-3920-4AE5-8CEB-97DE1ED5522D} 636
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4384
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1248 -burn.embedded BurnPipe.{D1BE4EDD-4CD9-456F-A75A-CD048898AF49} {7EAB0D27-3373-4043-969F-D52F7590CC16} 4384
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:180
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1248 -burn.embedded BurnPipe.{D1BE4EDD-4CD9-456F-A75A-CD048898AF49} {7EAB0D27-3373-4043-969F-D52F7590CC16} 4384
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1212
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{FD3F75E9-5529-4599-94BE-6950EE492776} {1D31C68F-3D2A-4BB7-8F9F-74A8314CD832} 1212
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2492
- - C:\Users\Admin\Downloads\dotnet-sdk-8.0.100-win-x64.exe
    "C:\Users\Admin\Downloads\dotnet-sdk-8.0.100-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4796
  - - C:\Windows\Temp\{91F9B05D-3B28-4973-86DF-5260F713080C}\.cr\dotnet-sdk-8.0.100-win-x64.exe
      "C:\Windows\Temp\{91F9B05D-3B28-4973-86DF-5260F713080C}\.cr\dotnet-sdk-8.0.100-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\dotnet-sdk-8.0.100-win-x64.exe" -burn.filehandle.attached=720 -burn.filehandle.self=724
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4244
    - - C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\.be\dotnet-sdk-8.0.100-win-x64.exe
        
        "C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\.be\dotnet-sdk-8.0.100-win-x64.exe" -q -burn.elevated BurnPipe.{37090BA0-B017-4BDA-BCAB-1A76059495A6} {8BC95E76-E196-48A4-9F3E-E5231E07018D} 4244
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4624

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:664
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D78B41719D1ABD625A3BC6FDBF767C80
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1148
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ADEE0694337CF1DD274711406F8FFB70
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2676
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 63DDD5095BFC1DD8DCDAAF0670DBA853
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4264
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E8FB96D395F49503EC6F428D861AD0DE
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4792
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8266B8C8CD353C3DD9AC6B5A4C789DE2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:180
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8955FCE0F48F06979859158D1CC13120
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4028
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6E14AC51A621C8D8A1978A164458A490
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4904
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2C87BEAEBB1E1A6ABE5E5AF9925D5763
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2492
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5650B70494A8675001002DBC3386F3C1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 51CBC1D3FE01272ECDE8F082FD3C790D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8855CA994F77E584C35199CC78251AEE
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1712
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 273B245921E52C9D5D57396C247887AB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4048
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BD5FBA2C7086799321BC93E3AEB6C2B4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3492
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 09F2C3A1F20A40BA908398D95CCE48F0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4780
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D78F71EAF18DDC839E5F4B11E0A16B14
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1656
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 91AD4BEB6A98E4BB273095B12CF3E370
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3908
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 54FB537F112D39B5239A8A4EC1ECDC48
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8D7CE9A375120689477B09A332496C6D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:552
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2E3BDBDB01802CE2AF0CB0F76CAE4D55
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7C689F4B7CE88767F5ADF6BCB14AC2C1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:640
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 62044390CB06B768609ACC18417F62FD
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1848
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C298ED0C596BCA7366F7D493A06C12B5
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4604
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3C27CD93706FE0576ED8A352B43E4E94
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2539A2F093FDC47E3126ED792AC8EDAB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5012
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4A11F6B016067B187923032FF92E0A39
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2488
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E568F23FA6ED383EC549FAB6BB770187 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:844
- - C:\Program Files\dotnet\dotnet.exe
    "C:\Program Files\dotnet\\dotnet.exe" exec "C:\Program Files\dotnet\\sdk\8.0.100\dotnet.dll" internal-reportinstallsuccess "C:\Users\Admin\Downloads\dotnet-sdk-8.0.100-win-x64.exe"
    3⤵
    - Loads dropped DLL
    PID:3748
  - - C:\Windows\system32\getmac.exe
      "C:\Windows\system32\getmac.exe"
      4⤵
      PID:4200
  - - C:\Windows\system32\getmac.exe
      "C:\Windows\system32\getmac.exe"
      4⤵
      PID:1712
  - - C:\Windows\system32\getmac.exe
      "C:\Windows\system32\getmac.exe"
      4⤵
      PID:2836
  - - C:\Windows\system32\getmac.exe
      "C:\Windows\system32\getmac.exe"
      4⤵
      PID:852
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 827190170105F319AA17A934C4CCF8B3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4180

C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe
"C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4920

C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe
"C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:532

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3236
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1944 -parentBuildID 20240401114208 -prefsHandle 1860 -prefMapHandle 1852 -prefsLen 24856 -prefMapSize 245077 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7f6db5d-a6f8-4153-9f25-f3cb650fcaf9} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" gpu
    3⤵
    - Loads dropped DLL
    PID:432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20240401114208 -prefsHandle 2292 -prefMapHandle 2280 -prefsLen 24856 -prefMapSize 245077 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8dbaf502-2257-4a89-9c97-7147d403ae63} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" socket
    3⤵
    - Checks processor information in registry
    PID:4224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3188 -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 3096 -prefsLen 25355 -prefMapSize 245077 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cadb7aa-c97e-440d-bacc-0ad63c0ee6d8} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" tab
    3⤵
    PID:4936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3184 -childID 2 -isForBrowser -prefsHandle 3708 -prefMapHandle 3704 -prefsLen 30588 -prefMapSize 245077 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {873f10e5-0a4b-49b3-a8ef-c9d023a4ecdb} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" tab
    3⤵
    PID:4532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4568 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 3168 -prefMapHandle 4620 -prefsLen 30642 -prefMapSize 245077 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc643cab-3467-4c86-bb83-225bb90f4429} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" utility
    3⤵
    - Checks processor information in registry
    PID:1460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5188 -childID 3 -isForBrowser -prefsHandle 5176 -prefMapHandle 5184 -prefsLen 27974 -prefMapSize 245077 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e8a012d-cd45-482a-9ef1-5f1e6e8b257a} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" tab
    3⤵
    PID:2736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5328 -childID 4 -isForBrowser -prefsHandle 5336 -prefMapHandle 5340 -prefsLen 27974 -prefMapSize 245077 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86d9046d-a4cb-46fa-8a23-a66fd894fd0f} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" tab
    3⤵
    PID:4784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5616 -childID 5 -isForBrowser -prefsHandle 5536 -prefMapHandle 5544 -prefsLen 27974 -prefMapSize 245077 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aff59046-dd22-4a32-9c21-13574de93ae6} 3472 "\\.\pipe\gecko-crash-server-pipe.3472" tab
    3⤵
    PID:3948

C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe
"C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9457846f8,0x7ff945784708,0x7ff945784718
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4984 /prefetch:2
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,13072380823010753002,16477986821774501720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1568 /prefetch:8
  2⤵
  PID:5560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:2376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5888
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Documents\128.0.2739.79.manifest"
  2⤵
  PID:4448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Documents\128.0.2739.79.manifest
    3⤵
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:4560
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1952 -parentBuildID 20240401114208 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 24913 -prefMapSize 245077 -appDir "C:\Program Files\Mozilla Firefox\browser" - {73a672d5-fbd7-4278-b5b4-24cf1d1ff146} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" gpu
      4⤵
      PID:5588
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2316 -parentBuildID 20240401114208 -prefsHandle 2308 -prefMapHandle 2296 -prefsLen 24913 -prefMapSize 245077 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d05770a7-66ca-444d-b80a-580e374d9787} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" socket
      4⤵
      Checks processor information in registry
      PID:5344
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3304 -childID 1 -isForBrowser -prefsHandle 3232 -prefMapHandle 3196 -prefsLen 26296 -prefMapSize 245077 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba55d39c-da45-4d81-8802-358f7162b008} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab
      4⤵
      PID:5392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3988 -childID 2 -isForBrowser -prefsHandle 3660 -prefMapHandle 3972 -prefsLen 30588 -prefMapSize 245077 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdc4a43e-ddcd-4e73-93f5-4c49568e1a80} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab
      4⤵
      PID:820
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4620 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4612 -prefMapHandle 4628 -prefsLen 30642 -prefMapSize 245077 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b586ec0a-f967-4d36-b4c9-8bacdc481afa} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" utility
      4⤵
      Checks processor information in registry
      PID:3216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5192 -childID 3 -isForBrowser -prefsHandle 5176 -prefMapHandle 5124 -prefsLen 27974 -prefMapSize 245077 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6bc5ec6c-e42d-43bb-923c-c5ee59efe2ec} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab
      4⤵
      PID:4360
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5312 -childID 4 -isForBrowser -prefsHandle 3712 -prefMapHandle 5140 -prefsLen 27974 -prefMapSize 245077 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf15c280-a228-4e8b-8a49-c6d3f684eefb} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab
      4⤵
      PID:1724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 5 -isForBrowser -prefsHandle 5496 -prefMapHandle 5500 -prefsLen 27974 -prefMapSize 245077 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2106b13d-5a25-41ad-9cd5-0f505326530e} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" tab
      4⤵
      PID:6044

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:4788

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2936

C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe
"C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1520

C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe
"C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5624

C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe
"C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6116

C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe
"C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4216

C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe
"C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:640

C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe
"C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5740

C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe
"C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5192

C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe
"C:\Users\Admin\Downloads\meowrara2.6\ZoraraUI.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5a6400.rbs

Filesize
19KB

MD5
3f9709e7064cf7e4d6498fce7ea2856f

SHA1
b93d9a1048f7fd1229d8bd29d5011664a2f0f452

SHA256
53b2bec1c6ca441dba0c77194c36a4035bda31ba00f600da756160c1b676cc7d

SHA512
9e2de96455a146ad9a5d5631793940e585470129a801fa8c3ae1e312c1f3f6283443e211e78035cfa3beccf507bef2f314f0b09249af2414b87f3f858274e513

Download Submit
C:\Config.Msi\e5a640c.rbs

Filesize
19KB

MD5
5032c580d113728c4b2e5ee18dbaf761

SHA1
80cc172377e863651afa89f6750cc44e8fbbb3ba

SHA256
bd297a45969132c70bb9976bb4aaa31fe1aa756100f3c8fd2f288d743676c2b3

SHA512
735905da37546db682d52a4b6eb0c076e955e0891a5c23ca422dd1d17f8e23fde7f81d9ad26e5886fe1aa737af92d5c6ce9777a994c8733ec0abab4e5ba882ea

Download Submit
C:\Config.Msi\e5a6413.rbs

Filesize
21KB

MD5
d93a33c680e926adb38e490a2dcc41bb

SHA1
0625aca9db77f0a5bf8be7edf2f521e82ed127ba

SHA256
fe1a9e72b07353b67e2f8a579523850f3bf6ca66e312b8669275350764c8364d

SHA512
66b5b98a77b3859cefeaab2cb4de9406572202977dfca6ba27e7707e1d0bb14cb6489956df0b524529e49699b1ce7cfe6db1010bd473b0b676f63425ba16655a

Download Submit
C:\Config.Msi\e5a6422.rbs

Filesize
21KB

MD5
5ff1f598b4fb37b1633a96dc78a3e854

SHA1
d6b02ba2c8629541e4d2744984d6a95a1f60d448

SHA256
1a3f30921c543483a4ee8505298af4a78c62e16266c0a01e9ffde2e4254bd2e0

SHA512
7572a38f522c28917ff669d973ecfff6bbca5306ba2efbde59a185513de5900f2faf2d4de31f59930dc76a5565a36038327168d6acf480620d889dfc0d37d904

Download Submit
C:\Config.Msi\e5a6427.rbs

Filesize
47KB

MD5
7a73d6bb2ec711897831b88f33b94825

SHA1
debb43afe6dcdadf7c9e0ba0756e026e417a666c

SHA256
013c5a59627dcf9d735ad7a3422eac1528afe326c6904cb1a41a5f76b40b588c

SHA512
0e2d0e3c0434be919a15033d97a51d889b92b4c3843a6624c283c566db8791fec7b5e804f726a66d801c9330b9b05eb650cf6fc184ceacaad41fd6ab9373c527

Download Submit
C:\Config.Msi\e5a642c.rbs

Filesize
9KB

MD5
c8f9078ae54cca63e3e8e2fac756ad96

SHA1
d8b8d95410a9f5c97cf560f6ae06dc40a724d5ca

SHA256
d4c4c0340174ec39d6120bc4239594da0548845d94df0c5de893c66881749ebc

SHA512
d357c2dbe0e1fac6681830caf596f079d8cacb8f399aee659bc6620062707f450fea47f3e6878a3d0e1ce37e5fc69bbcda192551ab67dde0ba3984fd547abf8b

Download Submit
C:\Config.Msi\e5a6431.rbs

Filesize
93KB

MD5
dd47314e9ccff8e5d3cdf47b85130825

SHA1
d09a5c2525e4ab98c8fb6ffb5f218d37bcef9abf

SHA256
a39ccb9423774257008d45e51fca651697c211ef88f58ebd399655e01245a70a

SHA512
3907364bd550ddf9355c672d0158667ad5de352735174a5859b37491b918f988efbafe5b48d32ee13a9923929e86fd09a98a6a4ed98c50fa23e739e8df34fe29

Download Submit
C:\Config.Msi\e5a6436.rbs

Filesize
11KB

MD5
4da697ee8985ef4dfd50695d953794f2

SHA1
be411255043011dc61e0d3f18d589b42b8ed6be2

SHA256
36d4cf2c935fb359400a8c7c19ae33905e416ff8afd2bf36641d01c8ca401ddf

SHA512
f5e2602f3fd98c16a6e3c4f3cbc008cb07a9dd5a225e2a43c9622fb2cbb19f7ffad9009d466d2490759860602185cd5a0808f4f2390422e54b46ef30b71d4d9e

Download Submit
C:\Config.Msi\e5a643b.rbs

Filesize
11KB

MD5
78fce9c49f1d10774404a15dc6ef5ecf

SHA1
db460bf32ea296b0f2a91192541616d2598eeae1

SHA256
97a6b541b31382563872072889b42d32f2becd59b3eca6e170e82c66883869ec

SHA512
ebe1ce8fc2286260476c627d3f370352aa71a71fcda165a329e7aaa11fe4f5726848f162ebf8583c75feabdf823d44cf0beea730ac930536934063de4b4a5e7d

Download Submit
C:\Config.Msi\e5a6440.rbs

Filesize
11KB

MD5
34391419e78abbdab3ec4384796dd35a

SHA1
d682bd766f56022d0f164e9ede2445d301bef800

SHA256
c77e2a49e814722848062082cee206f1d79100fc1d51d0b69184dca4dcf20849

SHA512
acdba89c05d73c95b7766618161d33f85464c8378900f55382a7409222a9521ae386c0f47f87c3017cdbc16084c93a38c289bb0217117c27685f39e2db2a695d

Download Submit
C:\Config.Msi\e5a6445.rbs

Filesize
35KB

MD5
4f14ee4f64657e1783ff3a5c33a4666d

SHA1
d7d4bde82d3a9cfd805ea3f69c527ec2072f3364

SHA256
9918bb1d1a4dc6e659de5225e7d7200c06502643eb9fe322c5893bb3fa497605

SHA512
068e16f4188fccaf20f529ab906a3860277e6bc86626c2274f1362dbc1068a464cfd5b0734e6c6f62617c47ba03cf796b40e08bea348fdc340a649607c614c8b

Download Submit
C:\Config.Msi\e5a644a.rbs

Filesize
87KB

MD5
fcfd82a2d6d8eec0ce6d980ac0bb09f3

SHA1
c13d9cb9ada2ef7eee3a3e9b5b4bd94b1afe191c

SHA256
d46fd233fe1d27a15088450e1888ea71fa67a5f327860c73c3adfcbfb558486a

SHA512
7023cf5c0fb1c33443d0e2a766452527cee68457d59f9643699f18e3b5edcd302364c7f1180b85b1f927486ec9d3cad19a7a778b435c3cf7be1191769141f24b

Download Submit
C:\Config.Msi\e5a644f.rbs

Filesize
40KB

MD5
8f8fd986e93105cdf82ba5f4910dc468

SHA1
6fe0a01c73979e84c63396a0b5399ce789b7f324

SHA256
51eb270b7fde07874bc8be8348f47fbf328f7776ef93f83626cccdd3e2b96955

SHA512
1554c2427f52174b3af34d6def0b2170b06322267a3f81c30461ba4552479bbb0ec40bc46f56930cca12b7c84d4a1c848bb1018fb93446341ef6afa9f8fdd67e

Download Submit
C:\Config.Msi\e5a6454.rbs

Filesize
92KB

MD5
a73ff36d7ec4bd1647b9c60c51266592

SHA1
97be31b1e3f4150d211a9d7229aa26e50c17fb6b

SHA256
5b7eb6cecaaf6bb0179196c780ba788d8d7cb709db8288068daaccdafbd4e538

SHA512
47c5689e6bdca748037fb5c036cfdfdf68bfca91a9d01e3ac0da8cba231ee8cbb486d30098e16412ac16e6e30628e64a40687ef14cc36bf315c63e5dac174ae8

Download Submit
C:\Config.Msi\e5a6459.rbs

Filesize
9KB

MD5
b781ab1dc06574b33fa76b4665ef1735

SHA1
a730357624553e6aafe7c8c202960d256cca91a5

SHA256
ea4cbb9272b726bc3915fe123adb48d7696d6766f140f5a40e6ea63c7785a2e9

SHA512
062430ed12c65ef4af15a6475e0bd359d3b309b4c68c8bf9d27960e8d272ae3c2f5f64bcf750faea6a6882d72c0ad41cad2257664b6cf058c3ea427f8060889c

Download Submit
C:\Config.Msi\e5a645e.rbs

Filesize
9KB

MD5
9a27f121b47e29de97a594f7faa58211

SHA1
824fad1852f4714575cf74d4c2d7ce742d76774c

SHA256
3fdaca7a0799cc0249d29e932cc276ac85672b3daa286e665dcc802beeeba81f

SHA512
1401562962f5453af124c2bcef01674d992f10862e5d37ff3ed793c2cd1191744bef21a989e4445b1d7e0c05caf68cdd154cc7eea4a8a7a35a211829304bdae2

Download Submit
C:\Config.Msi\e5a6463.rbs

Filesize
9KB

MD5
164ad1b786eac45a7ca2e0c5fb6fc2cf

SHA1
8744869695ff122de8079802f223a0fd419c221a

SHA256
65e01c6bc60f56a2d787c8048cd4a6a7d7fa3a1f8147f7e400149278dc0438bb

SHA512
01528e7b0aa1f86c6d149122329538da580cb1b7f76b5fc8addfd6dc79469706479cc45b05aa7952611bca620cde6a2a156876e637955ab003c7bca48d94ae20

Download Submit
C:\Config.Msi\e5a6468.rbs

Filesize
9KB

MD5
c66ee2effb19069a5db57a5934e07953

SHA1
44e00ef3258f5b1eb6078b6009f13933772c534c

SHA256
84bd5a99f61a75d45537ec40ec6c7aa59a93bb42e40cc561766feeb0f9302bdb

SHA512
a460ec4bc73359665b783d0c6acce746b1105ad07376406574ebb33407da3bd3907cebf7cc31ed22507e2b211c8c318f758ac4d8619a6773ae71e618e12b8707

Download Submit
C:\Config.Msi\e5a646d.rbs

Filesize
9KB

MD5
f8abf8116fce3a9b5919e78f19134875

SHA1
a87dc52743681c9ad3b772e116e9c4696a8a99e9

SHA256
d355cb3ebbfbcd411f8373a99bd659c46c74855224362fc691f89b2766f4aeec

SHA512
87fa1589c9fa77431866b4746a9803d35d6c34e4697ae01d029a16bf0683e5848eb1d67a3b39fe1d82b81e318b2f785af3fb143db170ed6ba98d7062aab8ee71

Download Submit
C:\Config.Msi\e5a6472.rbs

Filesize
9KB

MD5
637049a6ad745563a487cc937b3ccbbb

SHA1
ccfe97271247fc55711e6b17685d23443b672093

SHA256
795d50e6df2fe89352a5cde4ede73450398c6766d4418ec0e9218fbe2bc50cdb

SHA512
651872c52fa9f9fb1f597b5cef28fcf9f01454f5a5acbbe8539c54dfdf851218846e7e5c0871b550117442c6849132311461046711d38c2c430204c25a960f9c

Download Submit
C:\Config.Msi\e5a6477.rbs

Filesize
9KB

MD5
c6c64233f0a4ec538b6e53b5172dfce1

SHA1
3ff9e59d93ac5087cfdf475adcb8ffddd11bf7c6

SHA256
26fa86b2d1bc4b9396f654f2e003b7a6eb73c981bc9c5b44e14f728e90036be2

SHA512
44976dc8177111344014784ae98d1d928638f952441f420eb5b692d790d9f42c113f0edad43cd9f0137ebbb72081fa0c65668519bdf78d3804ff32c4b09256d7

Download Submit
C:\Config.Msi\e5a647c.rbs

Filesize
13KB

MD5
6c45472d85c2ea9ef70a7976b5007bf6

SHA1
1977f6a1934b21df77b06c8ddb73407231c1be72

SHA256
e4412be0c7f9da19d273c324cacfc947cfb7888c54b930295a2c0dc67ec7652e

SHA512
90261b1c62d2f0317d28a10f2ca8c9199d9f8649518b29ec960a3b34b1195fa0eec8a239ee30d876018984b64cf108ec61e3b4f374e0f25725ada7d04cff9b29

Download Submit
C:\Config.Msi\e5a6481.rbs

Filesize
9KB

MD5
7fe7fd50ef288b70964672464b00696c

SHA1
a802e355e5827201f41986d838d1d96627c56817

SHA256
bf027e31e72a508df130d4bc289bc0df137c46bdc2909f53246584ab4bac6d6a

SHA512
ca14aa5883d310109327b9c080911becf87f3ce8d478d635651cfd18a5575af1b4db45ee920ada65dd27a676ebc9b39f33959e8290f46a01781d85e5ffe88ffe

Download Submit
C:\Config.Msi\e5a6486.rbs

Filesize
9KB

MD5
4a58f655ad940df5d4951f50b2209184

SHA1
5e58fcd8947e99de92293f8cd8c51bdda846448b

SHA256
5a12b50e74d3a6357fff4b7f26956c9487320c0548cdddbebe49f01a3ecb1e07

SHA512
d780d97928e9941c947e694682b15a7ca9e2d184071c0e786cd0bbb353dd8f95a375a1f7993b7434564f8b716f6fc670797f66462748d9b3f873d2bf65238759

Download Submit
C:\Config.Msi\e5a648b.rbs

Filesize
9KB

MD5
3910ad2010374ecb14dd0fba957e2343

SHA1
87361bde89a6cac920ee4ff3b24e26e7508320d0

SHA256
a309c172a962abd0b43fc13d1eecefe8b2f84f96289500a3a1818dc5ec8f797b

SHA512
52c4bcd4a011c56459f7e1e632c135e9b3f978040319f29ba3a9601f7a618c508625fb805144d005891f296c9ec77235cb947699248904b904f53418436e0e81

Download Submit
C:\Config.Msi\e5a6490.rbs

Filesize
12KB

MD5
6e864954a3a34d4e2a647ae72ae326b7

SHA1
6547fb43a1599f80f135e7d78d7a98f0577c41e2

SHA256
2017ecc6055ebd56148c3feb59bb256bf844477b230a5cc2a29c8aaf4c7251f2

SHA512
bb5685841ada035f126c1e461fbfd63503dface3ca0b9b207e134db087290c34f6a65d6eb8ce90b7ff799673789af2d711493f2ea51f243c2d23e0398a4031a7

Download Submit
C:\Config.Msi\e5a6495.rbs

Filesize
12KB

MD5
66c6af5ce95bd8da77b7be1b5de64138

SHA1
4b667d6741b6948e367068a06b5c0956a53858fa

SHA256
5f70538c5021b6a84634a516f17b2850fcbde550a2c27b7eaa289dbddd2bf763

SHA512
7c2cbde9e97ae8503d6c6f9a30bdbf547275f2e4c4210c2d3fd0df95af0c57731a751fd1401419eee5005b978a32fe466fcd8d90c181b766b56e61172e73afd6

Download Submit
C:\Config.Msi\e5a649a.rbs

Filesize
9KB

MD5
77c3fb3e65cbaaf7a4929ee9e14ca4bd

SHA1
131429a2a2cf375fb410fee08025e9d91b94f308

SHA256
470e3572048ee84f455ce05f2081860b3bfa4c00dab34ac152bf762e2bb031f9

SHA512
f44957c43eeaa95f5b5139199111fef812679c29e2e5d89658ba5b8d57e54d178f71fdf04f55a68a606749ba6c6aca42dd77ce2cdc20163885726a2fe9860c45

Download Submit
C:\Config.Msi\e5a649f.rbs

Filesize
1006KB

MD5
abc9a17cf8ec7c05fbaf3cbccd3a37c7

SHA1
aab99ebeb67ab70be1543437a0d1b659d613eadd

SHA256
3b273467ce2c5111a08efc7c9b78610ff175788378979e936c0d1e941e667d0a

SHA512
76d034c5c0fcc470da3d90ba2961938aa40414471e145ebb99f915a3c85687681b02cf27f8ce60c72fd0e14dfda281ea32c42a3fbf28ce7da7faf2605f2d77c9

Download Submit
C:\Config.Msi\e5a64a4.rbs

Filesize
40KB

MD5
93ab0493f297323487a5e4fdd2393221

SHA1
808668892ed56aeefd7afccfe9a91244ec476217

SHA256
316d6eee8273d235c3fa03347088a771373e315e97e339b4d2b21102657b3bd1

SHA512
5a95d9141efbd17a52d8e53ed071c3563517c813ef23b305fad41a64a4314c3edc9747a4b1b8fccc8423583191ca1c0527e35e6e5a723accc82b59079239a540

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Containers\containerize\containerize.runtimeconfig.json

Filesize
340B

MD5
253333997e82f7d44ea8072dfae6db39

SHA1
03b9744e89327431a619505a7c72fd497783d884

SHA256
28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306

SHA512
56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Containers\containerize\ko\System.CommandLine.resources.dll

Filesize
19KB

MD5
ea1fc85ccabec5aa1ae22452afbafac1

SHA1
8ea9da27d9335f80c76867837688218b78311148

SHA256
f3d814678daa95c4609d723548edef7a76bb87423a4e78a20e48fded87089483

SHA512
42a8c0fd58cad8765712b0379a9ea8adaabaabfa2fb5e2760756e0cac80c30484da491065634aa406ec6fd2ffef0dcb386fa6378e191afb6fcb48a7845c8c479

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Containers\containerize\zh-Hant\System.CommandLine.resources.dll

Filesize
18KB

MD5
9101e8227a7ab83cafd27e4ec222ba10

SHA1
3a80807f7cd695bd9258eaaadf8b2d7dccefc125

SHA256
8508d85c0fcf1040b05d2a2f0c7e4f74ac476f9a46f414e05e8d47d565367e5e

SHA512
e017142f816299ea430a980db1b15298e4f45b4d8264b06160194061f7cb9c8cd3c9a1a8976eedee1f67d6a94b6a393583909c7c167e4407a5c47cb686f23412

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Containers\tasks\net472\Microsoft.Bcl.AsyncInterfaces.dll

Filesize
26KB

MD5
ff34978b62d5e0be84a895d9c30f99ae

SHA1
74dc07a8cccee0ca3bf5cf64320230ca1a37ad85

SHA256
80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc

SHA512
7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Containers\tasks\net8.0\fr\System.CommandLine.resources.dll

Filesize
19KB

MD5
aa8eeb801d74a4e562fd8c044e03fa8c

SHA1
8653841bd62dc74f605f608ed8f354dd692faaa2

SHA256
7ad12924769e5e85266ebd510fb4be141cf5092f0f8988345f80f5bacce0479b

SHA512
388ad6fcb298ad170e45f214ea4b1d1e5844efc1612800341a4b1b651ee3ca25b4bcdf541bf2f8f0975a1da50dbe8f60ff8651c100f8675b9e3ce924b0f08db3

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Containers\tasks\net8.0\ru\System.CommandLine.resources.dll

Filesize
19KB

MD5
7717b3eae55b3ec74f40699c1b9896c0

SHA1
1483166af6059633de2e20545bc3f3cb6f035304

SHA256
8a24f850a71065e93ae80d3a62903653e1aaff9ff478e05831f288761e4bcc02

SHA512
c988f566875ee73f0e568fb90df423424d9f3f237ebc8cda6b19e6b685ac778435a4fc654ce923a70090579216f6afb14a5663381c505ceaa919ebdda97b239b

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Containers\tasks\net8.0\zh-Hans\System.CommandLine.resources.dll

Filesize
18KB

MD5
c182eebde556be386ca5b656974993fa

SHA1
864aab5c6e71bc3537612c2541e7737d02e6f4c0

SHA256
d8682c24396dd5093f4e4bee6cc021148ed2558039b2682bebb60dbb95db56cd

SHA512
3613cf324c708564185f021404215202dc2fd5340890db115bd906716a9ce74900aba954c68ab13900c79bbe869b916739157e426a0196c1843426beb9d4ef52

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\DotnetTools\dotnet-format\ja\System.CommandLine.resources.dll

Filesize
19KB

MD5
5d26652b0f420ca6ba2bfa00b84eea38

SHA1
8dc1d2a7cb6b857344c120544f842fccdaa97e79

SHA256
654efb9ccd7c39ce7992616f8aad94e5855f01a3b1ad5dbf21710b1b6d24f00c

SHA512
5e066b399ce519202f2dc8299787ad47bd37467e85598489489bd5f0f49c424518ed6c4e89cb6ea44c038ceec9a5169aa0c1afcccb0de55ea805e1e0641a7419

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\DotnetTools\dotnet-format\tr\System.CommandLine.resources.dll

Filesize
18KB

MD5
c9c8df325a05d227bc32a5d854713c4a

SHA1
cf9ea69ccebd1ef0bd46beff01254a02c5fb0131

SHA256
7a2ada59d84ae17791ca23ff010f1251d98a72df15d1c7355274557349c124bf

SHA512
fc38b3d241bb8315202d2b40821d9a8ca4075ad7ccffe60a97268805e9cb00e83e6136d872f248661843753415b6eee22858a7de829cf60affc4c89c3793dd97

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\DotnetTools\dotnet-watch\8.0.100-rtm.23551.6\tools\net8.0\any\de\System.CommandLine.resources.dll

Filesize
18KB

MD5
e771e643a2f47b5d527aa4dd1e857aed

SHA1
ddb6ebbdc354122989c67ed9cc2555da640b16e5

SHA256
8c4a1a6e84875ae583fc032a723e934f0d8805d452b43a81b4eec624b5ea7e15

SHA512
14d17e82464fb813ff044b4e5dad1a429f0fd8fc5973ba2bcdb50edbef7e129048133d99b5c50f86a3f82d33b9faddbbeafff222d92b80e31ff963345c4b29e9

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\DotnetTools\dotnet-watch\8.0.100-rtm.23551.6\tools\net8.0\any\es\System.CommandLine.resources.dll

Filesize
19KB

MD5
79e57433e70b5a0a300303dfc5d759b4

SHA1
cfe5862964f3b389cbac01e157e9ade0031e45ef

SHA256
b58c35c328c383e3461c3ea2f1f0c46e7a48446d863f2c2c63f42aa466e002b8

SHA512
8f2ee3b02c4bee0483ed702d283bd9e513917044bb77aa4412dd85de501a8a52c966510df948a9f5f36177407bd111633047686d727fe32de14599e17b229de4

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\DotnetTools\dotnet-watch\8.0.100-rtm.23551.6\tools\net8.0\any\it\System.CommandLine.resources.dll

Filesize
19KB

MD5
4e92ced559ff6f26d238fc5393dab39f

SHA1
400983302371c5a7ba38e3dba8fbc4c5f8192018

SHA256
37ab1ac8eafeb21cdca5418d01ee65671dacad3fe206f13e8ddb5b199e5ee471

SHA512
0c77f4392b804a0f47e6c535ac7497182cd4a47e19d1d437d15d73ccfc03bb8febe45ae01965eb9e70a77059ed271bcad210f5495998c75b4ec46c1858fc14c3

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\DotnetTools\dotnet-watch\8.0.100-rtm.23551.6\tools\net8.0\any\pl\System.CommandLine.resources.dll

Filesize
18KB

MD5
3f14df8e4be6100673090c43eb3c3476

SHA1
61c1e35aeb6cb477077416f050c344fb18f5f87b

SHA256
09eafe24bde0110f526b49001d97673e533ffd9d361d9be9c4b511eac4dd1bc2

SHA512
7988759407514f6a6d3792ce58c582420eba75bb1871d8392f0f018f403557bc99d665c7655f913c9021d6ed777f7bb8b3d12a52ba5869abf48ea29e7c2d977c

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk.Publish\tools\net472\System.Memory.dll

Filesize
138KB

MD5
f09441a1ee47fb3e6571a3a448e05baf

SHA1
3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde

SHA256
bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f

SHA512
0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk.Razor\tasks\net472\System.Buffers.dll

Filesize
20KB

MD5
ecdfe8ede869d2ccc6bf99981ea96400

SHA1
2f410a0396bc148ed533ad49b6415fb58dd4d641

SHA256
accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb

SHA512
5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk.Razor\tasks\net472\System.Text.Encodings.Web.dll

Filesize
77KB

MD5
fa9d0d182c63c49a4c567f7c1652b6e6

SHA1
55ddfbe80762c02f9a9c65809f9ec3ef8f7f2ccc

SHA256
e9c4f5eed186cb129c527c4b8d67d163ea2f2396e9d8b96e30b5e7c12203ce84

SHA512
58f468c982ab66930ff37efb5a941db116e8c1aed66ebc23720a7b18f71bebe1e929bea76680294edb25f430c23d520b8a87e3a22064c5993d0396819a21cbe7

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk.Razor\tasks\net472\System.Threading.Tasks.Extensions.dll

Filesize
25KB

MD5
e1e9d7d46e5cd9525c5927dc98d9ecc7

SHA1
2242627282f9e07e37b274ea36fac2d3cd9c9110

SHA256
4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6

SHA512
da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk.StaticWebAssets\tasks\net472\System.ValueTuple.dll

Filesize
24KB

MD5
23ee4302e85013a1eb4324c414d561d5

SHA1
d1664731719e85aad7a2273685d77feb0204ec98

SHA256
e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4

SHA512
6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk.WindowsDesktop\tools\net472\System.Runtime.CompilerServices.Unsafe.dll

Filesize
17KB

MD5
c610e828b54001574d86dd2ed730e392

SHA1
180a7baafbc820a838bbaca434032d9d33cceebe

SHA256
37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf

SHA512
441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\tools\net472\System.Numerics.Vectors.dll

Filesize
113KB

MD5
aaa2cbf14e06e9d3586d8a4ed455db33

SHA1
3d216458740ad5cb05bc5f7c3491cde44a1e5df0

SHA256
1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183

SHA512
0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.NET.Sdk\tools\net472\System.Text.Json.dll

Filesize
627KB

MD5
63f1d0b53ce47b0ac3216281c8bcaf24

SHA1
090cb7392ed07a94d237b5aa2175689faaf49b7b

SHA256
de069c408673e62b098d6e37e64fc2308f02f3f16cb45e051c08b52fe2d104fb

SHA512
386294e2602642204ec02ff514d3064ddb7ccc6f56e955176b09b23bece87fbf29c12a532e13b77a918842b05b171fde6b4d48c7f6567928d9337a3883fef521

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.SourceLink.AzureRepos.Git\buildMultiTargeting\Microsoft.SourceLink.AzureRepos.Git.props

Filesize
295B

MD5
a5dcc9e5bf323d748b26652e11956905

SHA1
7f8c7a2523d1f4600e0f8bf347d10564cef36780

SHA256
2ddb662297ebfb51e70bc61ca7695dc62124a1edd342c82e87e6302cc03f016c

SHA512
79d324b12b375ccf888828fd64c303a669ab00657dbf6fe76bba522c7683b7aff8b0c216905fed00284ddf8841fabcf8e2bb64b6849956572d11bbbc8e1540ae

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\Sdks\Microsoft.SourceLink.Bitbucket.Git\buildMultiTargeting\Microsoft.SourceLink.Bitbucket.Git.targets

Filesize
297B

MD5
5725a6d47308db618d015c3e55dd499c

SHA1
9b3e1ac8d62d522505f57fee89a249ac33325edd

SHA256
61af182d230365161e831fc573eaa7a2c9ea413e01ca2c446e3aa623e3ee37a1

SHA512
ab4ff2bd624295eb15d22377bf1c1bdee135f24e534cc40e86cb569d7af846c990552bd4947b32c2bc74bd92e6ec42bc775e4954fd2142af89c2dcc75fe5f798

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\TestHostNetFramework\testhost.net47.x86.exe.config

Filesize
4KB

MD5
a22cdd3374234d3a50c2ace2dc33a63f

SHA1
d71bb2417cb805c3da21ebcc0e1ae5a102823c9b

SHA256
b60b80763571c22739c4a688a46ee12c65bb66d1e9ac7d0933c2e4222e618874

SHA512
71d27f36a5b03c6b470f720196d3d67706f47f3b1d4f88f55960676b3a5024c9ceb1228e7dd6173d24270af556c0d3898fb5395e3823801691deac8ea6026d61

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\cs\System.CommandLine.resources.dll

Filesize
18KB

MD5
2f679e46823cf54660405eda0dbf0842

SHA1
29fdcbd753e36022b6308425dad9323e5f3472fb

SHA256
6c9e8a37d656c8ee738cb0db392d49e908505a82175266e072a4552a7c98adcf

SHA512
f07fac0e45c87ea34fd1e9354fbdcaeb61f0a52b23cfd993def3c71f8c5d7249f861dc8c2dab427fb93e2bfbcd156d2f0518faffb91853e70530e2ad71e4cef5

Download Submit
C:\Program Files\dotnet\sdk\8.0.100\pt-BR\System.CommandLine.resources.dll

Filesize
18KB

MD5
c7f0f7e0a7562225d7b60b88459bde92

SHA1
96c432044ecf7d346e09c6c46f5ca163396d97f8

SHA256
516e73295a8c886807ef125de6dfdcc3b783133603655c7a105b38a953ca3353

SHA512
05cd9ad86c824d498ab7e0be7656c233cb051b056dabefd9d037923f7d3a1bb967182f575dee89896c47912fca4a2227c56f8f26f0c2949ee18a38d7e041b999

Download Submit
C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\state.rsm

Filesize
880B

MD5
6d2a461ca821b714a8e66f193bda8c73

SHA1
bfa6c1bde11462a556e141c09d5cbc6bbdccbe47

SHA256
5499461fc2e40376b6ba1b15b9a67212f3936a025a067aec6ad2556ff7a5e671

SHA512
51b676b65c40933b2ca57063355343f7f36f73667e467494850a4ac343b2f891fc9daf97037d51729b7df73fd7337571287b0a4fa8604cb599a25ec82c0bac1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
610a3e8ee7e60fbe570ec0db89697a5e

SHA1
d9e55acf9c618b8b8ab904ffe6fc3587db5cfa92

SHA256
388d74c1b20de7d64dc2ae117eab45549cbd72891a8f9b849b5f531e974777e1

SHA512
380f114495a279a1dadc34b0ad91046a0f649bf26f23a3955139b8db95b43f4b6c2216ed720cdd29cfe4f7569f0ee1278a722bc8be80a9aa2c9c472e32704bd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7d0aec70f7147086aa14e8e793fd7fed

SHA1
7c3564621eafcccec44de9a069fdc1ba79c1bb09

SHA256
1e8e3291d3d3cbc296a9aa54fcbbc0bde83ecd97c8dad0b56549fa3d98db1f5b

SHA512
aa1bf70098f3bea8f5bf740f690bbb30e3158a2e783ae43351082b0660ffb5885f620417b7d70065032474c32015d053ce7a92c1b98d1dd60332070718ae0f40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5346fefe680982deae5ef905544f3f63

SHA1
56d96c8a486176e274a4094764f55c7915873868

SHA256
710c49c181a1e30273e1de659830b009cae32ad31ec4e6287ae900382f23d353

SHA512
ca47c8ee5b0c3640098165a2d5f20785b4bf4671726d18e362f5922e1f08ec5fa2791d30f9cc6f460d426adf24a9d01bdecc6b043ce019229c7f79d5916de6dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
557100dcd1edcf31a641c71d2fb1718b

SHA1
ccb44cc37017677722578a05a123e69046b26d26

SHA256
2d0691bf81da31114d0d822c8324371b453430e81728e0fdc4489e775c64dbd3

SHA512
bbec02591e3f10dc0ecec18e8858b2b43134ef2a238e07ecaff65a8bd83880b30d04ab122747ecb9a8041f63adca54d7b2a1ac09f708ca171c8223bea0a84aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7f4f26e8460674dde6547d12532f20e2

SHA1
344640b5eb0a051ad7ef2584770608288cbd4e64

SHA256
6206b8a3c68a96ea4ca1a74faad100cd50451723f22975da7d948bf0167cf18d

SHA512
784c09e84906bbe32a026f4db0ffa1b8387788ed6a039fc9bc9ad430bfc6f15224ce3f26a4d100790ec19626cf142b870f1d7ed9cb0a21c031f714c27718ff8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e7342e4f406964be4b9a56e5142143f2

SHA1
7cdec520f980e32637f42da6cd87b45819e27343

SHA256
f831ce049a6440e1a44c6b6570d8c79fa0e44afa139b62739a7cd6d48c9226aa

SHA512
a4a1ae27ed209ee28438af7b19dc79349d3644f7d20cdc8519ecee4333e568293d14422382aeca02bb9707b13e9f40cc645960b6179513380c68fd768cd0063e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e69b032aaa87f7ace7ec59054f793a61

SHA1
054cee8789bd44234683e7233a82ec9cf27d0a2b

SHA256
11549ecc7b9bfff765cd9a4c36e7bc8d4e1a203e22d456bb761ffae49da1dad9

SHA512
0f97348e09f1915597ed1a83934a77c5c8aa4c65e9704679ef50f7eea35008ad7a800d9820e54d455913c288e325fb687d9e3cdb57fc1d46de988879ee7634f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ede1611a428fb28f953d8e0e5ed133e9

SHA1
3f9bd506f0f133506b75462ea29fceae1ee72777

SHA256
5c0b6c82d5d773e64421a37449ae173d6d699851eb0b85813ad327ecdb3fc7f1

SHA512
6a03c591a364c176d8c4e3390d7f38c25776fdbb71f51db19c8135b3f9f6325839d3a82911d2d2dc5cdcd0aa4bcd21cd88edc825e83220405a2f19bbf23d766f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3715a669f48cba6e409e7dd2c1915e64

SHA1
cae5af2a85785cb09af5fce2d15db2366cbf1e00

SHA256
a4ad35d970aeebd4bff3d9df0fa04c93641b8e344bff93cc6ea080e8423aa16a

SHA512
f9f8ee7737eb70557608c3c6ad61219ab068b484e156059703dff0b0d30d5b7c9c65e69eb5568d9426a7c009d8e8b923d07664dfee1514238d2ebdc9712b39ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0f1cbc189e45b967587b43b39cf4163

SHA1
9896dde287571ca267092ec2701a82c0c89c1186

SHA256
e0a42f945ca28e2faecdc4ff08b5badf57989a81bb7ccac2dbf324c64ae3a33e

SHA512
d8150706594cb9b6f0fa3d6499bf1eabfb6e48a04c2c70ada094b472ef47e117cdcc3cd15cdc2032a85356d82206e622dbcfc1da9936cbe9f4fffba012349ca0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
af03ccc5f41a8a4a3a8a8631cdc92880

SHA1
115dd4a821f5e5308da8ea4bde938182a664c616

SHA256
1d190fd37dfbfcab187687d83e6cd91bb8acb1328388174eae4e8a2e038aa6af

SHA512
27579b52940713a3cf16c097e06aa48e618bbc331144f1884ce3237513fcd9fc20f5237a35d1e35bd651989d557c3c58d2b689eaa9d58110a1ff8de344f50c2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ac999050c50ac7641c973f95c0c55da3

SHA1
72c92e244222595026443f4d454d040c53444883

SHA256
9ceddfda0b781c9b95a09b655b85223123fd83a58aa049ad37f40a2ced1e1681

SHA512
8265a17c0c4883b3065fcc1341ff1dbdef00d6fe261d1bd572353d32752dd014a8fa6bf47ae183bf304dcbbd9ae4a1037ed53e181993cf0e52ad1007671a784c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5dc4e9.TMP

Filesize
1KB

MD5
03612c8a1d152198c58c31421a4383db

SHA1
66a1e1c23c36754bf33064e8c612715ee58da2d6

SHA256
db62a5fd66124924f49711285542bf7b96f7a8e6523cf86d5abb5d91ea1cfd62

SHA512
9101856248aed4f4add6f8129d4dc75bdce242253754555f21e947944fa507264d950b42ca57c04cdc3e596f369f8479c8b235556677dc8fbeffa9892e782aed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e56041b2672ad7d4a2ce091a93d50732

SHA1
db928a1d87128ad0acf02fbe2452f0931c0d30a3

SHA256
739b0bb33c8f4fa118eb370829e4c922aff438b28c0a9f32a339c7f0887d35ba

SHA512
b4e7310732558dea366d3e36de006f804d0638ef6f06f609f06db841a034174134b3b0d39d25d48a54d3fdd91a33fabddea6ea7cb52d3e63bbfc920ed91a651b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e239fc5d8739faf135b9c616156e7d0e

SHA1
afd1174b2467ba24e00442c0b37a06448f972a75

SHA256
96e073b5a2c81159dd1a76cba7498494ed6d97bf37c7f0130b123bc341311d21

SHA512
b17a47256cda7c72712a4db1733223fdfe4c2d712ee75382f5f6c46d51f6214ef76d4492f51a412ab966acbac13edcf35406a35d6ce4155780b5ad81e7c5fa4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b4090b7e5f54dffb372a19c562b4d208

SHA1
4da89bdc85f77b4977c54c2f3f1dcc8343f2e771

SHA256
e9213913eea9de7f35c0302753c3c6b2af2e7b5d704b5ae8db260b8783cf866b

SHA512
a580401d333c174892abee4edd6d58a8b3017907ebec652ac15d8b1dfeeeabc4d729610da66d57009301b4d13375f71ecbd6088b5b6772ec674bcded59498fe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9baa4475d9a35ce995b75b3a26ab0331

SHA1
8cc4bc009c541575aa5fb3de24b5e7d8c7ae0eba

SHA256
3b718bc131727e8bed71af822a3e123fc4d3af2216dfd1bcb8dec805089b1644

SHA512
444d622f9246988541569180c5380ae6fd42f83bc9a1f3a4bcadfc4143856f8e5e444d3288dda0dd8f25b39f0f22fa39ef9776e7ae8d7af1c68b39bcc6907fdb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json

Filesize
32KB

MD5
c871f390641a05d5d19c2db7b8122628

SHA1
2f05fa2f456b4c84f4575de82df7e13e17f17285

SHA256
c82bddf62735b49187eaf36b998f9fdc1059f000a5f1d912bec58289d76d4f30

SHA512
fbcc1844b820d7a14584c4111cc952614eccd58026974b221939647ed3e228da905982a7b48b2e9e83abb3eb9879f77b909af20820578bdc7cdbfaee510a7a81

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\startupCache\webext.sc.lz4

Filesize
107KB

MD5
cc4b28fdc91c598857b67e2353e5e5b4

SHA1
f4024ae75f756e29b30cd781c56c1a8187d3c9bd

SHA256
d01d8f5566518b99a8ec7e4841c4f45414f380e929dbe80c93f93b23e07d3184

SHA512
c94d6585a6c133cf1a4a2de496d85bf32b48a952e2fc24879a151552bc72c7261a76f15b7aab6be6bafc62c59300532faa28fbf32ed0d9e86bf4225a602f9168

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_SDK_8.0.100_(x64)_20240914161032_000_dotnet_runtime_8.0.0_win_x64.msi.log

Filesize
3KB

MD5
37dd87cb90c8f2c23b928cd937b87ff5

SHA1
ff5aadc6ad3f7849582d031aa99198e51b3a14a6

SHA256
6d6c3372fca1373f680c0850ef3756197883bbb998c98fbf414237ddec4ddd72

SHA512
6d7754dd3066b51a9a2028ee8ad9b28a52f9f301d845324965f6eab812bf5c6e3002992be2821e0508b932cf5565a34034a67d8db923fde54cf2668be0231036

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_SDK_8.0.100_(x64)_20240914161032_001_dotnet_hostfxr_8.0.0_win_x64.msi.log

Filesize
3KB

MD5
ecba50507490be2c4f80d30ec7839751

SHA1
a183bb3033c0af53830c719e6d6ef3760f0e7a8d

SHA256
b1b0b5a6809039465334d1e2bec090abff314a5789dc05900f1207c98f71ab60

SHA512
74447b988b2560ef59a06b3571dd74be5983933c75a1a463bffdfb3b726bd7c0294736f3b15f6dbf7d8bd8c7e66b5f902e4333ae216c031631459c09be8b4cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_SDK_8.0.100_(x64)_20240914161032_002_dotnet_targeting_pack_8.0.0_win_x64.msi.log

Filesize
2KB

MD5
a83cab0827588c92e100c04d76685ce2

SHA1
e6f684223694aab84c2ce9ffabb7db2a39df4a98

SHA256
0dbd435d31bcc58efb5541fc9d7dac77c605e112197c78c9f603b51135c619f0

SHA512
fcbe8d7958ec534ab397959ff91fc96205fb44e4eba6496be6a61424160b5a5ffc3c8d42f250fb0892120c7e6af97d1941676120f5c7a88df0e66d1f2ef8b146

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240914161018_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
0196b3d50ecb0e0b98f5299fa551f160

SHA1
e51fd34a5887d7cd61a81076922f58aa286e43f0

SHA256
a8bf47520be8bfba6b36e40b7b37f1afec935f0fbfe21c80aa34be2e5c033fb4

SHA512
fb92264441344252f2c7066c01a677a593254ede955328244aee801ad0aff4a558c67bae70c271b5361070023837bfed5725844d033f5162d6dc7a3d2b9ede19

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240914161018_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
2c3b5282c7e01016abb51468f054537b

SHA1
f2e4ea579f5990a6f3582edca35771446881e337

SHA256
db66e9de07f2bba412cede087b9094070cdd6352f2af07018cab82131f9d42c7

SHA512
b37379dfbf807ae2836b071a4b66783268b4be006f2f269c3ad511642f25aa7662262a8e5f054c050de376fe70219397507b93e4b6f2475e55a939dda170efe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
16KB

MD5
965f09d9546c8bacf062427bf5b1d41a

SHA1
06445377e43616ab7dd571805180f197d25e295b

SHA256
d0305eebc8a5cc689461e3071b7d8c725b21209075a7c32d0e65ed3f180e79e0

SHA512
7ccf98a55f9aea0918b7ea981f789022302b063a196c19872deca2b86d6bb8f75e453918f70c504550a02f824522745834c4bc0c652526379d3d75bde16e4843

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
16KB

MD5
e2ce9ebbdf6aaec1faac5a705c5f31bb

SHA1
193da1987409049c6727de36db4b3a2de1269975

SHA256
ec71faa332472671e3b69d3b04216baa133636d86ff924af861d2a700e62e372

SHA512
0fe3fbd9762e48770fc667c70d43aca27b87738ac57302a967295958efa60e09f0a5a36bd9951646907a7731b199aa3108955dd5b3a63d41d0975b7fe1d76144

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
79e605c75e6114c8bada64bf57a626a7

SHA1
1549db851926ffa6ba4a1ad35de83b0b57bdb64a

SHA256
66749d7b6147b3a40d6316f989ae11568b0bb2cb293e951c3ba2aac99e05832b

SHA512
9c8e81c6d1a74e8263815a70cc9127aa6e28da70817abb0d25eddb5a0c56ca09c04e86050e2fca54922258bedd7f17c62ce864153897754870fa4132450a3e0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

Filesize
6KB

MD5
47f7a83e4d5b94a6c1bb1698566f2ea7

SHA1
069ab7d56794df704e731d1923d10c22d32539b5

SHA256
1744ef395d301f62390ce83516044ee43f5e6b77de326e29f3f81cd188dbc342

SHA512
15cbc66ce720255c4eab4c2a31c123678f01f306a18884941cd046ddebf4067488cd5ab600decb5f6b7f18489e5f227318c1c3f4d91b810ac0dabd17f8fe9c89

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin

Filesize
8KB

MD5
cd7e337f541d7c3178f883c84c7c1df2

SHA1
88dc803c8ba6722225d4c854be31c81ff23e6237

SHA256
bf70d92aa3eb7b20caca80c7112f716a1f806874ddbdb3b95c69e266b362057d

SHA512
76908aff58855341d0dce0a1a7f76f4640d8278b48c28a0df9361977acdff6767fc9e8a3c318876fa4750e3e03b629458453c4d5805adb16f2b03ca37c6f4282

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
5bbbc4eadeb165b659ffc2b15b52ff49

SHA1
6e6a0ab5c27a6b20ad596903be02255c7f1fe93b

SHA256
c8d385824a1b69c0be94de67e1bf4e360d4c8793ca511806fe10a2dc4d524b8e

SHA512
198f7905d2045e1651bbd98d797d3a832187ab3d08cf1c6de3d09d1adf4865a4faae11e82c5964f83114bbbb3d0fd50364715ff209c95b49c715ebb4fb97933a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
36KB

MD5
38e140dd068d02e99aa9672881337cf5

SHA1
4e1cfbc3e162ac9c446e2319a58f689b706a81a4

SHA256
970f0475d9cdd09c9d0a342f6a6536ef36f1664598ff04c51eb40f6e81b05cb6

SHA512
e50989ae6f4e5aad4cc966544c171f2f7c30a0cf5fb04ea3a0b7d1e351284c8b8dd4b6f3c1fcc1b085adccb8cf6e260060242fa5629e0f16a6eef5a6d98544c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
37KB

MD5
6fc8bfd0ac0ed9dd8a298eea793a76d2

SHA1
de61f48d0efd54ef2882fc86ea40bbf172d6daca

SHA256
bfdee207b88483cf80b1b341a2d59cd1971e99fcf5c2079b05b3e16df331a8c6

SHA512
824dbc293ddd66f5b4dc1ff5eb6a386d82af4d82b196b5b627a6dbd294384ddf210120164c81958cf2d1acd49cc99b679563203bb7f64fdc9d5e4fd87493e9c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
36KB

MD5
092f84d5d163e209928128910141a24f

SHA1
2e2253dbc2ee192454391d0bcad0c748e3b59969

SHA256
843ee3f5db63a0de3eb92b28c0fa3ad99d4b2fdf1c4874802b9d7f8f6212e690

SHA512
15fbf5c6c83beec38a4ff3783d11eee51ecea48467ea163692d678a28d675c7661abcd28e7dca3da8bf56fc2c1a98eb7801d235f29c3f0ce619d419ee37282d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
7af0d8cc81bc1e936185fcbc70d495ee

SHA1
451e1c45e2f5ac6908acbaa0781bd8abcafadab4

SHA256
5f192dba9e01b050aa869f79de67144b2a964e168451f85e698d929f74a2d820

SHA512
d27fba132d099ed5988307215a5e62226ea88f9c062a4b99a9bac6d9d2404ffc08379ed8308092c70e91e9dacfb0033ad7ea224ce5dd05a910463ce0125d88e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
37KB

MD5
18cbfb57f72ce654572bb1f383e6c9cd

SHA1
ad342b62f8f4eeeabfe36435cad77237e916e7e7

SHA256
806c2fdc933b02e29ff5158566c27d02b7f8c321dcefcbc27871a0819bd93616

SHA512
1849eb07cbaebd795adf892905f51c19ff18bb97cd29a36b319bd76138463f43663ffa68100e286e475cb70ac75002a9eabfb9e621f9c090feb2b1227962361e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
36KB

MD5
a4608b6157f01b4c8d33771fb891ec9a

SHA1
4e2f8e83bbf63f7a8235cd6c922a240e892e3678

SHA256
0ab054f9b48fd118b80c44c0b69bd79b960ea26cdc6c9387f288f76e86b4327a

SHA512
fd49349862c8c690abb0cda147b166481bddb1b97c01bef336855f5faf50892f22a7af27808f7231643a61514a9428220737f7d1abc781dd9e6e1563970dcf81

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
cc4766ad81f75bffda9a2b940abfccc0

SHA1
149657f8d1745f29825dc56782777d2ed5330c97

SHA256
ea3288106685106282f1ffbe3f3ebcf2abe3f43f1f6ea544db962b0b08ff701d

SHA512
7185f966f809ec221a22739f92924b26e1b1f40efbb9ccae0f6bc1c02188aaca21a71c23fc231d06f98846b3ca73b447d1a6ae9c52932a423ee96de75bc72b0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
38KB

MD5
90eff5e1ff735376a503c8c931d87ce8

SHA1
34a2b861aa76e2d0e4d0bddb114b3fbacf5218e3

SHA256
80e43cd98782932b3e4b097f0882777de4964a3747ce05d995f14ecfca4c1311

SHA512
42c9c2ec653f69080c600140c6e9b8c4cb899379968e79816d5c4babd69f1b89203928b9add434dcf218c9c0bda7907b740ff7b30a95d5aa7f488268992706ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\1663fdf7-5b14-4841-8d7a-9483abcddc35

Filesize
734B

MD5
4e22b29f56f955d7c18ba8c7f0b000de

SHA1
314897b520169c85d70ad6397ca731d0d6cbf15d

SHA256
6af0024105e535563b87377587a2701d9ba9949a18c1755376695669f4d76229

SHA512
23a7d816e2ff086d0e417eb031e6403e8530b1108a7cce6d5df6b072e316dd6a60ccbcfd6f3db6eb64efde2d3ceb1a19d0cf6d5d229678dc554585c196992cf3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\68086cb8-3a8c-4153-b0c3-a05bee6edb65

Filesize
865B

MD5
1ff26bde55b146b901c83dbb58166036

SHA1
d03d3a68c0ba2caec9829daaa582a3052cf1b7c0

SHA256
a5e63f1e086ff79e616ad10d0c69aa2765e2e26443d4079ec0716290303d62e8

SHA512
e0097e513404c1c72b094735e60fe2520a2089f85ab3c5cc523634ca96d8a43b153e5c77ca2d0772d724424e9ce0e28d1155de566d198bb8bf47f9eef562ef55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\6c0a098f-8cb8-4d79-95ef-b37fc1e9c82d

Filesize
659B

MD5
f9ff08ca459d3d9e26f662ce186974c1

SHA1
534c57ae5030f98460f63760ddb9379d216fef72

SHA256
f68b2bb16d37ee08636d6373e4e432283178def9670563192054e15a731b7768

SHA512
3a691e30bb6bda865837a7a3aa768ec433be26c87de1f1e21dae8bcb53d16d8d851e2b8b6819d783dd40600b6dbfba9c8795fc4dfba9271ca73fe9874899352e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\8af4ba26-6b3b-4810-99d9-cecca73d68d1

Filesize
1KB

MD5
999e575b430f1d007d584da5f106bc28

SHA1
af771a072adf8d66e23a34971c67a45ccef3741c

SHA256
70fafbbe97ec03c44764432d27ba7de6c033721c00d7fce0e7117bcccc22bae4

SHA512
1d32329b785d7cf5935943ca0e892d649d49ab16ebd5716d1d4a9f5615ced3e0e1f225993fa9169b7f4a95d1e0352f3c0f9e13799f9f3cafe0c30f4f8d0faf11

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\907dcd95-1956-4040-aea6-8d4af85d8604

Filesize
671B

MD5
d9fc752077c3557ba0634002d4f5d246

SHA1
a16fbc678281324dea72d8c6313c85515605773b

SHA256
cefa7fe2a6008ca53e008980c8fc2b2565176f4e3d948b1f35f7cd9f97d2d9c9

SHA512
4315ceed8e204c1153b2d9424fc72493e73e0827109aaff866b0c700b3d868eeecbf13a731262d26940ba9b96dac2140f6178e167c18b10357da00b4cb058a1f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\920e1e67-70cf-4474-afe3-a77526f17951

Filesize
28KB

MD5
515acb2cc80e32e47d171755dfd64aa6

SHA1
19626500eab9c43717cc08ac5567de468c48441b

SHA256
7aba0bfab1735005252f556c6c66841f9205646d5dc49b19219d89f813d01ac0

SHA512
7d796d6291e559041441f911e2297a49e96f55958677e3b56ba6a6e375822fd22ac597a8158cae41eb77d8f382a33ecea181d550f9bd63d5f6b3ea97c8f52ca8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\a8531ca9-867f-49a5-9455-80384eefc4c8

Filesize
3KB

MD5
ae2bb93c9d84d0e5420e3d33521289f1

SHA1
ebcc103e1a98cd05f8bb0d1fc8c4dde5acd105c7

SHA256
7ee1eba8c3fd07333d11e4fc72389e6efffad73440eb91697dba5fcee67a1f27

SHA512
0550231e098ead6911327cdbe380d8c72efb3b071709b082372e902f811728167d6b1f3ecd48b9b582fa6e7e2d5132549899715b6d68fa060a6cbddc69293f71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\dc6a21b2-fd26-46de-b5a7-2b8eb3516baa

Filesize
982B

MD5
2410fd5acb26febdf181789d0bc4a2a4

SHA1
3096eecdf56f59d816cd97a6133e6018d39dfb4e

SHA256
bf9829bc3db632af0f31a8f7098e89ffdde0859e6f72678af5015920e2e745ef

SHA512
2d0c1f87497b0b7e319e09bb9f3a4c018dc51acc06c188cd642c04ed57945c6bffa03c216e2a4f872a2890e3216877b1959b1f1a8bcff204c9124acde1bcd73b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\f4d60aed-6140-4fcc-94ba-1fdbeec00fc5

Filesize
1KB

MD5
59c5df8f3c7ed3d437a2d9d41f93a941

SHA1
ceca9c2081b727b72c04dfd541c837a94ca9ae56

SHA256
6bb8cf81586f5c1dd570c385dfc4b5ffed571699142c0cf07e21f3b0d7866ef2

SHA512
73f69917436532ec824a1f4eca73a4e61ee5bf75ae5685f01b05516cfe53b3c3c95636af38812df472d60bf8eb558f7134e3433a3bff82fcd77f95ef1ae28586

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\downloads.json

Filesize
821B

MD5
b9c728bb9882f932f253a4c9ad51339f

SHA1
bb0e9a6ad7b1601ea57d5b68eeec63f015b86a12

SHA256
686052c4deabbf0d5b2ad10f09a0a1eba5a510d3a099acdee476b6e66abd0a1e

SHA512
21ed9f7d9e229dc40bebe84dba8d93a29ed288bc134d95abf76e41bb0a78d4d8986acc33a872abf0206bb195c9232c6a0d8b5c5d21e2d72e0d4b81e0515330d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

Filesize
12KB

MD5
85605d35527954094178f6c51356d75d

SHA1
7c7a7687051e21d517dbeeee3da41544f0869cfc

SHA256
92f9f75d96e1e2d17dc74ddf901b9cdcb9bcc4b4e6b6046ed4f8c865eafee13a

SHA512
74b4dd8b0f7f5bf1fc74e6482e874caf918e8ed35e136a05415faab5ab444510aa9a703c05147f554854b95bf8f31405ed768e84e0090d44079b181deb986bc5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

Filesize
12KB

MD5
a8f1060399454f60c2830626175c7b53

SHA1
3259ab3d297cb05a6f3b184e041aef41dca9af27

SHA256
de4a16ab097f40ca9e30b1128fc5cef37b53b50c1634aab614f63404a44fe814

SHA512
16a4f303adb0af1f856b2b77f9599fd3279aa068be820b7030ed693e198f54a98cbcb332ae8341eaddc9d2a671b8b59c1b7c71ecac2d388cfa906e68dfd2df6b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

Filesize
11KB

MD5
1eb1f6fee1204723923f0928e10d80f5

SHA1
98390a15ef672d47a9afae2f53921943dba96806

SHA256
cbbafbcd5632c83f3b1686251faf855fcfe54ce1b3692faac943776b789d3e56

SHA512
882c8be87e96ddf5aebab6393f29770bcd918d19f0d447ce3ed3906bf6e306296aa99952f10dd558b49e0e1a82e81243c231e9520af09d1aa7fe138420e688aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

Filesize
11KB

MD5
10f72a6a3f6ae196d957754bfc381c0d

SHA1
f0712e5e8480d00ec27b0179f692eb7ed480217d

SHA256
9a4baaf1dd9bfab5e47b468cd50f550d74eca72efa0c1dd415d7c9477b513117

SHA512
69f0c012bcebb8c350b3d4dfb412fb701c320709628b93a5ab53d4c76d0624d4ecf19385fe07b90a6bccbb581e551a6da17f8c9cff28160a6a67c8dbf50975a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js

Filesize
12KB

MD5
de1aca7c25c99f6b1082a51b01bd52f6

SHA1
3a0f3cade931d44932533642c3f0b9d9ffdbdf08

SHA256
9b89aaefe07464fd3b76cccfe360128096195480d2e13041b31a3cea5cba0ebc

SHA512
1dfcbbc72b1e4aa44c059a1b8695c0b181630173ebfefc6615ffeeaa737d68dfd005e142f9ac14087f05423c892f2239ca65a656b129adb6882da02d770726b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js

Filesize
11KB

MD5
37e78be30f64ed1e1bfee832438f3616

SHA1
32a325595601bd6d701378225b70879ad581eae4

SHA256
d5f0477754533125a7a554372d1f164767e6032511c1dc7c6da2b2becedd47b0

SHA512
ce9ab28c29fbbaec22b06548aa95d2782f08cfa7307298afc37c26a665eac3546dcb2c6ff73df3c126d0b731bf62703e1f626750c4c19e53a17103bacc442c2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionCheckpoints.json

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionCheckpoints.json

Filesize
193B

MD5
2ad4fe43dc84c6adbdfd90aaba12703f

SHA1
28a6c7eff625a2da72b932aa00a63c31234f0e7f

SHA256
ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933

SHA512
2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionCheckpoints.json

Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionCheckpoints.json

Filesize
146B

MD5
65690c43c42921410ec8043e34f09079

SHA1
362add4dbd0c978ae222a354a4e8d35563da14b4

SHA256
7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d

SHA512
c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionCheckpoints.json.tmp

Filesize
228B

MD5
66bdbb6de2094027600e5df8fbbf28f4

SHA1
ce033f719ebce89ac8e5c6f0c9fed58c52eca985

SHA256
df49028535e3efe4ed524570624866cca8152de6b0069ebb25580fce27dccebc

SHA512
18782069ef647653df0b91cb13ba13174a09ce2a201e8f4adfb7b145baf6c3a9246ef74bdad0774a3023ec5b8b67aba320641e11dd4b8a195e1c2b448202a660

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
362985746d24dbb2b166089f30cd1bb7

SHA1
6520fc33381879a120165ede6a0f8aadf9013d3b

SHA256
b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e

SHA512
0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
6b84a5b41499174234ac5f66e683c8f8

SHA1
307c49ce9206840f66363313fc5878876ee23c02

SHA256
64d081df57e643a17a716513a594e45ff3b3dfbc4b89712fb90ef5913958d078

SHA512
6960eff31897a448522ef5b3b1e125e2f58d34722634f3fab12ef9e51ddb9ad0ee03c483a73fe7d48a0e260da3219dc62e5a478516f5de502497e565f9d92740

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
a1e0692b54ccade466a1ad55d1e13952

SHA1
f957a609a574db2374855bff628654a41cfd9557

SHA256
ae25fc27248eac01b2b6bca2bae490b150c4f3107cf537e4609c548419c43b23

SHA512
42899979d721a2bc4e35d9b92d54cf2eed43885b98b48043f1d069167d9befb5c0f354fb8218890f96ab508fcaae2987e83d6b7226debe5f1471043e995e18c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
f4dc203758f4d15a380c206a76d1dd09

SHA1
20cf9d53093720ea4394ef630d1a212bec2a1108

SHA256
13fc42f37bd474ce9dafa3ef0ca01da6c85e3b747bd22bc18eb13ad9eb116f00

SHA512
fb82702eba6fec6022b288197d2e471c15d17eaba379e430ab7c0f292de39c9d0eed23d9ec3aa04b6a3096d4c79aa384987229a92a1b88174724ce67cbba769e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
0032004d00e05c65654bbde9ab195d5d

SHA1
c05b6e250c488a52fdde51d65dd2c9f964408f55

SHA256
d8c8c776fc1a8e4b2488e43b7aa1df39174459d82cbfd6b8a32e6c1dd8dfe9ef

SHA512
e37b94889ddb58a79428cc31373c1014b2150ed3885caf0cee3df42b8a5fc02b9cd259160ec3135a6b4afa5d4aec964b7841b359d7b51e9d38943f34fb0bdb60

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
57556a834e2107cdf2e116f4750b5e7d

SHA1
5da979a94e823a837f545368ed8ebea0dbb06c7f

SHA256
b37ca21387e87080c3be98257735d0354adfbf28cbf2e3ee606346a080d42dd8

SHA512
ca83e1cbf8177ab01f3c32490fa828047f4dde68bf7ddbe9e6a50bd670c746a695eefb493c16dec4b0c1f18ad8292029c2e07d802c441c78dc51340cea23dcde

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
c8ae4d5d9c79132239fa54b6f27845f9

SHA1
a9eaa427a5e3b667cdd3e231815a2e3c8b7950a0

SHA256
2761775ece252cd4f45632bb395c63d98b9cd39f970963794dc7380dc26b8cca

SHA512
803dc84f377b24d45306a48b9be385a27f036812ab9b711a1937e7c3589af9261e7984e098f6e1e8f5ecd9f2b95c8d9ec8861cd545efbc6caff888e5e628a962

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
9ac71f4c0fbce75cf88568fa75def577

SHA1
3892dbc9b8feaf471bd01b12928da6a3e3633318

SHA256
9833b8b982ff74304f6b22114db79eaa3463ba5ba146544a1934d7c6ce2d1b08

SHA512
d253526d33f12d91eaecd4d57b446eadd2f5185bed35d2f0ba3d1845c06a738dfba0844666ae194de87c49f67778a9bf64127d5711ce9badfae55cf7c0138086

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
552KB

MD5
1d0a425d4095d6c0b5d805da838ba72b

SHA1
b9837efb5bbd66eddbd5ff9c457caa6d84b5c583

SHA256
17cdbf5bf31b979b539f6941fa40651b92095c56a27f2f0f8b846b04da52b4d3

SHA512
24bd07bcaa1d214ed0a46fe7484a2ffaf6570d04d94b186917566b065b3e61392cbe0cee13c95d8d1faf27ff623802eb2b7153f22d7bed4c8f682205f404a6f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\xulstore.json

Filesize
217B

MD5
3c7edbdeecdb47fba617e3d03c36b0d3

SHA1
53628ce8c5170810fabafab8e001bfd971d47825

SHA256
c3db6f2519b071b7441022f9ed508b0da5ba40295be0ee449a27bd6146595d04

SHA512
bbf56ea374114173f7de198cd71ac6e75276b0f30926c6690db512f45ac2e54d099d990c285578f702696494d2884d8550e5dddadeee01077933034ac3817842

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\xulstore.json

Filesize
141B

MD5
d7a9c29a5421078a9135ccf1cade552a

SHA1
e1b43108778d359d8d9287cf59225617e1769463

SHA256
bade20948c677d1d458e39a4cf6d8c4d8237263d55e63370d6272fa3243ffe28

SHA512
49553b13fa1cc8d257f2ca9056742e6e11fbdce21633edeb5af6f863294f97ccf3cabe851d94bcedba03e2716311a48dcf8064eb1500f8a7c400b049bf48296f

Download Submit
C:\Users\Admin\Downloads\VC_redist.w-2IQJuC.x64.exe.part

Filesize
24.2MB

MD5
1d545507009cc4ec7409c1bc6e93b17b

SHA1
84c61fadf8cd38016fb7632969b3ace9e54b763a

SHA256
3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a

SHA512
5935b69f5138ac3fbc33813c74da853269ba079f910936aefa95e230c6092b92f6225bffb594e5dd35ff29bf260e4b35f91adede90fdf5f062030d8666fd0104

Download Submit
C:\Users\Admin\Downloads\meowrara2.6\settings.txt

Filesize
10B

MD5
4c65e2f855d8696d18ab503ca9f4cbfc

SHA1
448a8b537b3dfa966682a496168bae8555c3c889

SHA256
268eef82beb074b0ebad1eaa73261d87f97ca50dbcdde8fc5621ed50c5f1faea

SHA512
c127295e977a579679201f36c9c70233ebbf70bf1cc8f6a83283d75c853935902172de3dc8b19eefddd64e182219926d5ecae944a993505e86994cc813e82b59

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
C:\Windows\Installer\MSI958E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\AspNetCoreSharedFramework_x64

Filesize
9.7MB

MD5
8d2736452d5c4fe580d1e9e0b48e5c0e

SHA1
64ba9a7a008ab368dcdb08c5396d45fdd4d87391

SHA256
42378f5db7098fad83175757d97d34c4c59ccf4e9a48bffe1671018359da742f

SHA512
9501cd784cb1c1fb363c1e5bef8a0e541bc05d895f90ce7f168e3a5607f77b4723c4c8cfe1839729d31e93bcb1e0a1e5045a784e7cfe6eeecebf3e9af3ebbec6

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\Finalizer

Filesize
153KB

MD5
768668aaa00028c01bd55c9cad38be22

SHA1
90e555698f1acad791d9bd0445c825b4f8bd1ead

SHA256
43d67682bc14d3ae0653dc54f128e7eb6a4cd546c7666c0e08024eeca8faf756

SHA512
dd0605c5b4e15f0732423d5da53072bfdf3668ca74dd70c8884ef94a7ddb8b62cbeeccbe7d9bb5f3974bca7588679fd88739225ebec054933fb9b497025641ed

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\_1d51f7168ee76de6e1e0dedc20af4655_x64.msi

Filesize
648KB

MD5
f904c4e361c69b878134a06c6d021592

SHA1
8077518359a666cbce0365e2fa79aa3da5ef4dd7

SHA256
5793780dba7ee82f6a12e7145662eb711d14db05b970fd211dc952505bb87cfd

SHA512
79dd63cc6be2bd9876164909608551029b5a6dd2a9b5f52cce8cc8fd9c35f40d573d6e2b935d9b57da455761b5cf5fa3e3d513c6d425dfd04e01d2d3aaa92a70

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\_57814a2ab4d0d3c49393630d2169e8af_x64.msi

Filesize
648KB

MD5
bffb061b6ac460d9b19fbe4247934c4f

SHA1
2ce3d29f5a4018bd6860f475d82e6b46e21e8481

SHA256
f86f6bfa1918c9ccf6b96f4832b96afe02149283171e9a95610f5bb8de2ed45e

SHA512
3804d77c83371df8f43d28fdc2b5739cc76a79deedb15f548d7afc0ed04b8c589f61220ea0f376e0aa9f3158297beb22d883c9d309c8af5c2ecb58e28903bcc2

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\_742b6d74542baedbfeca2e6c5804b329_x64.msi

Filesize
652KB

MD5
44f25d0fb186b450714f6d37cccea0bc

SHA1
3788c4005c30f5febffbb96eda6c7fbb95848b00

SHA256
2523d86f395ac6cab136b2461652fd1aa7f780b7e4a506ff69277ca6756d6b6f

SHA512
3c48b0e4bde46c6a6df0637d08f96ac27d9c4f88d4e4fea06bd6a4217e0f407860ac631afa2e9f83e8c3423090868e905161afe5af3b938f1d51daf46b5fec36

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\_8d47e97c6404ad4a185eb5a573486af4_x64.msi

Filesize
648KB

MD5
ba94fe85c7478d62aa9ccc1448414892

SHA1
ef9720414117459981952bbd03ff77004b40fc96

SHA256
2ad0d32d08cfd4fbf579aa8d675c6ae6c8406acc2153b2f76fc608d05c325261

SHA512
ecf4643e9d8777703a72adbd6405e35d4f0a9948eefb320fb8b3277bbbb5d805bdb4a3b13a00978cf90b82e92306502673df487c935f24a681a89934d0e76502

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\_9827d98bba2e18518f7361c1cc4ab44a_x64.msi

Filesize
648KB

MD5
8dcf9081c8507358d1bbd6742d51cea9

SHA1
f6a73c30d6c4425e2513777e6be8fdcfb6f3270f

SHA256
3b152e8cf4c0a8d55232f7f3ef93cbb4cc67ca0227126c7caf856c824940e9c4

SHA512
fae2abef23186f09703f354b26e6441617aed9a9e9d7762fbc5a68d15df319afaf9832378303469c8796ee8d4bb4e36689be04c83af0f3ccb3636688bbaefbb1

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\abe39ca5739be908ba559c1c17115c7c_x64.msi

Filesize
648KB

MD5
d05cc85bf8d40f91a5e63ade6e2a9ce8

SHA1
25d1a0d5adeb2226582e910d780f39a34585b4e7

SHA256
8aec2cb1a39648788fa0487842a0cb9c3ac4bd6d3666515e66ae73c24de33661

SHA512
954e5a8e0298ca3a7551865a5bef762ffb725c1b3a8ca01eee3c15ed404863875d1ce943cc69ef5b52f3286e4d3224db28897331a1963d49bd0b54d22b0ffe92

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\aspnetcore_targeting_pack_8.0.0_rtm.23531.12_win_x64.msi

Filesize
3.0MB

MD5
dc1f946c083ef96a20799088d162f0bd

SHA1
71a72e9f0eba3b4b7cdf932eec189a9516ae24b1

SHA256
1c62fb6462f85bf962a58452e1b73be076f1c703db6239fdb67a4c7e18e64383

SHA512
93bbe33bd871983c424badefefcc7b9aaa3dad2a179842d58b8f87efa182e8b6112973ee46ed0acfb63dcc282f91fa6eaff4ca7ff1cd027f03a8352a53996a5e

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\b2f6ff375cf05849408f27254dca99c2_x64.msi

Filesize
656KB

MD5
aeaeaaa48aab826347744bfd327ff450

SHA1
a332152f6f9318a4bf4f0ba480f0a1109d0392b3

SHA256
7f13b31c8ef23abbc9d7865a8db53041cea92e79f3154b37cfd6b1b77df5e3b2

SHA512
616be170e84d78bf47a35d20f65e122d17c21526a60af5c38230a90736218e9a684ba79f27a5cbdf8a138c6966871166f580d8cc2c160bc7e6cff4275258e8ed

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\be0ad677ccffd94aff9146224e2b6bf5_x64.msi

Filesize
652KB

MD5
047ef4a8e7e318c654fdfd7b0627ea57

SHA1
3b07e4a86261e2af773a052d6aa11b81a811ffa0

SHA256
d7653f0cb8e613bcd5a83d452737b1a2eb26c66c57af8442149eb17fd2d4c108

SHA512
c693d63d5f5b8fbcf638dec5c0ba7409ebdf42689d646bdbdafeb01e2065ea4faec0e891e0939357ef6b7dc6cc856efdbc0c89821c6fe1b05ce4678a274ae75b

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\c57c66ca52df2c178bd723ef830272bb_x64.msi

Filesize
648KB

MD5
95de3c4e11cff7ea6ef06d29f5ad4d5d

SHA1
0545ec48174e19b13cf05fd52f0f6f8b07099179

SHA256
a4f6396bd698fc3d872bb7b56d6de017b479b34de8cc93cf4176cfed6edf537f

SHA512
1331066591e770f5655a23c0a7ef21dcd377860d6e3ea25d11f6f64d04bd0f4ba358c2a9ff0b632962272056098e36ff4aac86d21be1a920708a85d1d5b3f6d8

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\da1bdf7c114f2788963a10ce897084d9_x64.msi

Filesize
648KB

MD5
f5e6eea729dd20d2c4aacb9417116662

SHA1
75dab949d1cb9a878b28f51c20cdce75d6a91a6e

SHA256
9ff280f9a6d834d5c8cdd6697400d7165680a395dbc7f7ee64f6bd18c5ed1a39

SHA512
0da05feeefaf20b1efd73c181447dae1bbb3e0f741abb84050ba9590f5b54eba52cfce35fb54dc54dfc1822a0702e0fcf96d3f2d8bf533fe32c9ce4ba41dd085

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\dotnet_80templates_8.0.100_rtm.23551.15_win_x64.msi

Filesize
2.7MB

MD5
2d9ad1237175308a98516d1b767ef5c7

SHA1
fd46d658598c9edfd01ffc54f43c5f40b5d5dc5d

SHA256
c835d4091929310018bbdc6c0321f1189d08875f59b5bd37303441b095e0e3d8

SHA512
aaa81e205812f43667c3354d28440fcb18e35068976e691372ced99248c0939b1a98c01f4b89e27e0ec08efd7dc9a05e5e3f7724845e0a3f72f4f7cf5b7a66a3

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\dotnet_apphost_pack_8.0.0_win_x64.msi

Filesize
4.6MB

MD5
c339cfbc76398b48f0754a5626def38f

SHA1
a9b68fd2fe22c376e26449eb7c25c4f257c0e803

SHA256
19cfd668ef7e92311d6ecf4ba50943da2fe6bf75015b679fcb6a13d9c7f859b7

SHA512
b5b76850f4b2adeb525b7f96596a9a3b80a32b67504f0131164510a83406d78baf39db9ecd57a033efe90123840e5c7019f810caf72063cd8b94155c6b0d6be7

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\dotnet_apphost_pack_8.0.0_win_x64_arm64.msi

Filesize
4.3MB

MD5
72e880392edc33c14b2928fe8b59e590

SHA1
52eeda6f758ebe272e5418694be6ffbb4b5ada8d

SHA256
c70d288e6239bdbe451af0e1c623cabfc8702dd569e429984b140a5f6698846a

SHA512
53b373d53f58cf4c4f229c32a5621e3c9be5c20c0ec628118e8756ec497e05ed999bd95bd640565d021ae911f49ad3ed2b1432d81536e6c501a87be9d709f840

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\dotnet_apphost_pack_8.0.0_win_x64_x86.msi

Filesize
3.9MB

MD5
b3b957553207dc4095146801f900fd68

SHA1
2bf0ba9418c0652b8d508148b15e14721edfe572

SHA256
6690412aeed2776c9536f99f5fcd7d5167f8ed345e4521c0d558a897055dbdf1

SHA512
2a5c45b4669ffc37def60bdf4cda85e267828535b607fbb1af03b8e25e8d0884c7d206456c9d81f2aced605ece0c0b70eafb8730cc9520d2ba297fcf6732fc44

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\dotnet_hostfxr_8.0.0_win_x64.msi

Filesize
796KB

MD5
6589266c2f3f7d4078fefe5047cf2b7a

SHA1
1c79c5e143478475b13c5d1fd1212e1a9aac5a88

SHA256
9be09b096303aec139ae4bee61308d3a80ae55cef54f15c469d0f1940935f85a

SHA512
d4ce4f2d7dc4cddd36c8d57d4aca9188a83bb31c0428adde2fb1fcb3225c7a353b83dca35345b162c8bdbbe48b5006a49d41fe139e701fbcaa73f8e8b3334ef3

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\dotnet_runtime_8.0.0_win_x64.msi

Filesize
26.1MB

MD5
f742bde0f8f21f84df215f3c1d171683

SHA1
d9c82a106069763af26f89b08301814315fc812b

SHA256
3e89b03747fd6c598d3852339d3ed142c216195ba56bf8790e5bddf4cfd7b777

SHA512
592c82b0b7ffb73f08fdbef01147ea163789c6e24829f0df5846f7c3a658be6e836bab2c42ec0585299dc237af778614b07721456d3c54cc696dfbdcc7fec3eb

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\dotnet_targeting_pack_8.0.0_win_x64.msi

Filesize
4.5MB

MD5
70a160b352e096171636ed6421ce9e43

SHA1
5b16fceda73ed2cccb8821b5616123145e0626b7

SHA256
c71ae39a26056700c592871a544fe0bfdde2e25560a3725b359546f258dcf58c

SHA512
057a4020b8877e49f08963e0ae19727991f9771fb93139d41cbf23dff81a9655882befb4beed555c03d778c2d1aeaae5107d33e4e8637ef3e5bfc634fb67e5dd

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\f0afb712a5278260ba52b75b232054cf_x64.msi

Filesize
648KB

MD5
a25bd9ae35f3a5e25502264c4c3fc859

SHA1
ba1a63a8f7f3798937b241153a8b3bf790ea1bf0

SHA256
eac5ce18bfde9f92c52ddab687ddfab312118ab7c4e47707e4c9808e7f5c93cd

SHA512
e4b99f74f91db1585a7711549dbb3ff0ae5ded78f019b129a9c3e54f84fce68d7feeff32644ad7576a61daf87c4a3abb767b1302beda813903a8b26439ecd836

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\f5d2bbd8d1830aa8dd4b07dee5e04573_x64.msi

Filesize
648KB

MD5
ae6581d1589b195b16c494f1e13a6c13

SHA1
a2fccb9249ed0be535216dc17e8691f53a6ed921

SHA256
046675c5a7af46ba76cb5154a9fc5aa71074247876bd0f63dbd09fd397715de0

SHA512
c8e20ba4dcaae7ca3e96a45da537c30ebad030af4d4ed4eb7c8bae6fbb2da0d4892c9ff8d79c475423464d3a0aafc9f04f7ec8d9023b4905960b2d452ddec5df

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\fa1e4892737b3b393253e957c80e1231_x64.msi

Filesize
648KB

MD5
0b6774b071253ae46ed5e9a8c00ec89a

SHA1
d2e2265da47c5e7610f10338e9330319d53ccac4

SHA256
59f5d9a3047e2ca9a383e69a95145dd5f25ce1a03cbfccabd972ca1a84fcab0b

SHA512
c5dd4925388c3f31457cfe378e0b45fd90c0855b89de9c6aed25003ca6d79c44a1264651013df5f561aa4a11e0e9a0948e3b376d9f69b9104cdbda20c3a13027

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\netstandard_targeting_pack_2.1.0_win_x64.msi

Filesize
2.2MB

MD5
a093b5bf3f67f66e5176cb2a114e59fd

SHA1
e135423e0c68ddd28e90b764087e896f19b25490

SHA256
13ba634758b3cb67fbc493b447688025c443282c1a78c3b1066dd662d23195e4

SHA512
7196490055c345dfa56cf82c73c62e493c706190221375b1e4d1169e415e6bba58046ac9244280c29a5bb42a92810deb42d8f8f076bbad168084e8a838452bac

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\windowsdesktop_runtime_8.0.0_win_x64.msi

Filesize
28.9MB

MD5
454916180f2913dae1647fcb336b4a32

SHA1
fb45ac72a86c4c4a6c4516b82f1aacc43f13b954

SHA256
fdd71317c4e84eaf54da183ca4ab838ee4cfa1a9f5af65d664ba66eb4bc71f4b

SHA512
d22030661d856c301b27bcbd703d6c30523899a230030d011fe665d839625676690e44942c71f276558a31e56924979817141d86b37c895738940cbb4f9f14a6

Download Submit
C:\Windows\Temp\{0A57A007-538B-4321-8883-0FAE55B24C97}\windowsdesktop_targeting_pack_8.0.0_win_x64.msi

Filesize
3.6MB

MD5
9c895c28f8019917663bf92caf73f662

SHA1
250b6c805c2633553798db1ea95918c066a079f4

SHA256
f9cdbc0f53a7ae2619afa9a7a86af349589df7151478568c101554555da69ebd

SHA512
b8f97133331e175dd9ae8591e0a3ee430ae3d087a713e108b76a74aa28659294efcae5b0e89f73ca4a84ccc1a6fcf933f2949416aa0e11b07f25f1a0a14e13e8

Download Submit
C:\Windows\Temp\{7209E27D-89C7-49F3-BF18-4F9CD6134E9C}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{7209E27D-89C7-49F3-BF18-4F9CD6134E9C}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{7209E27D-89C7-49F3-BF18-4F9CD6134E9C}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
d5a3fd8ad806f66d33d652d5913a95b3

SHA1
7b1bb6cdbe700acc2434dc52c40cdd96a6462a17

SHA256
cc001c20f85e16015e0d23eb0c3a9bc3c3cdcc1adda53f88ac77dd29705ba01a

SHA512
594d710133f44049546c62c3c89614415ad776c24f3ada0a8d1724e6daf27f941eba43a05a096d90cdf51ad51c02462edd6308e2aa393cb8325fde256ed77037

Download Submit
C:\Windows\Temp\{7209E27D-89C7-49F3-BF18-4F9CD6134E9C}\cab5046A8AB272BF37297BB7928664C9503

Filesize
962KB

MD5
8eccd85b6c4273a28a54b0687feb6a96

SHA1
be791128af5713d407df2f7436ea8de1a80ca725

SHA256
8fafd6d0754ee53125902df1b67ef2db86eb7af4c097522f2fb58443501fecdd

SHA512
9fdcb359a5748d0d920e1e12cf31de42fa224840fd11e5878f7caff7c4495b4facacf1a58cdaf0caadd0d9a3af871870b755245d2c1af33f07f3229b85101da0

Download Submit
C:\Windows\Temp\{7209E27D-89C7-49F3-BF18-4F9CD6134E9C}\vcRuntimeAdditional_x64

Filesize
188KB

MD5
5fc68510b7425822a9d0928567ffbd1b

SHA1
f506d97ceac3c435ce6bafda7c47d9a35fc57714

SHA256
7489cdde6a0c8aadb3253f22c460c2dc8099ba677f42d46b277f7040327c9b28

SHA512
4dd4d99ace30eb1add9ae225f159f68636d42d1899acb50f616717f05045e402a2bbb76e4d86569a08ae74bb161b3911a73910fcc7044429da34159cf6b9f473

Download Submit
C:\Windows\Temp\{7209E27D-89C7-49F3-BF18-4F9CD6134E9C}\vcRuntimeMinimum_x64

Filesize
188KB

MD5
0d00edf7e9ad7cfa74f32a524a54f117

SHA1
eea03c0439475a8e4e8e9a9b271faaa554539e18

SHA256
e55a6c147daab01c66aed5e6be0c990bbed0cb78f1c0898373713343ef8556cd

SHA512
0b6730fa8d484466a1ee2a9594572fa40fb8eea4ec70b5d67f5910436ee1d07c80a029cf1f8e488a251439ac1121fd0a76a726836e4cb72dd0fe531ce9692f6a

Download Submit
C:\Windows\Temp\{91F9B05D-3B28-4973-86DF-5260F713080C}\.cr\dotnet-sdk-8.0.100-win-x64.exe

Filesize
613KB

MD5
6ce047163eebf7073cf3a4344b635b45

SHA1
75be88517bc3bf959aa159f685c10694804d1cb2

SHA256
6f6da21180d0b8381f948e5441c7cbcd5e94266364c255c5e4841006dee2ac64

SHA512
8f3851743a3b6e6b4565ec636ec030c73cf0d5fb23b36a56bc0e2ccb096e09aa84bca9b9c2981cf7899551802dfbc79f7b2feeca0aab4aa42efde7de15a00cc8

Download Submit
C:\Windows\Temp\{B69ED7D9-8AAA-46A9-B6F7-846E1228CE15}\.cr\VC_redist.x64.exe

Filesize
635KB

MD5
ae0540106cfd901b091d3d241e5cb4b0

SHA1
97f93b6e00a5069155a52aa5551e381b6b4221eb

SHA256
8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c

SHA512
29bb486bfdd541ba6aed7a2543ff0eb66865af737a8fb79484fb77cb412c3b357c71c16addf232c759d3c20c5e18128df43c68d1cba23f1c363fd9e0b7188177

Download Submit
memory/180-831-0x0000000000240000-0x00000000002B7000-memory.dmp

Filesize
476KB

Download
memory/532-6898-0x00007FF9398C0000-0x00007FF93ADF6000-memory.dmp

Filesize
21.2MB

Download
memory/1212-830-0x0000000000240000-0x00000000002B7000-memory.dmp

Filesize
476KB

Download
memory/1520-8287-0x00007FF961400000-0x00007FF961402000-memory.dmp

Filesize
8KB

Download
memory/1520-8288-0x00007FF938960000-0x00007FF939E96000-memory.dmp

Filesize
21.2MB

Download
memory/1520-8280-0x00007FF9634D0000-0x00007FF9634D2000-memory.dmp

Filesize
8KB

Download
memory/1520-8286-0x00007FF9613F0000-0x00007FF9613F2000-memory.dmp

Filesize
8KB

Download
memory/1520-8285-0x00007FF963090000-0x00007FF963092000-memory.dmp

Filesize
8KB

Download
memory/1520-8284-0x00007FF963080000-0x00007FF963082000-memory.dmp

Filesize
8KB

Download
memory/1520-8283-0x00007FF963500000-0x00007FF963502000-memory.dmp

Filesize
8KB

Download
memory/1520-8282-0x00007FF9634F0000-0x00007FF9634F2000-memory.dmp

Filesize
8KB

Download
memory/1520-8281-0x00007FF9634E0000-0x00007FF9634E2000-memory.dmp

Filesize
8KB

Download
memory/2492-793-0x0000000000240000-0x00000000002B7000-memory.dmp

Filesize
476KB

Download
memory/2616-7192-0x00007FF9398C0000-0x00007FF93ADF6000-memory.dmp

Filesize
21.2MB

Download
memory/4920-6885-0x00007FF9398C0000-0x00007FF93ADF6000-memory.dmp

Filesize
21.2MB

Download
memory/4920-6884-0x00007FF961400000-0x00007FF961402000-memory.dmp

Filesize
8KB

Download
memory/4920-6883-0x00007FF9613F0000-0x00007FF9613F2000-memory.dmp

Filesize
8KB

Download
memory/4920-6882-0x00007FF963090000-0x00007FF963092000-memory.dmp

Filesize
8KB

Download
memory/4920-6881-0x00007FF963080000-0x00007FF963082000-memory.dmp

Filesize
8KB

Download
memory/4920-6880-0x00007FF963500000-0x00007FF963502000-memory.dmp

Filesize
8KB

Download
memory/4920-6879-0x00007FF9634F0000-0x00007FF9634F2000-memory.dmp

Filesize
8KB

Download
memory/4920-6878-0x00007FF9634E0000-0x00007FF9634E2000-memory.dmp

Filesize
8KB

Download
memory/4920-6877-0x00007FF9634D0000-0x00007FF9634D2000-memory.dmp

Filesize
8KB

Download
memory/5624-8301-0x00007FF938960000-0x00007FF939E96000-memory.dmp

Filesize
21.2MB

Download