fea34176704339dadce1e7592bd2b1594d22fbf0d574f61517d590bfc0276595

Analysis

max time kernel
150s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
18-09-2024 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AimWare Crack/AimWare.exe
Size

93KB
MD5

abc13201f23ec06c8ed617e503569aa5
SHA1

22e03e82b23939e67fd76452d36d93910f8f9bb4
SHA256

775ad89dc1d9f9d79706b57676912fa01d018038e7f2d2923ccddf3f5b954bc1
SHA512

ae76fea38c87ae2d0a97fe9db654c72f8102da63fc396a6ebdaa95773ffe7189629d75e4426e389611b1dcb53c3de9c19d4b9b64acc305d3fbdc8f3b4f476bb5
SSDEEP

768:eY3EUfhWXxyFcxovUKUJuROprXtWNzeYhYbmXxrjEtCdnl2pi1Rz4Rk3DsGdp2gM:uU5WhIUKcuOJ2PhBjEwzGi1dDvD2gS

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3548	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	AimWare.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	AimWare.exe

Executes dropped EXE 3 IoCs

pid	Process
2068	Explower.exe
1872	Explower.exe
652	Explower.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Explower.exe	AimWare.exe
File opened for modification	C:\Windows\SysWOW64\Explower.exe	AimWare.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Explower.exe	AimWare.exe
File opened for modification	C:\Program Files (x86)\Explower.exe	AimWare.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AimWare.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Explower.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Explower.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Explower.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe
2712	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
852	AimWare.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	852	AimWare.exe
Token: 33	852	AimWare.exe
Token: SeIncBasePriorityPrivilege	852	AimWare.exe
Token: 33	852	AimWare.exe
Token: SeIncBasePriorityPrivilege	852	AimWare.exe
Token: 33	852	AimWare.exe
Token: SeIncBasePriorityPrivilege	852	AimWare.exe
Token: 33	852	AimWare.exe
Token: SeIncBasePriorityPrivilege	852	AimWare.exe
Token: 33	852	AimWare.exe
Token: SeIncBasePriorityPrivilege	852	AimWare.exe
Token: 33	852	AimWare.exe
Token: SeIncBasePriorityPrivilege	852	AimWare.exe
Token: SeDebugPrivilege	3804	taskmgr.exe
Token: SeSystemProfilePrivilege	3804	taskmgr.exe
Token: SeCreateGlobalPrivilege	3804	taskmgr.exe
Token: 33	852	AimWare.exe
Token: SeIncBasePriorityPrivilege	852	AimWare.exe
Token: 33	852	AimWare.exe
Token: SeIncBasePriorityPrivilege	852	AimWare.exe
Token: 33	3804	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3804	taskmgr.exe
Token: SeDebugPrivilege	2712	taskmgr.exe
Token: SeSystemProfilePrivilege	2712	taskmgr.exe
Token: SeCreateGlobalPrivilege	2712	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe
3804	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4592	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 3548	852	AimWare.exe	81
PID 852 wrote to memory of 3548	852	AimWare.exe	81
PID 852 wrote to memory of 3548	852	AimWare.exe	81

C:\Users\Admin\AppData\Local\Temp\AimWare Crack\AimWare.exe
"C:\Users\Admin\AppData\Local\Temp\AimWare Crack\AimWare.exe"
1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\AimWare Crack\AimWare.exe" "AimWare.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3548

C:\Users\Admin\Desktop\Explower.exe
"C:\Users\Admin\Desktop\Explower.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3056

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4592

C:\Users\Admin\Desktop\Explower.exe
"C:\Users\Admin\Desktop\Explower.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1872

C:\Users\Admin\Desktop\Explower.exe
"C:\Users\Admin\Desktop\Explower.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:652

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3804

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\System32\hpnsw5.exe
"C:\Windows\System32\hpnsw5.exe"
1⤵
PID:848

C:\Windows\System32\hpnsw5.exe
"C:\Windows\System32\hpnsw5.exe"
1⤵
PID:740

C:\Windows\System32\hpnsw5.exe
"C:\Windows\System32\hpnsw5.exe"
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
9e466b4837d8431be725d6b9c1b4d9ef

SHA1
3f247b7c89985a41d839cad351cd0fc182fcb284

SHA256
2f9a5eeb5ac8cec52a3e73621e4d392f501f5d657dfec3215ccd40eec317208d

SHA512
01de0fda555d63b5c38339b0f6d38c28de2a882643439679e63cf5d75f13516b57dc90e8dfb8c638bda328fc12342e58d1e501acec8f85b92dbd5589dac06418

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
960B

MD5
16846df493521e84fe47cd6b6451ec8f

SHA1
6d99eb017c5aec08d3a7e908bbd4a051ce250c02

SHA256
69f19f2ab2f3625faca623477864766ab1ef3a21712bc892d7b2b0886585b3f9

SHA512
aefa5121601b8273cff6b79b7f76417c71e29e835b66faf3e1a67d0d38fb9ebe90320b75493fd5c4a2d9ea3e3c485d0a84bcdbfb78c26a8ecee3175cd8bd93cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Explower.exe.log

Filesize
408B

MD5
593f806d2255a76afcad5d4a8395781b

SHA1
3990edff12ef61875bb4206b25a97a9440a8998c

SHA256
beb8b3a764b3e94cc547be84090345e833be03d95d680ad4d75734ccd6485757

SHA512
97440ebd7f8aac1030fe83c7f32a40a986d0fa6faec2c8b8cfbce093a3f27e7626c0b6e768ce6c753ac4dddc4227057b3a6e1d5a652d1f4a9cf64fa8efbad017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Explower.exe

Filesize
93KB

MD5
abc13201f23ec06c8ed617e503569aa5

SHA1
22e03e82b23939e67fd76452d36d93910f8f9bb4

SHA256
775ad89dc1d9f9d79706b57676912fa01d018038e7f2d2923ccddf3f5b954bc1

SHA512
ae76fea38c87ae2d0a97fe9db654c72f8102da63fc396a6ebdaa95773ffe7189629d75e4426e389611b1dcb53c3de9c19d4b9b64acc305d3fbdc8f3b4f476bb5

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
cd6829f53a60318a54648f4ff9d694c2

SHA1
eda672c23f219a9cdbe740079412f5fbe04a157d

SHA256
5410184dfd5ef071de14c78cc7e9488049a85e313a3454250d53e974251ac906

SHA512
25a54ac013419868211b704a9b1f4cbc7c0a5b1a0e10cec09cd8eee3fbde7497e36c8e35f0506622eb9a47939c2c6b9590bf9bbf8d43508be13d7f85f7838ec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\.ses

Filesize
53B

MD5
1f9fdcf4ec45e31976d9faed803d3550

SHA1
f48feeaf59c668f9d8800026cf43d75b015b4b23

SHA256
a99b7f823d20520b7c8edacf51ef068211bb6e5868a4fc875f5da98206a6024b

SHA512
730f6e8ed0123870fb7e205b2af8427dfba0f82c63b48a106c58cdcfb8ac7b9b2fff0085f8c8aa7cbb0b944178648cbe33a880a246134dbf58067f460acb391c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log

Filesize
1KB

MD5
bd91d6cc28ea069a1252474380485568

SHA1
a72ff39c2d470ba9e92356cc5b737256097906f3

SHA256
b016b1295a1ee2eb41fa82a946a1dd3b23e32ad94445249b4b783b361a658cd0

SHA512
b0fdfada272219182bdc5b53b0e326c4285a2b478da7e57934e7d83723a23fac2858be475b2a00daa892e9acb92029df61d159d8784f23806f1522ee1cc60132

Download Submit
C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log

Filesize
13KB

MD5
f703fc7cf46e5e739de3e2cd3b0be70e

SHA1
22de84878746e5b1ca39bd820a3c62af396dc427

SHA256
75dc95760444fc997f6c1c39d095b55548371d1e11748a39c2fb82270dfa950a

SHA512
49674a5415ac2fc80e4a1c509354f6a5a1a3028f591e5bd6d3992202295a9bfb8bba636a501f1215745d3aa4ba251da16c05b5a2e26556e104d537157856b2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\LIRNGFNA-20240802-1531.log

Filesize
57KB

MD5
b51ef910100a66efabd92809765d16ef

SHA1
c8852e62fef0f7fc0139c841e743708413f7b067

SHA256
0308f744a4eda03cee8696992e0a98f4e10bdbbf4aec38f8e747007d803aa211

SHA512
5d8d4e7a8df7875e076c1507bbfafcc36077ad0637b8854e2a665a62f67a938c31e191d5a38f40ed4e03c0fc4535fef6491ea46bcac6f4da5e1f27d754f61ad8

Download Submit
C:\Users\Admin\AppData\Local\Temp\LIRNGFNA-20240802-1531a.log

Filesize
182KB

MD5
d24068472871a2ffb8f270c0830bf40d

SHA1
5cecd048a34aad32398980843f50e01bfc61a11e

SHA256
cc647880e4b08161ec1b125acf94c19573511ceecdf01622939f6a1d9f0ba355

SHA512
f117bbd8e8e86a43ab35c28fca5270adf93500e17d881f58af15e2de249c39872d98d5bc3ca84baa21a782532af0e426aa3c73546a42ead9c73916560d4763af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240802_152703676.html

Filesize
93KB

MD5
068ff623e4b6fdb44d4603d5d1873dc4

SHA1
0b96c9a4038d59b1845474dfebe04089be2b1b3b

SHA256
502b5c3696aed2083b09f2a784287974114b1971d3522c5c05825b3089fc0ecd

SHA512
79c1a778b23bec4f0c8a42ebffba7625c8176f9a447a3a154a81557293ac7a0ea56ec11cfa1c7d824db6596e6bc876c52bc511df4e6e8d80867a75262c20073e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240802152727.log

Filesize
15KB

MD5
db01218e731631ff185e639b7c734985

SHA1
3506ff4f878cf86609eac6c5e1ae272459def191

SHA256
b7562b4c739c920e9d81acb3223a4d3a457209409fd76670a6357059965bc551

SHA512
e17d03b876d7c9eba19d9854fcdab2adaf6a42a81448b810be9b9a650f46ccbcca315c0ea2ea715f0fe9362f3e4faf3d7f9dc8b50d2cfe73d1563c8f95629965

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240802152727_000_dotnet_runtime_6.0.27_win_x64.msi.log

Filesize
551KB

MD5
7ade0831830d716dacc0de0d843128b2

SHA1
4329d58518d3ea58e4cfbf495105dbb825054169

SHA256
63f1bb8dc51d6dc5cb402b69efe96f3967be839f46f2e8319995e2b17c427122

SHA512
1f5269f8aab722067f3c0ea4bfc4fe22c03a3bc91d13dd44e3d6b10b0efdb3b92cea75dbc8694f9a65fdc3d4acc1afdd244826a361048bb006bc391f973ec525

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240802152727_001_dotnet_hostfxr_6.0.27_win_x64.msi.log

Filesize
95KB

MD5
0e5419666a4ba05441189a536531351b

SHA1
79963168794d654ed2cc13cd46b5a8b660f0bd73

SHA256
3d1eca4819b7c54219e95110b7d981e38abe30cf504c04ba969625d1418de53d

SHA512
e2aa355f879961642821f3a2f8088630fa112713b9fb8bd35c7039483c1a262c36a1532cb4b563aa290487efca2a9919ee8a14dbe948668269a30e37f43995cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240802152727_002_dotnet_host_6.0.27_win_x64.msi.log

Filesize
105KB

MD5
9641b45bfbe5363cb3afdc4bbc08ed18

SHA1
3e4fe62eb69a4d5ec17571d78be8ba1b6bebdd7e

SHA256
86c6b7d4e375950e5075a3030288ab164c10c286b1228fa5e5419481e5457067

SHA512
1abe9362f53075df6728202da3192ee06f012c1e9ece0a7c0c1dd90d8a3b48bd5a663ed59e6206fbf41ae70787de4560ae60aa9db3a7d24f9991216a065e0b15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240802152727_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log

Filesize
847KB

MD5
7d742bbea36e38c934cfb8f630690389

SHA1
bb775957a06a1559f679bf26452fa8e31a1b6d5a

SHA256
5e206d34635f3e8c17db5bb1cb07434c66c4086320a6a529da2b9a79d35eab96

SHA512
809a03452613c960b598f2aca33561f1056b743f29af6a466640c6669e7b99a3dd95b654b594d7001138593d21277a938e8e4640bb0cfbd4cf9c33f890fcddff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240802152750.log

Filesize
15KB

MD5
d031ace27c453cc426260c11563d1d64

SHA1
b7563ec78904a985df729a54c84d6256a271c83e

SHA256
b065a797019ae41e6395ed1fc932068e689903f959448ddb46f8be4f99c95ed2

SHA512
423931700120d987e07692ff9feae7d9431689ac7c29126a74cc1204ef6957fdbd6fc1cd51f28c8296cd7332764946fef27efee5c4a5c5b1beb7ba32a968fa7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240802152750_000_dotnet_runtime_7.0.16_win_x64.msi.log

Filesize
470KB

MD5
71b94205bfd6bddd3ba15cf28af74e52

SHA1
61362437e0b1731ad50770e590243c65385cbd47

SHA256
fa1af447598a1d37d2679c52094089d286c0ac9bac3e5c4b90deb9e8d2f876d6

SHA512
10c3ac3180a6b42b9f559b1a05611c93e9fee6a57c1dfccc32547585ff408831debc087da472b24e5a4d50597a4d0e3361f2f509284c0430fb03a63016786f33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240802152750_001_dotnet_hostfxr_7.0.16_win_x64.msi.log

Filesize
95KB

MD5
4fc10ba3eb5fc4dd0c7744d1cbe2c0ef

SHA1
49d5b83a7bc28359d6d23867084b872e2b2c6ace

SHA256
bd8b92d0109c4cbec37501df5584279c2426aa0bb5c3ed857442290305ff2e58

SHA512
0c5990831ec0d51412bf082f322dcae1bf874f16f2c3068ff38fa7a2fe8b482231b9f603342edd23fc90ba5aaa72acaf223d2e585ae4d78c3eaa105101cc93bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240802152750_002_dotnet_host_7.0.16_win_x64.msi.log

Filesize
109KB

MD5
b8d64292a2812ad37a8c93e978f8cdd1

SHA1
8785b56e2bb921f5bcdf4b1038cd835ca07b9236

SHA256
d3157e5e23ed6fa2e2879a4da60190bab77d7f253af9f772b55c003ad8c33d95

SHA512
89fee34b45ec71ade2e9838e0f42fa4b617afc1d307993680962b41730d8ee34257b5ca486470d781bc0c7cca3549eaee95ec2051e377151eb27be83025ea4f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240802152750_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log

Filesize
852KB

MD5
919608dde5f4eda727c50bd0dedd1e62

SHA1
3339d1d3db27f610c6bfc378b80eeb5924f6f343

SHA256
88a24be965e07829145b3cd54a0623a85fdc20c32e499beff525fa420d50dc64

SHA512
60a12eb0a37682749ee5017bbf17437997f0489c03ddd18bba28e8fb3521360b7cc04cefde3089548484d713d0c63d8437614f3bbef92a7e4b154ba691906c04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240802152814.log

Filesize
15KB

MD5
6fd491fcd608fa9952427f873cd36d09

SHA1
e1598a132874bf1e2c9bb79e7c6e20f599898b3d

SHA256
ba18cc19dbfc4da767d6a3d935973eb54d709ef0b30c0f3262dee28d250247fa

SHA512
3ecd995a6e6c69be0981215212d3275a3923b80350c172e1bba59fab4fc0f9894c64d4cb50bc66f32bafb3d8488f275e34057c48d0273e8d7b01281a77bb5593

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240802152814_000_dotnet_runtime_8.0.2_win_x64.msi.log

Filesize
469KB

MD5
b415c13d58d72b6876ed7d96d74052d2

SHA1
477a7859ef8ebbeb2f58c69720a10518f1287fcc

SHA256
807467559666b652b4f6df82f931860624b4ed1990dc0c173e76a9fea15ce5ec

SHA512
a53176c740148c040d98a3a79fefc06e9be947901ee7a59625b07bc073d470035cb7badf901ecb5813d6dfb872d1087ab1d8e7413608ec2465a8efbb5ae4d0a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240802152814_001_dotnet_hostfxr_8.0.2_win_x64.msi.log

Filesize
95KB

MD5
d51db1bc34f5afa9393e8086d8d3a98f

SHA1
01d348c8def5c6bd910c7295eb5ba38c2bad7b91

SHA256
cc89ea0b80d54e6d93306863145bbc39837083611794217988b65c79fa559f81

SHA512
f8be0c6ab52180c5b22c5ec330c54006e574444d1d0744d803e22aa3e62378bf39721da03398fcebfbc047bf60985422d1ee83b53c19ea395078390dccc74587

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240802152814_002_dotnet_host_8.0.2_win_x64.msi.log

Filesize
109KB

MD5
89ea7968d986a096897d2f04de432cb2

SHA1
5e34a44225d93aaec6e83ac2e6cd130aa71255e3

SHA256
4a6c42a7065e85d4093510e39552bc354ad84084df82d5f760c0a0e9fb7cf3c4

SHA512
50ef01b8b41151bd24e625bee376a382b09f7cc38597212bf9420a9ad06de182bcfcccce6c357e16eb9b79130287a757595aa28bccae29d6ddf921ad3f85df7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240802152814_003_windowsdesktop_runtime_8.0.2_win_x64.msi.log

Filesize
846KB

MD5
b14038c5936b5a5fa7fd2148abc6a36b

SHA1
864e1cdb740772076e1df1292e158acb4310950a

SHA256
09865be7c67e304d87045d7e097fa9f3a5165453b3ec49cd7c0e90a42db912da

SHA512
ddcadbe3418a0a6d6f824052f0617aee2611fbb3d7cbd067b7726b5873c7c4e3f3ce1a1fb63b1cfdb4e7a3255ee8c51bc922c212080b97836ffd3588d92bd667

Download Submit
C:\Users\Admin\AppData\Local\Temp\aria-debug-324.log

Filesize
470B

MD5
203209f8b4ef984a643adc97f6848b85

SHA1
491f01cbaf551bbada1b4896e59d716c8eef77b0

SHA256
fddb13f780b7163ee9d25f65b5fb355200827215b7003214397f382002b63073

SHA512
f16dee371d852e282a2444c585179366dd50c722dc7129037ecc1392ce218aae989fddc2fca1e03b972f86aad887171efc3f66855d64a066cbf6eade3703108c

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
6KB

MD5
508f024e96cf212d7c406e0f096f2194

SHA1
6b33e7354e0ed947d7b7716dafd0785c9f0dde92

SHA256
ccdd05baf6660c9864107a6baf912652e1daea9c4d301f8f1860742561b8c7d9

SHA512
b29304cb4a8a0d249aa1c44665b42f9d58882244f292b8dbf325c27773fb8f700461deb668cd15abd31f66cfce60a638288a4a2eed6fc1cc26a7d00f4b5cbab1

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Filesize
1KB

MD5
27cc9c9cc231936e9dba11d75aaf1c1d

SHA1
d0f51875e8bc977ac4ea2247cdb93a17fafcdbbc

SHA256
bf8a0d0742d671de8d7d7353f2e07ca25baf243a567fc9573765a049a084d786

SHA512
879e1d310c3cf4ea426544c6f773e4c1e3308fbba4b54d71678ebec6eebe00cc3ee412d3bd8db3b906ad8dac12e5f701f11949d7985b42023a7ecc0acc8631eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2E64.txt

Filesize
425KB

MD5
57ab0d9cfff4350df76f64aca360f57a

SHA1
14fd0956165a8477a40c3d79b96a501a7072faef

SHA256
4fd333796ad7da0f535650b937947c40087074e7a6fbf5afadd893cc0b32077b

SHA512
8b4291cf95fc1a7caff55450f749f6f9000bbfac911c75a3b76728052e926821e61a10d8132715d0b5426a042d351ecc2150d1e6fbe9a4421dcce930fadba322

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2E81.txt

Filesize
415KB

MD5
375b58715259d2f297dbd80e6b554ea4

SHA1
de3fae8a039dc8378f89049dddbbad1eb9892493

SHA256
97a861b64e1998b196af64004d7faa35ec65bc2212c522c928c81ce47f6043e9

SHA512
eb040d568974d3c3eaefc6ad566bade587fcf1c8f04a1f4ba32933bc292208ab694aa720d8eef434314ee5e53e7d272d117dab0cfb2ebfd374343027c50e6753

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2E64.txt

Filesize
11KB

MD5
fffea40ab1a90d5c13591b11ebcf6690

SHA1
1b86b3fd54c0de5411f2c51b0617baee71b4722e

SHA256
cd85cd0b4a33d340f3e6bc060bbc217ed849c55ad761809a2fdb7981c581bb3c

SHA512
4f14f0cf6b11873e591de18a4d2eda3fbe3781e75566a5a57eea8cf66bd1907b9b0ddc25dc611ecb55662fbbacce7ef05edcdb74ac0fb277a6d17ad13223a6ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2E81.txt

Filesize
11KB

MD5
a2903198dc1cbb946a2b15b6cc09efdc

SHA1
4894c530893d4ee62a5a61bc79ec713834a752ea

SHA256
2cc261731a82cfdfc1af62459a7c92d91b06b1636e107e83e430a32b4c29dbe9

SHA512
a0fa49c9eae99ea2e35a20f1a8fe4a27e0b27aa2dc857a952ff9dfb0c1d55e9cd256890a32cf1603e5caa39e41adea071ef4f203c6eabea5f1a471893f1d6f07

Download Submit
C:\Users\Admin\AppData\Local\Temp\jawshtml.html

Filesize
13B

MD5
b2a4bc176e9f29b0c439ef9a53a62a1a

SHA1
1ae520cbbf7e14af867232784194366b3d1c3f34

SHA256
7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73

SHA512
e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
163KB

MD5
7009df43725181776e2443659bd99dec

SHA1
b32ec04d0d1cded674bbfd6d870025f8877fc50f

SHA256
6d017d686cd4dae051dff96e9c7ca1c981973495e63a237a0ea4f068dc597c27

SHA512
bd0033430dc8b17edf80893b6c5d4aad690db32b9ee05bf87272f3fa3c0a17d0dc8793891fd6b678649f1e2d15be69e71c11dcb2d25cf14979d15466a698fbe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\msedge_installer.log

Filesize
2KB

MD5
18b3d535e5dbad741fab5c5c5e3b3c90

SHA1
b1cda2c9f12fefad347e3d4b6b987ef48b3cded1

SHA256
d05d4af49350c78f41d387897c7af29265b8610b0c455a17e14e1e9a525a8a8f

SHA512
4e71eae24ea30b06200fff09ab4eb8b0a428a3a93514147f4387c3e82a7f2447cfeffffe1ea3d135459a53608c78ac556c1bc1d67f794d3efee6c890b0b51483

Download Submit
C:\Users\Admin\AppData\Local\Temp\wctB0B3.tmp

Filesize
40.2MB

MD5
fb4aa59c92c9b3263eb07e07b91568b5

SHA1
6071a3e3c4338b90d892a8416b6a92fbfe25bb67

SHA256
e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9

SHA512
60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace

Download Submit
C:\Users\Admin\AppData\Local\Temp\wctCB00.tmp

Filesize
63KB

MD5
e516a60bc980095e8d156b1a99ab5eee

SHA1
238e243ffc12d4e012fd020c9822703109b987f6

SHA256
543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

SHA512
9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
693B

MD5
60452a93ad0ab89948d090cc33436a5a

SHA1
32ca1cfd4c469b62da111859a2e7ee34231626f5

SHA256
89f87f4b86e4fa025c01e15846ff403d782a27bec830f2c70fdf2b901775df3c

SHA512
b249c09423e1bf6acd99ceb2228ef7b8fc4f08b16d206eafb098dab379ecdac2b1c0ef5c6d6046fd34874f151fe5b16714c27574f4c3ee46daefe6da25b308ea

Download Submit
C:\Users\Admin\AppData\Roaming\app

Filesize
5B

MD5
410c3c7c3e0376e2f9b228980b58d042

SHA1
3aec3fa12cd88edca90fdc72a0d25cd071dc2052

SHA256
5c272042cede2596555e6b6f2c36857b015ccab9f34affbc63d6b000ccd08391

SHA512
2a1e382b045d59580271cb05b521d0c6e99772be7cd5ce38d3e5e1997a4cb9d3fe5d424a24c67383a5a2d0002d4a2194f71e1604fa9ff0199944f8cee9b26a57

Download Submit
memory/852-1-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/852-2-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/852-22-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/852-0-0x0000000074AF1000-0x0000000074AF2000-memory.dmp

Filesize
4KB

Download
memory/852-53-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/852-30-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/2068-31-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/2068-25-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/2068-29-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/3804-50-0x000001E8E5DA0000-0x000001E8E5DA1000-memory.dmp

Filesize
4KB

Download
memory/3804-39-0x000001E8E5DA0000-0x000001E8E5DA1000-memory.dmp

Filesize
4KB

Download
memory/3804-41-0x000001E8E5DA0000-0x000001E8E5DA1000-memory.dmp

Filesize
4KB

Download
memory/3804-40-0x000001E8E5DA0000-0x000001E8E5DA1000-memory.dmp

Filesize
4KB

Download
memory/3804-46-0x000001E8E5DA0000-0x000001E8E5DA1000-memory.dmp

Filesize
4KB

Download
memory/3804-48-0x000001E8E5DA0000-0x000001E8E5DA1000-memory.dmp

Filesize
4KB

Download
memory/3804-51-0x000001E8E5DA0000-0x000001E8E5DA1000-memory.dmp

Filesize
4KB

Download
memory/3804-49-0x000001E8E5DA0000-0x000001E8E5DA1000-memory.dmp

Filesize
4KB

Download
memory/3804-47-0x000001E8E5DA0000-0x000001E8E5DA1000-memory.dmp

Filesize
4KB

Download
memory/3804-45-0x000001E8E5DA0000-0x000001E8E5DA1000-memory.dmp

Filesize
4KB

Download