hxxps://github[.]com/EugeneSunrise/reWASD/releases

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/EugeneSunrise/reWASD/releases

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	reWASD700-8447.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	aspnetcore-runtime-x86.exe

Executes dropped EXE 6 IoCs

pid	Process
2564	reWASD700-8447.exe
1536	windowsdesktop-runtime-win-x86.exe
828	windowsdesktop-runtime-7.0.7-win-x86.exe
4900	aspnetcore-runtime-x86.exe
4756	aspnetcore-runtime-x86.exe
2212	AspNetCoreSharedFrameworkBundle-x86.exe

Loads dropped DLL 36 IoCs

pid	Process
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2564	reWASD700-8447.exe
2412	windowsdesktop-runtime-win-x86.exe
1132	MsiExec.exe
5032	MsiExec.exe
4776	MsiExec.exe
4196	MsiExec.exe
4756	aspnetcore-runtime-x86.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{929eedf8-8704-4e0a-9b54-c9e6db21a6e4} = "\"C:\\ProgramData\\Package Cache\\{929eedf8-8704-4e0a-9b54-c9e6db21a6e4}\\windowsdesktop-runtime-7.0.7-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-7.0.7-win-x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\cs\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\zh-Hant\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\ko\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\cs\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\PresentationFramework.Luna.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\ru\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\pt-BR\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\UIAutomationClient.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\ja\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\System.Printing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\fr\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\LICENSE.txt	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\zh-Hans\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\pl\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Reflection.Metadata.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Threading.Overlapped.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Private.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\UIAutomationClientSideProviders.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\es\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\zh-Hant\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\mscorlib.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Runtime.Serialization.Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Linq.Queryable.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Reflection.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Drawing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Collections.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\PresentationFramework-SystemXml.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\PresentationFramework.AeroLite.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Configuration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\de\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\System.Configuration.ConfigurationManager.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\fr\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\ja\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\es\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\ja\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\de\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Security.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\clretwrc.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Runtime.Intrinsics.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Linq.Parallel.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\ko\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\pl\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.7\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\de\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\System.DirectoryServices.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\System.Diagnostics.EventLog.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.7\Microsoft.VisualBasic.Forms.dll	msiexec.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59b97c.msi	msiexec.exe
File created	C:\Windows\Installer\e59b982.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID9B4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59b982.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e59b977.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59b978.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7EC.tmp	msiexec.exe
File created	C:\Windows\Installer\e59b97d.msi	msiexec.exe
File created	C:\Windows\Installer\e59b981.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD0D.tmp	msiexec.exe
File created	C:\Windows\Installer\e59b978.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC338.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3D332594-2B70-4C75-8965-00D0F98838D7}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0EEC265D-6126-433C-B735-1A821A0C0A3E}	msiexec.exe
File created	C:\Windows\Installer\e59b973.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59b973.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID0D9.tmp	msiexec.exe
File created	C:\Windows\Installer\e59b986.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9B1FD351-30AA-4521-A8F4-7F92ECCD8372}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC8F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59b97d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8C93FD6A-9535-483D-91D1-0B47CD0C7517}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB1A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC92.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reWASD700-8447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnetcore-runtime-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-7.0.7-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnetcore-runtime-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AspNetCoreSharedFrameworkBundle-x86.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4900	aspnetcore-runtime-x86.exe
4756	aspnetcore-runtime-x86.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d6be30f9a4b6bc740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d6be30f90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d6be30f9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd6be30f9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6be30f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\153DF1B9AA0312548A4FF729CEDC3827	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\153DF1B9AA0312548A4FF729CEDC3827\ProductName = "Microsoft .NET Runtime - 7.0.7 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\153DF1B9AA0312548A4FF729CEDC3827\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.31.61636_x86	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\495233D307B257C49856000D9F88837D\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D562CEE06216C3347B53A128A1C0A0E3\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.31.61636_x86\DisplayName = "Microsoft .NET Host FX Resolver - 7.0.7 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1A4C256D3B05B5A76277774A3B92B9F0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D562CEE06216C3347B53A128A1C0A0E3\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\495233D307B257C49856000D9F88837D\PackageCode = "DEE22D833C0BDC24CA65E163453A188C"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\495233D307B257C49856000D9F88837D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.31.61636_x86	windowsdesktop-runtime-7.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.31.61651_x86\Version = "56.31.61651"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.31.61636_x86\DisplayName = "Microsoft .NET Runtime - 7.0.7 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6F2DDC0A5185C1B683FA9008FFC4CE11\153DF1B9AA0312548A4FF729CEDC3827	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\153DF1B9AA0312548A4FF729CEDC3827	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A6DF39C85359D384191DB074DCC05771	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x86\Dependents	windowsdesktop-runtime-7.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D562CEE06216C3347B53A128A1C0A0E3\PackageCode = "5DB8E238ABD136E4683066BDAD76DFBB"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\153DF1B9AA0312548A4FF729CEDC3827\PackageCode = "B74DAAE78FFE756408CC0194BC41D12B"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\153DF1B9AA0312548A4FF729CEDC3827\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\495233D307B257C49856000D9F88837D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A6DF39C85359D384191DB074DCC05771\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6DF39C85359D384191DB074DCC05771\PackageCode = "FC8FB4CC04A83124BB85E596F556F177"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6DF39C85359D384191DB074DCC05771\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6DF39C85359D384191DB074DCC05771\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D562CEE06216C3347B53A128A1C0A0E3\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6DF39C85359D384191DB074DCC05771\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.31.61651_x86\Dependents\{929eedf8-8704-4e0a-9b54-c9e6db21a6e4}	windowsdesktop-runtime-7.0.7-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{929eedf8-8704-4e0a-9b54-c9e6db21a6e4}\Version = "7.0.7.32525"	windowsdesktop-runtime-7.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.31.61636_x86\Dependents\{929eedf8-8704-4e0a-9b54-c9e6db21a6e4}	windowsdesktop-runtime-7.0.7-win-x86.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\495233D307B257C49856000D9F88837D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6DF39C85359D384191DB074DCC05771\ProductName = "Microsoft .NET Host - 7.0.7 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CB060CF1DBA5E1C781D70245BFC4FA32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6DF39C85359D384191DB074DCC05771\SourceList\PackageName = "dotnet-host-7.0.7-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.31.61636_x86\Version = "56.31.61636"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x86\DisplayName = "Microsoft .NET Host - 7.0.7 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\153DF1B9AA0312548A4FF729CEDC3827\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.31.61636_x86\Dependents	windowsdesktop-runtime-7.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\495233D307B257C49856000D9F88837D\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\495233D307B257C49856000D9F88837D\SourceList\PackageName = "dotnet-hostfxr-7.0.7-win-x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D562CEE06216C3347B53A128A1C0A0E3\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x86\Version = "56.31.61636"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\495233D307B257C49856000D9F88837D\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CB060CF1DBA5E1C781D70245BFC4FA32\A6DF39C85359D384191DB074DCC05771	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D562CEE06216C3347B53A128A1C0A0E3\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\495233D307B257C49856000D9F88837D\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.31.61636_x86\Dependents\{929eedf8-8704-4e0a-9b54-c9e6db21a6e4}	windowsdesktop-runtime-7.0.7-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_56.31.61651_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.31.61651_x86\ = "{0EEC265D-6126-433C-B735-1A821A0C0A3E}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D562CEE06216C3347B53A128A1C0A0E3\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\153DF1B9AA0312548A4FF729CEDC3827\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A6DF39C85359D384191DB074DCC05771\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6DF39C85359D384191DB074DCC05771\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8C93FD6A-9535-483D-91D1-0B47CD0C7517}v56.31.61636\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\495233D307B257C49856000D9F88837D\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{3D332594-2B70-4C75-8965-00D0F98838D7}v56.31.61636\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{929eedf8-8704-4e0a-9b54-c9e6db21a6e4}	windowsdesktop-runtime-7.0.7-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6DF39C85359D384191DB074DCC05771\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\153DF1B9AA0312548A4FF729CEDC3827\Version = "941617348"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\153DF1B9AA0312548A4FF729CEDC3827\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{9B1FD351-30AA-4521-A8F4-7F92ECCD8372}v56.31.61636\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\495233D307B257C49856000D9F88837D\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6DF39C85359D384191DB074DCC05771\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6DF39C85359D384191DB074DCC05771\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D562CEE06216C3347B53A128A1C0A0E3	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 199965.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 245602.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
1704	msedge.exe
1704	msedge.exe
2140	identity_helper.exe
2140	identity_helper.exe
448	msedge.exe
448	msedge.exe
2432	msedge.exe
2432	msedge.exe
2564	reWASD700-8447.exe
4380	msiexec.exe
4380	msiexec.exe
4380	msiexec.exe
4380	msiexec.exe
4380	msiexec.exe
4380	msiexec.exe
4380	msiexec.exe
4380	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	reWASD700-8447.exe
Token: SeShutdownPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeIncreaseQuotaPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeSecurityPrivilege	4380	msiexec.exe
Token: SeCreateTokenPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeLockMemoryPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeIncreaseQuotaPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeMachineAccountPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeTcbPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeSecurityPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeTakeOwnershipPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeLoadDriverPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeSystemProfilePrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeSystemtimePrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeProfSingleProcessPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeIncBasePriorityPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeCreatePagefilePrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeCreatePermanentPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeBackupPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeRestorePrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeShutdownPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeDebugPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeAuditPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeSystemEnvironmentPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeChangeNotifyPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeRemoteShutdownPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeUndockPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeSyncAgentPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeEnableDelegationPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeManageVolumePrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeImpersonatePrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeCreateGlobalPrivilege	828	windowsdesktop-runtime-7.0.7-win-x86.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe
Token: SeTakeOwnershipPrivilege	4380	msiexec.exe
Token: SeRestorePrivilege	4380	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3432	OpenWith.exe
2412	windowsdesktop-runtime-win-x86.exe
828	windowsdesktop-runtime-7.0.7-win-x86.exe
4900	aspnetcore-runtime-x86.exe
4756	aspnetcore-runtime-x86.exe
2212	AspNetCoreSharedFrameworkBundle-x86.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 4320	1704	msedge.exe	82
PID 1704 wrote to memory of 4320	1704	msedge.exe	82
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4076	1704	msedge.exe	83
PID 1704 wrote to memory of 4612	1704	msedge.exe	84
PID 1704 wrote to memory of 4612	1704	msedge.exe	84
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85
PID 1704 wrote to memory of 4208	1704	msedge.exe	85

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/EugeneSunrise/reWASD/releases
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3ab646f8,0x7ffd3ab64708,0x7ffd3ab64718
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2172 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2012,14974594507102451329,14242624336199152358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1496

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3432

C:\Users\Admin\Downloads\reWASD700-8447.exe
"C:\Users\Admin\Downloads\reWASD700-8447.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564
- C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\windowsdesktop-runtime-win-x86.exe
  "C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\windowsdesktop-runtime-win-x86.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1536
- - C:\Windows\Temp\{3E8C94F5-5663-4AF9-81E9-D7322A4945EE}\.cr\windowsdesktop-runtime-win-x86.exe
    "C:\Windows\Temp\{3E8C94F5-5663-4AF9-81E9-D7322A4945EE}\.cr\windowsdesktop-runtime-win-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\windowsdesktop-runtime-win-x86.exe" -burn.filehandle.attached=576 -burn.filehandle.self=568 /install /quiet /norestart
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2412
  - - C:\Windows\Temp\{EFCC24DF-CDC6-4117-A94A-B58B92B868CF}\.be\windowsdesktop-runtime-7.0.7-win-x86.exe
      "C:\Windows\Temp\{EFCC24DF-CDC6-4117-A94A-B58B92B868CF}\.be\windowsdesktop-runtime-7.0.7-win-x86.exe" -q -burn.elevated BurnPipe.{20C081EE-0637-46B1-B733-2030CF0A659E} {FD578EF3-324C-4CF7-A87D-EF32F03F176D} 2412
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:828
- C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe
  "C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4900
- - C:\Windows\Temp\{8890CED7-AA0D-40A4-AC05-0913A94058F6}\.cr\aspnetcore-runtime-x86.exe
    "C:\Windows\Temp\{8890CED7-AA0D-40A4-AC05-0913A94058F6}\.cr\aspnetcore-runtime-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe" -burn.filehandle.attached=568 -burn.filehandle.self=676 /install /quiet /norestart
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4756
  - - C:\Windows\Temp\{49BAC702-A36A-43E1-819F-2B4FB0F43304}\.be\AspNetCoreSharedFrameworkBundle-x86.exe
      "C:\Windows\Temp\{49BAC702-A36A-43E1-819F-2B4FB0F43304}\.be\AspNetCoreSharedFrameworkBundle-x86.exe" -q -burn.elevated BurnPipe.{8791C2AD-60AB-415A-8233-975048A531AD} {8A3DBA16-4A13-49A8-B097-641AFA9008C4} 4756
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2212

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E2675583DDB684ED75CFD553B39D3A71
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1132
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C1811570E1B38626E842B4F5C186E419
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5032
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E9616CB39364A74442BE6F633DFB8711
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4776
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5CC2D5EEE8B4621831DAE4B54D5BB51D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4196

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e59b976.rbs

Filesize
48KB

MD5
90609e1421d9aed9188fc33aa06d90ce

SHA1
b39c912a7ba45d6f5b67d3c54eab5121a1bec3d6

SHA256
9a347e89c8f01e65c31804a2113517d3ca35805d1137417ce561ddbfb8712ab2

SHA512
18fe19fce139d23d5b8c16e9e45d4620e9d324155e40cfd5c6280287bf4c82c2da066ada3d6da5dc9403ce9233bd7a8bcde6b84880b6b3ea6fc96e16b24d8578

Download Submit
C:\Config.Msi\e59b97b.rbs

Filesize
8KB

MD5
f2ea85561f4c68e9a9b47b61dce8cf48

SHA1
b8bc603c326ccad944e51d7e9dc230ad6ddeed15

SHA256
1731a365ddfe73537886e69bcc16e75a89ea6dd780075038b26ff9e5cdbf2f8f

SHA512
41e6ccebd406065cd3c27c3412a21753b0ac81a3285f1f7ba0214e2515adecb9ae56b89d0cec3a0b2f8429a02277cea8175a5bf7a3c9812df96f6491ee64fda9

Download Submit
C:\Config.Msi\e59b980.rbs

Filesize
9KB

MD5
c441717ecc8d172a5de750b2d1a60686

SHA1
3ef929e6770dfb70742bf4d953cfb48963d8135b

SHA256
6f1093acab21b6e910358629b7a26a75085d049fc5f16d7fcedd64ca478cff9a

SHA512
84d04f8bebf5133c27ce4216657ba1dd7396522c1a811994dca51fd09797f33a8603fa0361ad64fb095a5fa37937f1bffc3b43ae46dafdc57c66ec4a8af1cd96

Download Submit
C:\Config.Msi\e59b985.rbs

Filesize
89KB

MD5
d07665402c76431a2b56ed45df2761df

SHA1
f81ba166133453c34ffdd169ccae797741808491

SHA256
955fc82d520d75c6aa54d9e9772780866d8bec6a68b0c19d269e68a377828da4

SHA512
80a9496756a4a4c6d181bfc34135000d4ea6cd87b01a87db254f576c877bcb87c748c31dd5daabe608ab84852e4ea05515f7577bd6ba2276d60b98d70483e6ab

Download Submit
C:\Program Files (x86)\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt

Filesize
85KB

MD5
481ad608d2c3b3a5a0a3a529f2b2569e

SHA1
e271613b837d2cda290808af2bbd104a8c104a10

SHA256
29aec309fa6f036be931222385612088a3d98aa07ac2356243028a3072d0ce86

SHA512
93dde6782e14ac259b8655a89b31f7efe6990f27bc560f90200f3c967645d20fc54510e8fb0346732ea54707728a7075c9b566a936e76586c50681de65c83afb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6b69806543346fa93d01d5311799880a

SHA1
70b7f46b138eec39196fd9bbb697645288ffc2e4

SHA256
aba46a39fb9c1b73e72989454b1a85c4a0f84047aa18aa678808267e0bc53929

SHA512
5bf7e6363603b800e54b26400f310ff67d8e5e4fe83224f584a56d83313ade346ac0b6bb34f872424d69f055106388bba36ae136fd096091d68d4afe066a7c37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
1b92794633aaa7d8ca83e408ef516a36

SHA1
4ae0678d6cf8abedb3e9819fc9d7d715d3f72bb6

SHA256
0ff76dc871bd6e59abe386781ef988b4c8d734bca726a4d1eb556d3d78f1e7e0

SHA512
698bb4adf1932dd48fbffb344b0053b9dc753b97a92d88a26341e0c3b0fa2e03481c5193bd2b4a1caaa2aa2f00e41eae73c53aaadc1ac6bb8be17d0f229a61bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc8516a4f4df3178a34817aaad5ebd49

SHA1
ee611f0a52c8f29a84d99f6e5da78250487f0890

SHA256
19a6af7f15b7416e47959daccf4b2be821360c33f021513129e480a932c56130

SHA512
b9d34b38641cfba912cf16829432d9860c1931bebc0aadf6147aef169dd507df0d57a705b8b90df2205e4c2b591ee642493f3bdbd2dd20d1068b7692f0370bbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
096850bcdd6c1a7d7d47dc1ffd67b6f8

SHA1
08dd0be6cc17c601a3c243924eb98ce18797a181

SHA256
6e013e1a65d860020a0bce7792d08ddb8e65bd09c69fcc1cf6a232476ff295e4

SHA512
a7e1f7cc522a7a3a0adbc563328a3fd5c924e8d3c8d7548cb66d564f643a617f6e3af3abe710036afbb8ffee053b69f73138447ab6ae82daa8fdb028f8872007

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2116e07e3df14212c2f215dff416a5d0

SHA1
87009fe79bc983554c17aa71a37bdb031213f192

SHA256
f4eed374c9e9e86909f37059c8c3296b30907842a814aaa55d7b68290c8cfd4d

SHA512
f72f9c12421ada90566a370b5a8ab0470d6ae9878abe32b07c55c7a4d87c1d009ba383d208fcbf49d43aed95334fbba5a2d50915d0f44a0c5c8baac797475a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8a9d5c7ec7a1d78fd86601ddaf7e6c8

SHA1
c93bbaba12f69fe190c3a8762ca4d7a29f7397de

SHA256
da6f9fe047d024ea04936a534bff7e62e6c4cae6125b9ac2ce43627587dfe1f5

SHA512
381d31dea0e9e47d7cd8e10fb144d37e176c3d62d4aec3bc03c9bbf2f7ff3e6c9e9c63516328da7473a32d8e79418f62f3d50166d915f5fa5c46990cc82923c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7bb3bafac797894a4f0e6ef9ac99196b

SHA1
c68e2f49a7761d8414b2f1048a303898fc14eccc

SHA256
072d7152adca690940ee00fb05261d5c3bf994069782fda3a713d7031fdea01b

SHA512
8e06414cdc16441e027666a10c5c8b9f6c6f116c1b2e5787b4c4fd06a4bd0be7f03c9f5f5feb3b5a2b599090ed2a004a1e8531961692a98f29df70fdff6d5f42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
8d396382c3afc38965b326af2f673245

SHA1
c42ae040150d56ea41f652a67f3d6f72b7c4be14

SHA256
13bc8e0d4cf38d1a4453801537bc66446c9fc58c405b702ed427968e3f18ed2a

SHA512
ef5cc4c0e1359c38d725286e78815de28cc20b412bbe4cf918afd0706673f014805deaf21fe8a99fdcb2bb54046da81902da98b16782a2b360708cd6110f9bef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
1eab35073c81f7aac045af0ca9aa021a

SHA1
4af62a45ce7b3a567781f79068ecfe7f94642119

SHA256
7bc2eb25d91f5b59a50aab12a2a4d92ecf5c8a58a5f8e70d3439747cce5fbf02

SHA512
8f22d7e228ddf64b2672d2d49cb8700f63254380b07bcc70fe130f8bc704d21c91c9dafc0f3ac287985f8b71c16c1c046cdccb8c2af038b183c5be32f1e70c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58120c.TMP

Filesize
874B

MD5
e1833a866fe6cc78b7d1da2b0378cba2

SHA1
f20922392c8ab54f9da67a37b834580ff2f805b8

SHA256
98abbe111353972bb30d9f198f5bbf723349a2b543db3f75d82bddd1b2a3260b

SHA512
2e13ef6801b1ac6004f5ddf57039ad4dc4b97f960f77492d1a9f106f9c91b0fbebf858dfb09c0978a263c2eed5983e875b8facdb37a12edddc345747c59d2018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cfbee0e862c359e720559ab6e4c9b4e2

SHA1
4ccefba92091798e88f868a2ea5b9fd9f0ddd272

SHA256
fae9caa29780a0f76daf2d1a9e64dfdfdfe6957e698672c5e6cdf401472c126e

SHA512
36fd4caf5a8d5dfa3a5f0a6763cab43aa9a53b9336c539e038a745cd42a1668a406618c06bf4a8f362f805707cf72fd2aa4296cde80824b75bb3d575cecc0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1a2be9ce95f9bfe3b525b7a4d342726e

SHA1
46b5c6221b1f158477a793e8b81b0cd4596d563e

SHA256
a708a6ce3c698e3a398b7a8dd91adff385792890262b0080f4c2defafd63776f

SHA512
4448d61d8e5758ae5580ef7e1f5470d2206260535121fbf272dfe392cf9c1fdddc0ee524560ca61321820a9182a5b7779083e279aaa751af18fe5a0b84b6be00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9e7dc0f13c947e56dd20601964f1d90f

SHA1
1d3add1e13e1b3f0508f2d74ca93155efd9a1a9f

SHA256
e028e1480a6a67016c7d9cc6e5a28b4d7e683fd34f8b5b51cedd556bdf43b9fb

SHA512
eb5afaa1e69da97c45f09f865c28341e0b415d92567b31ea28347b0d6a3dfdf7d98f0b5feb62e50c3d473648ca8b384e6773eb07093b91e6bfe43104e555eea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
08edbd472ccd9377d4fa4b9dcb2e5aef

SHA1
1150550f1f9f7d9239828a7e532aea7e8d03651a

SHA256
3b1cef3cacac7c2d316f74bfde5f7e526f429c7998c7f0c9bd7987bf8039c9bf

SHA512
091aa4c0fa725b5dc82de0851954e994711659660d32811c46efc88b9984bd968bb24318302dbb1176ae8e309bcbb9eb40df179f00a73cb4f25af2b4bb6d9ee0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.7_(x86)_20240929165527_000_dotnet_runtime_7.0.7_win_x86.msi.log

Filesize
2KB

MD5
1cafb46e2ff239bd6bb8d6be324d5213

SHA1
a43238ef7016d81e6984c2d5d5c3db192042cf73

SHA256
6702c1e366fda1c20b4319144982612b62a880c9e86b113f7bc498a083cdee55

SHA512
6ef6e7ae2466541990c7f9a9587ddb83b15d374c5b37b0e4a1369a566d375ab9167fa18e598298202b6bcdd4d5a3dbca20f10d1cb55c69b57910fbc0da6b5212

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.7_(x86)_20240929165527_001_dotnet_hostfxr_7.0.7_win_x86.msi.log

Filesize
2KB

MD5
d65c215bbeec914ddc8e710435ccbc5d

SHA1
5d28a5f7ccd10b4b5a9320c251d54b99ddcd9849

SHA256
88de74a227de624c12a0e95ccdc371aaf35a2d7a70c3f4fa8aafb839eb7773d3

SHA512
74503afffefeb08cd6b4e2eb97397bfe6f651eeda888b5721ba4054163e0db67e8ea864e65ec07b3f1afa9d4b90988d360e5971df1f981ecc7615f8a131007fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\7z.dll

Filesize
155KB

MD5
ad71a5e3a757aef0329aeda567f25a00

SHA1
97c766d85c9dabfcabd5a983fe165506d227a8ac

SHA256
f6b9ae6eaaedc55db0e381ec153892c122f1f257ada80cf242a20be8a2f117ef

SHA512
6852496fb8f59bea3ae46efd507d654ae27306d9f4f2f0dc0db8b03f9f63a3712e075b12f0ebdf6ea88db081fca4dd29be1555584aa70386ccb8297beef886ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\CHS.dll

Filesize
83KB

MD5
bf591f4d366c6c27862373dfe1ed9c8a

SHA1
907037948f7708bbfda0d91725801ee80dfdafb0

SHA256
cdb1fcb52d718427246a79e810e59914386bddef399a7713405681fcb33ddb31

SHA512
f336edc46c231d5cd3ea9959fec3db42886e5fa7b066564ee0b996a4e7be62e832149ca9b59086e8f00219defbe150a94e0d32f018fb10cd4e2b2dbddce42177

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\CHT.dll

Filesize
84KB

MD5
178f9e57ca31a09c18a5983c9ddbc3a2

SHA1
0ed1366fdf7ad9a01cbf5eeb9239c7f805d77e73

SHA256
71e77957c236171222f7a5ddc1ae3381141ad617a17798737a0c0e5b5bb38d58

SHA512
4cb9623e60807789ea0f1fef773d8fa02e268aeefe90a14d4e8fe1e44be7f1742fb54226e68eff921783c6f4f09ab850ed0ebe202eac80b97d85aec63d188b7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\DEU.dll

Filesize
206KB

MD5
4cbd547904dbb9e6cca6931cf58c8c1e

SHA1
d166fb044063f34ffcca83a2f3b40fd29626b3f9

SHA256
24a8b7347a7ad2118bd7368e1f1fdec0148f5128f1c3741ff80b56b1c0ff3fe7

SHA512
e03e4454cfaf38a20a7c4e58a4fa951f49c1bba7871f565c9be57daca5032ea1aee6e2fe4679f8ace2f1b167bca0e625af774e49747dc860ac15630e712d4599

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\ENU.dll

Filesize
171KB

MD5
79654940dd2606fb404152697446ffa9

SHA1
f9091154bfca73b2ff9bf5905f943924797b24d4

SHA256
7a71e4067f7dba33f040a7d9697e57f5d40806a6bacc7256aff1175261f5181c

SHA512
ff81db1a5a7b017b21f73e23f75a3dd860a0dc637d10f7cf23fb6ee02d35594517a0e01b0393104e0ef65f69f3e736c0d0d4529646d2441d60263dd1ce589def

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\ESN.dll

Filesize
199KB

MD5
ba9dadbf5d2408b15c673c0db76dedb3

SHA1
acd61dc7aedc9131fda2046a1cecf455500f1ff4

SHA256
d4767ae746392c47750ff3270dae18563d38e0fbedf7d6ef0c875d094da91552

SHA512
0ff54173657df32080f50b08144d9eec42e31ac5e83020b3a760ab90773ddecb19a184c13b9ec9828bb2879070dd17cc9ba1f61358bcdda9bfa0ad8757b550ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\FRA.dll

Filesize
211KB

MD5
8853e74cd4c71f978465c7c3e25b5e2e

SHA1
4a00dba78fdda7bf5d8becb3de9622407eb371fe

SHA256
1b1ca005d084b495243c966416ec8f789e9f6f2b05dedc6272bd0b3de5aecafe

SHA512
2eb757ae7373d4e7c9d2b727cf122d1214f1ec41e87863023d1e067eb00b501fb6f4af324fc91273885e8c5a915dfb4348b3855668807f4b7242b824645bcb60

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\ITA.dll

Filesize
200KB

MD5
c063a9da8b077d1b702d44ea9b1a0bd4

SHA1
90654ad00a9f858e5fb6cab41b90395ec4880d5a

SHA256
afb2cf086a9f99b1457c7172f1d6c8ce83e84d83c622b9297679834804fdf780

SHA512
0ee90475bb435260dc158f55da0508e2da78515862e96d5455f5fea92c71770a51c4ac7a4525702f7aa53a32a0374989dd4c76c90e65f86a7a414a1e38dc4b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\JPN.dll

Filesize
108KB

MD5
3b0cf857ab3627ad188a230b5110b0c3

SHA1
4a306aa3bb6e1186368cb22bebf678d979f4a016

SHA256
4e944e0397c5bc17ef8ffba37b8f7af490929de33a1cb47534b4d8e6fc1e7d13

SHA512
9ad0f988efbf1b7c6191c8feabcc000bd9c6b4548eafc0e618ec3c5751df220640a1c2d27bb812e274da1b9638bf0b12245e8de9e6cfb33f4e87b65b5d7ec170

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\PLK.dll

Filesize
199KB

MD5
46d6dc8b3826219e8f171fa1c281cf7c

SHA1
d787a25f6dbb99020ed2d5528868081700cb7f91

SHA256
cd6e42db77254268e4bcc3dbf042e3199f94969ef6d39224fa4e8b2a2d74c75b

SHA512
4a4871d7f450dce6058f129c9e657db796b69619e7894fa658a0e3e232497aa58cc4a277e9e055e1dcbf65112aafab3464899248f1c202d6bc3343e873614d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\PTB.dll

Filesize
195KB

MD5
89e8cdc2eb2c1812d30255a6ae7c24a6

SHA1
af723c6c7ac58f9bb1c1c9013f0e0c288c60087e

SHA256
c5e221eda4de0828afca1fd685554ccf1493ec1d53daa143592e68a63cc4271f

SHA512
f53b8c1830482c26d7618332e7259771b17cfe01403a3a3cdbbce40aaf7e8f63b561cbc63b420a0f04c0a3c72f78276bb47c1a8f395099c951a33e263a37195f

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\RUS.dll

Filesize
188KB

MD5
5712264e6f283eae9ec5c992ccf41f57

SHA1
50795d52d10b880cbd579043987af34990cbc99a

SHA256
2dec23e2b4d1b74f3779005bb8192af6d4722ee9915d8ea67c3a04f3f9d414c2

SHA512
fa68fa14aff8ea380f1b4158a5849381a94f2166a8afbed4f129dfcf6c2b60d692d746f49a5bd124df807eb22da4025a8428017ca8fda84c3acaf0d479271c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\TRK.dll

Filesize
199KB

MD5
2824aea16a89b5d0bf337d5139b69e48

SHA1
2896784ebe3e0875464610b1ded6c6f2e96e7541

SHA256
f7c21b2e9a42a186537e6b5d26fe9a0e3dafacf6c79fb8049b683a56715ce3e9

SHA512
7746e8d3730655e5e28d9e86133932fd5f7ef27a24036c013594ec9197555ba4af2f1e16f4c8d23126dc69f350537c6b3753d21e0bbc715edbd1a426ab8dbbe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\UKR.dll

Filesize
187KB

MD5
c3137aaf5d6abfeb51ac2fcc9ad30cba

SHA1
9d9e72df01fa7dc7ad88798e9070f683b5dac27a

SHA256
82dc03d44d78f9520d389eab5c66c1fa4f12e747535872400743ca21b73975ae

SHA512
148f2109abff6e5d51068562ca2ae3977665b142154e4f2d28ea332eed5e0ee5f0f317d8310b395d0190baaeb5dd06c235f83fc671a3f55fd319e7da6ac4a3f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe

Filesize
8.4MB

MD5
4a8d40c412d7b8161cdd35c622baad35

SHA1
6dfea97a714dbbb5b4e874ea2f1bbb225813ccab

SHA256
c3acfa9a188629aa7c010c9fd195bccd2fcacfb526573517c24db85d86a9147b

SHA512
f6329de5bd21932df7c101dddcf70e54df6e4d4872e4b3712e5f7c9d77834d1455ca746ca27faf2e4c9287e782986d1e68a4bf83136d875b6d1941ad815382ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\setuphlp.dll

Filesize
950KB

MD5
5803f993b54809fe21dec0891b37cdfb

SHA1
8132b80e63fb336cb3d51d6d268d653f485a1742

SHA256
1c2e9ccf92ca043f9796682cc248707af17ef2e9cb4c013c344503852100c589

SHA512
26f185a5f8fd5c3e322b032f45f61aa6939f311156bf5f5c3a46ac456ef597206b35186f3c6a58f0fe0810e556fa60f995ce25646603608a720401971c5413fd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 199965.crdownload

Filesize
3.8MB

MD5
be8a27f3b8dfdcecf0f2e607aed18e50

SHA1
203c5e021927119a95cefe647116926bbaecc757

SHA256
2578e951c8e861908ec3941b491d10fb2e577736a71977ef4581f708d867ab26

SHA512
c7614b3db2600dd75f88e988b29dc6facb86ad5dc76079fd048fe3287aa6ee46ab767b66fb93195f9fc8c1c8ad337e17d47c6bfff741e78889bf87ee6be04ea9

Download Submit
C:\Windows\Installer\MSIC338.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Temp\{49BAC702-A36A-43E1-819F-2B4FB0F43304}\.ba\logo.png

Filesize
12KB

MD5
84709eb22e4b05688067699ca9b0d322

SHA1
7c3381d8b6a58087cda95577cc2d25e7aa2c21d8

SHA256
c8e23a42e04fbd73f5f66f3b9f2ba34a777bc4769c413a0f78335a4e757baad5

SHA512
04de70b7317ee1cbde73ac0fe84bd70983cf0ff7e769e5f9626c69eaa6e3e9724c95b14ccb7a5478ee639848d3f8c98e4dec599cc5e33ad71de638da589ba319

Download Submit
C:\Windows\Temp\{49BAC702-A36A-43E1-819F-2B4FB0F43304}\.be\AspNetCoreSharedFrameworkBundle-x86.exe

Filesize
593KB

MD5
163958505f5ea6a0e4c08586be1f2778

SHA1
7e951cd03bed70a4a952b015a80a8e6534e662a8

SHA256
f91b7241f7a5b0af1c678f2e84d1b49102ca253cd92342bcf1498f3ab9c15d8a

SHA512
77a1a1692c1d932c6a3cdc9a4b581305e289b0e30b1a229a65e9d7fd1af176229fdda9568820cc1d446249ed0cfc19ef5edea1c6cb361d89e2d191edea39f151

Download Submit
C:\Windows\Temp\{EFCC24DF-CDC6-4117-A94A-B58B92B868CF}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{EFCC24DF-CDC6-4117-A94A-B58B92B868CF}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{EFCC24DF-CDC6-4117-A94A-B58B92B868CF}\.be\windowsdesktop-runtime-7.0.7-win-x86.exe

Filesize
610KB

MD5
7bbf95e859da4320da41fc39673879a0

SHA1
4beb7e7050bcdadfb3e4a7c4e92beec2eaac383c

SHA256
d5b6c70de5df3c8a7dbbde438eec5462fcc6736d473f92987e5ac13176ce53f4

SHA512
2c0ca6180a120dca9c80e78166c1894ce3dd534b70c162930f2aa5aa8c4590865fba64d8facf90ba6bd657307ef43fedf708ae228a6d28091c950c8ed1c5c1e8

Download Submit
C:\Windows\Temp\{EFCC24DF-CDC6-4117-A94A-B58B92B868CF}\dotnet_host_7.0.7_win_x86.msi

Filesize
732KB

MD5
f890bc733af4e963aac06aaa9565c8ec

SHA1
9f09ac43d2cb60caf46e98fab7d7f7ca0e1b708f

SHA256
afc9157c95c63bff28b861c56a9722156f5a5d84dbcd380c943d5b02bce50af4

SHA512
326a4b9a169e1c2b4e683bd1bd770af322c124a308466b7846303666b90d7370f6606ba01acb778fa18052f2fc86b43cc7b6331951ad2df6d5a6432a992a0c6c

Download Submit
C:\Windows\Temp\{EFCC24DF-CDC6-4117-A94A-B58B92B868CF}\dotnet_hostfxr_7.0.7_win_x86.msi

Filesize
784KB

MD5
c4b0d690a7c5d66348ffde405179cb80

SHA1
44afb2a4422b43cb8375fc3a9071559d50a0a66a

SHA256
8cb99ba98afe7dec68c3d5844d372865339b1e5adf31fa871b900e421275dca4

SHA512
e5198c1c581d3880996730f9ef29dda6de697b82dd128902145feb3cb85149d6b248db235035b7f1a3f5f14573f6f50d9650cddc54f210110eb3eb41feaf3d14

Download Submit
C:\Windows\Temp\{EFCC24DF-CDC6-4117-A94A-B58B92B868CF}\dotnet_runtime_7.0.7_win_x86.msi

Filesize
23.7MB

MD5
e13a6eb8ba62b0ccfe16eaad7adf644f

SHA1
579b2d742f159f0d01adda0eb0bc7f6d035eb5a5

SHA256
ea212d6e20a0c505ce46c99a2c094a30c146594edaea439b9eec29f11e34335e

SHA512
8ccf323ff8c56548a4aec29ac2dd8b033a9a1e1aa0a2b51256f7cb91c24c0beba8619b5c017c621eba92d9b9ab7a94c600ae57dcefa930a7462e4f3d463854d0

Download Submit
C:\Windows\Temp\{EFCC24DF-CDC6-4117-A94A-B58B92B868CF}\windowsdesktop_runtime_7.0.7_win_x86.msi

Filesize
26.3MB

MD5
1811a2d2571ad0a2db574f58c65480c2

SHA1
62b6214395f62f6dfd2b829cf0b09fc2101273c9

SHA256
35787607fe59786f12365a0ae77499b7f0983d06835ebb62d8002d67aed3af00

SHA512
db6ded019b825eb9c03dca8ba6958a0f9d5fa15ace82fc228fbb33f72144cb73e9bc7fb573dc09f23e0eb4eb6255d749890a073587fb6c2b4f061cea77d1f3cb

Download Submit
memory/2564-518-0x00000000094F0000-0x00000000094F8000-memory.dmp

Filesize
32KB

Download
memory/2564-520-0x0000000008DD0000-0x0000000008DDE000-memory.dmp

Filesize
56KB

Download
memory/2564-519-0x0000000009010000-0x0000000009048000-memory.dmp

Filesize
224KB

Download
memory/2564-517-0x00000000093D0000-0x0000000009410000-memory.dmp

Filesize
256KB

Download
memory/2564-433-0x000000006E4D0000-0x000000006E5C0000-memory.dmp

Filesize
960KB

Download
memory/2564-414-0x0000000008990000-0x00000000089AE000-memory.dmp

Filesize
120KB

Download
memory/2564-413-0x0000000008910000-0x0000000008986000-memory.dmp

Filesize
472KB

Download
memory/2564-407-0x0000000008450000-0x000000000845A000-memory.dmp

Filesize
40KB

Download
memory/2564-406-0x0000000008470000-0x0000000008482000-memory.dmp

Filesize
72KB

Download
memory/2564-405-0x00000000006E0000-0x0000000003976000-memory.dmp

Filesize
50.6MB

Download
memory/2564-521-0x000000000BDF0000-0x000000000BE82000-memory.dmp

Filesize
584KB

Download