hxxps://www[.]nexuscorestudios[.]com/

Analysis

max time kernel
229s
max time network
228s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
29/12/2024, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.nexuscorestudios.com/

Score

7^/10

paypal discovery persistence phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 6 IoCs

pid	Process
1608	vc_redist.x86.exe
1848	vc_redist.x86.exe
996	VC_redist.x86.exe
4824	windowsdesktop-runtime-8.0.11-win-x64.exe
2328	windowsdesktop-runtime-8.0.11-win-x64.exe
4572	windowsdesktop-runtime-8.0.11-win-x64.exe

Loads dropped DLL 23 IoCs

pid	Process
1848	vc_redist.x86.exe
1692	VC_redist.x86.exe
2328	windowsdesktop-runtime-8.0.11-win-x64.exe
1388	MsiExec.exe
1388	MsiExec.exe
1964	MsiExec.exe
1964	MsiExec.exe
2376	MsiExec.exe
2376	MsiExec.exe
2376	MsiExec.exe
2376	MsiExec.exe
4344	MsiExec.exe
4344	MsiExec.exe
3716	windowsdesktop-runtime-8.0.2-win-x64.exe
2916	MsiExec.exe
2916	MsiExec.exe
2816	MsiExec.exe
2816	MsiExec.exe
1840	MsiExec.exe
1840	MsiExec.exe
4244	Setup.exe
4244	Setup.exe
4244	Setup.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{e7802eac-3305-4da0-9378-e55d1ed05518} = "\"C:\\ProgramData\\Package Cache\\{e7802eac-3305-4da0-9378-e55d1ed05518}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{bd40e761-3e88-4202-9b53-26c6bed3d467} = "\"C:\\ProgramData\\Package Cache\\{bd40e761-3e88-4202-9b53-26c6bed3d467}\\windowsdesktop-runtime-8.0.11-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-8.0.11-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Detected potential entity reuse from brand PAYPAL.
phishing paypal

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\zh-Hans\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\pl\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\vcruntime140_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\ko\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Net.WebClient.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\it\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\System.Windows.Presentation.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\zh-Hant\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\ko\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\zh-Hant\UIAutomationClient.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Threading.Tasks.Dataflow.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\DirectWriteForwarder.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\es\ReachFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\System.DirectoryServices.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\ru\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\WindowsBase.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\es\UIAutomationClient.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Resources.Writer.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Net.Quic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Diagnostics.Tracing.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\WindowsBase.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\ja\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\PenImc_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\PresentationCore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\tr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\PresentationFramework.Classic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIC4A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID940.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDA0E.tmp	msiexec.exe
File created	C:\Windows\Installer\e5867db.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDDC9.tmp	msiexec.exe
File created	C:\Windows\Installer\e5867df.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1557FAC875C803DF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI15FA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6ABD.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{84E3E712-6343-484B-8B6C-9F145F019A70}	msiexec.exe
File created	C:\Windows\Installer\e5867ca.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD3A072D759575E77.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID970.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE0A8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23B6.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7BF3A00FAD7E980B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID350.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F59C11F0-D73F-452B-8D1D-8C33B82D8507}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{362B4D0D-8438-44DA-86B2-FEC44E000FCA}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF34D3524D701176F0.TMP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\63337BB296F4141479799EDBF63E89A0\CacheSize.txt	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C0790AA0-0F40-4836-85B2-677B87625E63}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI68D7.tmp	msiexec.exe
File created	C:\Windows\Installer\e5867b0.msi	msiexec.exe
File created	C:\Windows\Installer\e5867c6.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8870A0BA14F59BDD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB48.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4E422560174C1AB3.TMP	msiexec.exe
File created	C:\Windows\Installer\e5867d0.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE1BA222736075846.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID40C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB37.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9C0B32E61A55157E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF19135BF7E973457B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5867b0.msi	msiexec.exe
File created	C:\Windows\Installer\e5867c5.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6CF7ADACD021E669.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD69C89A55DA533AE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF09AE1D02EDFAFE4C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBD4554B56B04BC23.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9C80213E-9079-4561-8D57-1FDD0D62251F}	msiexec.exe
File created	C:\Windows\Installer\e5867cb.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF00B3A76A444FADB3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID1B9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF48ACCA3BD9C374FA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID69F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5867db.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF20A2ECA470678AFD.TMP	msiexec.exe
File created	C:\Windows\Installer\e5867af.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5754FB109A4EA7E2.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF965F7A25DF598718.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6A32047F11F93329.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF78D.tmp	msiexec.exe
File created	C:\Windows\Installer\e58679e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58679e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAC8890659402A560.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI11C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\63337BB296F4141479799EDBF63E89A0\64.8.8795	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\63337BB296F4141479799EDBF63E89A0\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1378.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6955.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5867cb.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.2-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.2-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.2-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fc80c284bade0450000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800002fc80c280000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809002fc80c28000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d2fc80c28000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002fc80c2800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F5968DD9DAA5B3567CFF6E791844C78F	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\Version = "237667969"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.44.23191_x64	windowsdesktop-runtime-8.0.11-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\WINDOWSDESKTOP_RUNTIME_64.8.8806_X64\DEPENDENTS\{63880B41-04FC-4F9B-92C4-4455C255EB8C}	windowsdesktop-runtime-8.0.2-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.8.8795_x64\Dependents	windowsdesktop-runtime-8.0.2-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.42.34433"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0F11C95FF37DB254D8D1C8338BD25870\MainFeature	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA0970C04F06384582B76B77826E536\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.44.23253_x64\Version = "64.44.23253"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E31208C997091654D875F1DDD02652F1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0F11C95FF37DB254D8D1C8338BD25870	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64\Version = "64.44.23191"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA0970C04F06384582B76B77826E536\SourceList\PackageName = "windowsdesktop-runtime-8.0.11-win-x64.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{bd40e761-3e88-4202-9b53-26c6bed3d467}\ = "{bd40e761-3e88-4202-9b53-26c6bed3d467}"	windowsdesktop-runtime-8.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6F05B006EF15FED56A7079F7AB6FD21F\0AA0970C04F06384582B76B77826E536	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA0970C04F06384582B76B77826E536\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{bd40e761-3e88-4202-9b53-26c6bed3d467}\Version = "8.0.11.34221"	windowsdesktop-runtime-8.0.11-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64\ = "{362B4D0D-8438-44DA-86B2-FEC44E000FCA}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E31208C997091654D875F1DDD02652F1\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.42.34433"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\217E3E483436B484B8C6F941F510A907\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{bd40e761-3e88-4202-9b53-26c6bed3d467}\Dependents	windowsdesktop-runtime-8.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0F11C95FF37DB254D8D1C8338BD25870\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{F59C11F0-D73F-452B-8D1D-8C33B82D8507}v64.44.23191\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0D4B2638348AD44682BEF4CE400F0AC\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D881F2EC0135A4B72CA89D27FD72F577\D0D4B2638348AD44682BEF4CE400F0AC	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63337BB296F4141479799EDBF63E89A0	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA0970C04F06384582B76B77826E536\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\217E3E483436B484B8C6F941F510A907\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E31208C997091654D875F1DDD02652F1\ProductName = "Microsoft .NET Runtime - 8.0.11 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0F11C95FF37DB254D8D1C8338BD25870\SourceList\PackageName = "dotnet-hostfxr-8.0.11-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6F05B006EF15FED56A7079F7AB6FD21F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.8.8806_x64\Dependents	windowsdesktop-runtime-8.0.2-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{C2BB95AA-90F3-4891-81C1-A7E565BB836C}v14.42.34433\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E31208C997091654D875F1DDD02652F1\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0AA0970C04F06384582B76B77826E536\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA0970C04F06384582B76B77826E536\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\70BF2CCB0FC824541BC016CBFE40FA2F\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E31208C997091654D875F1DDD02652F1\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0F11C95FF37DB254D8D1C8338BD25870\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.8.8806_x64	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\70BF2CCB0FC824541BC016CBFE40FA2F\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\70BF2CCB0FC824541BC016CBFE40FA2F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18237B7CA0BADAD40AF9C5034D6097CA\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.42,bundle\Dependents\{e7802eac-3305-4da0-9378-e55d1ed05518}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64\Dependents\{bd40e761-3e88-4202-9b53-26c6bed3d467}	windowsdesktop-runtime-8.0.11-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.8.8795_x64\Dependents	windowsdesktop-runtime-8.0.2-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0F11C95FF37DB254D8D1C8338BD25870	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA0970C04F06384582B76B77826E536\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AA59BB2C3F091984181C7A5E56BB38C6\Servicing_Key	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\679E80FBE29B63345BF612177149674C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0D4B2638348AD44682BEF4CE400F0AC\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E31208C997091654D875F1DDD02652F1\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E31208C997091654D875F1DDD02652F1\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0F11C95FF37DB254D8D1C8338BD25870\PackageCode = "36269CBE4B55ECB49B8C4B062AF0B04E"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.8.8795_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E31208C997091654D875F1DDD02652F1\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{9C80213E-9079-4561-8D57-1FDD0D62251F}v64.44.23191\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0F11C95FF37DB254D8D1C8338BD25870\DeploymentFlags = "3"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Enforcer.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
3920	msedge.exe
3920	msedge.exe
3036	identity_helper.exe
3036	identity_helper.exe
4244	msedge.exe
4244	msedge.exe
228	msiexec.exe
228	msiexec.exe
228	msiexec.exe
228	msiexec.exe
228	msiexec.exe
228	msiexec.exe
228	msiexec.exe
228	msiexec.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
228	msiexec.exe
228	msiexec.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
228	msiexec.exe
228	msiexec.exe
228	msiexec.exe
228	msiexec.exe
4728	taskmgr.exe
228	msiexec.exe
228	msiexec.exe
4728	taskmgr.exe
4728	taskmgr.exe
228	msiexec.exe
228	msiexec.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
228	msiexec.exe
228	msiexec.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4728	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4244	Setup.exe
Token: SeBackupPrivilege	1132	vssvc.exe
Token: SeRestorePrivilege	1132	vssvc.exe
Token: SeAuditPrivilege	1132	vssvc.exe
Token: SeShutdownPrivilege	996	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	996	VC_redist.x86.exe
Token: SeSecurityPrivilege	228	msiexec.exe
Token: SeCreateTokenPrivilege	996	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	996	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	996	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	996	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	996	VC_redist.x86.exe
Token: SeTcbPrivilege	996	VC_redist.x86.exe
Token: SeSecurityPrivilege	996	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	996	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	996	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	996	VC_redist.x86.exe
Token: SeSystemtimePrivilege	996	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	996	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	996	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	996	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	996	VC_redist.x86.exe
Token: SeBackupPrivilege	996	VC_redist.x86.exe
Token: SeRestorePrivilege	996	VC_redist.x86.exe
Token: SeShutdownPrivilege	996	VC_redist.x86.exe
Token: SeDebugPrivilege	996	VC_redist.x86.exe
Token: SeAuditPrivilege	996	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	996	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	996	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	996	VC_redist.x86.exe
Token: SeUndockPrivilege	996	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	996	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	996	VC_redist.x86.exe
Token: SeManageVolumePrivilege	996	VC_redist.x86.exe
Token: SeImpersonatePrivilege	996	VC_redist.x86.exe
Token: SeCreateGlobalPrivilege	996	VC_redist.x86.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe
4728	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 2708	4160	msedge.exe	79
PID 4160 wrote to memory of 2708	4160	msedge.exe	79
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3220	4160	msedge.exe	80
PID 4160 wrote to memory of 3272	4160	msedge.exe	81
PID 4160 wrote to memory of 3272	4160	msedge.exe	81
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82
PID 4160 wrote to memory of 2192	4160	msedge.exe	82

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.nexuscorestudios.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff963ff3cb8,0x7ff963ff3cc8,0x7ff963ff3cd8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1752,16584802181864959068,3528150951474926285,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1752,16584802181864959068,3528150951474926285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1752,16584802181864959068,3528150951474926285,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1752,16584802181864959068,3528150951474926285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1752,16584802181864959068,3528150951474926285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1752,16584802181864959068,3528150951474926285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1752,16584802181864959068,3528150951474926285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1752,16584802181864959068,3528150951474926285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1752,16584802181864959068,3528150951474926285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1752,16584802181864959068,3528150951474926285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1752,16584802181864959068,3528150951474926285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1752,16584802181864959068,3528150951474926285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1752,16584802181864959068,3528150951474926285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1636

C:\Users\Admin\Downloads\Enforcer\Setup.exe
"C:\Users\Admin\Downloads\Enforcer\Setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4244
- C:\Users\Admin\Downloads\Enforcer\vc_redist.x86.exe
  "C:\Users\Admin\Downloads\Enforcer\vc_redist.x86.exe" /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1608
- - C:\Windows\Temp\{E26B6A6B-1B9C-4976-AA42-F2931B02D9ED}\.cr\vc_redist.x86.exe
    "C:\Windows\Temp\{E26B6A6B-1B9C-4976-AA42-F2931B02D9ED}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\Enforcer\vc_redist.x86.exe" -burn.filehandle.attached=768 -burn.filehandle.self=612 /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1848
  - - C:\Windows\Temp\{152FE0D1-0ECB-4411-B350-97E73A86688C}\.be\VC_redist.x86.exe
      "C:\Windows\Temp\{152FE0D1-0ECB-4411-B350-97E73A86688C}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{24808CBE-823D-40F7-B22B-9CDDC980DCDC} {A25530A6-8E62-42AF-8DA2-F5CC29CA035D} 1848
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:996
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={e7802eac-3305-4da0-9378-e55d1ed05518} -burn.filehandle.self=1004 -burn.embedded BurnPipe.{2EE1D3CA-07D0-4EBD-AF3D-E4D8ECCBE77E} {807FB0FD-B70B-4C5B-9BD5-3D9B0DBE8BDB} 996
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1216
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=572 -burn.filehandle.self=588 -uninstall -quiet -burn.related.upgrade -burn.ancestors={e7802eac-3305-4da0-9378-e55d1ed05518} -burn.filehandle.self=1004 -burn.embedded BurnPipe.{2EE1D3CA-07D0-4EBD-AF3D-E4D8ECCBE77E} {807FB0FD-B70B-4C5B-9BD5-3D9B0DBE8BDB} 996
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1692
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{131F83C5-9299-4FE6-BCCF-59505C04CE75} {B4F2E5CE-6693-4223-90F7-5E986E9D4D60} 1692
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:836
- C:\Users\Admin\Downloads\Enforcer\windowsdesktop-runtime-8.0.11-win-x64.exe
  "windowsdesktop-runtime-8.0.11-win-x64.exe" /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4824
- - C:\Windows\Temp\{4D48D0D8-DFC0-443D-A556-C3B1625DAEDE}\.cr\windowsdesktop-runtime-8.0.11-win-x64.exe
    "C:\Windows\Temp\{4D48D0D8-DFC0-443D-A556-C3B1625DAEDE}\.cr\windowsdesktop-runtime-8.0.11-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\Enforcer\windowsdesktop-runtime-8.0.11-win-x64.exe" -burn.filehandle.attached=612 -burn.filehandle.self=764 /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2328
  - - C:\Windows\Temp\{FE5196AF-5B46-4864-B8C4-7A42019706C1}\.be\windowsdesktop-runtime-8.0.11-win-x64.exe
      "C:\Windows\Temp\{FE5196AF-5B46-4864-B8C4-7A42019706C1}\.be\windowsdesktop-runtime-8.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{73281D52-2EBD-495D-9EE0-6FA35358B1E7} {23D0AD8E-1866-45DC-84C0-520086CF8371} 2328
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4572
    - - C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
        
        "C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={bd40e761-3e88-4202-9b53-26c6bed3d467} -burn.filehandle.self=1124 -burn.embedded BurnPipe.{8ABBF820-1D96-4F3A-AEE7-CB512BEB287C} {CF6D5AB4-EA91-43BA-9BFB-8CECF127AC14} 4572
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
      - C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
        
        "C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=588 -uninstall -quiet -burn.related.upgrade -burn.ancestors={bd40e761-3e88-4202-9b53-26c6bed3d467} -burn.filehandle.self=1124 -burn.embedded BurnPipe.{8ABBF820-1D96-4F3A-AEE7-CB512BEB287C} {CF6D5AB4-EA91-43BA-9BFB-8CECF127AC14} 4572
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3716
        
        C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
        
        "C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -q -burn.elevated BurnPipe.{19980FB3-54E8-4484-BC81-DDD75B7FAB9A} {1C33E1E2-F5B5-4D1E-B18B-4659D86090FF} 3716
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nexuscorestudios.com/store
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff963ff3cb8,0x7ff963ff3cc8,0x7ff963ff3cd8
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,1044524756574767118,2866530195716411644,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,1044524756574767118,2866530195716411644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,1044524756574767118,2866530195716411644,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,1044524756574767118,2866530195716411644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,1044524756574767118,2866530195716411644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,1044524756574767118,2866530195716411644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
    3⤵
    PID:1268
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,1044524756574767118,2866530195716411644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,1044524756574767118,2866530195716411644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,1044524756574767118,2866530195716411644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,1044524756574767118,2866530195716411644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:1128

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2264

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:228
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D0C21298170E75A73F170F398BFD2769
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1388
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3B2AD35A3230F657C8EAD2F7DAEF4A84
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1964
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A879E517EB2B348B10E8E9C865430B26
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2376
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AE0AD8F73E1D175A1FC8D434D62B7996
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4344
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DFB81A4749DB58E5CF9188EA1B5484CF
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E8A0F81C32CCC6322A7867A67A16CDD8
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2816
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EC7BD699A034A0A159902C04113A2E04
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1840

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5867a3.rbs

Filesize
16KB

MD5
f7d573b81d017839bcbd477b256d38ba

SHA1
600a476062c2d9df55a9e0bcd4872f6b607a57e4

SHA256
c2421b5693ceabfddde6d6bd6a4e1c9438bbef7d0bd661715d8f932bbf483522

SHA512
a629dd67f34763dbf839a84803961cd7a6a46ba7524f45334b22472321d4286ac6a6731568d5632ddc13c266c432263bc75ad2e00173977a73a248e581dcc880

Download Submit
C:\Config.Msi\e5867a8.rbs

Filesize
18KB

MD5
541742a3f22ec4323fbf60727eaf8ac5

SHA1
1a30f5029927e81a7b8c74f0e700003c6a20b8a4

SHA256
fda60809f3e137eb8a3b9c8fe2cb27981fc23816ec5fbbfdc8619164edbad68f

SHA512
d982ec596b073b2cb67a4903bd1c73e885b9e3ec8cddeb43021562df40a808fc7787f1b1d93a34da9e8f20709db2c5dce45143720ab9257c90f7c761eba2091b

Download Submit
C:\Config.Msi\e5867b5.rbs

Filesize
20KB

MD5
fdcd3d28fe67a6850c54f5bf5f4615bc

SHA1
12dbf46eb496b0f6ad076f6818bd66fd0e99de9b

SHA256
950cf353368ff4d3716adfe0fe98b7607c5ca5e44d342377a61f4c7c25e0e315

SHA512
38056f3d4eeaec7acd7b35441f64823a2ca6956984a942cfa0ebeb30c5656366280037d8efbdd2a8decd6db4a830089a60056a5fbc2e5ab8f476b34e0b575ef9

Download Submit
C:\Config.Msi\e5867c4.rbs

Filesize
19KB

MD5
d77a8bf41ea891ae69da0145db1a4734

SHA1
719e1d27171f3ea6bc417058b69e5776a34d4b06

SHA256
e3c17c8a95b5624298801351bbabea8902b5fc2b38fbdb495f07f624d267cab1

SHA512
d0f1526fcfadcbdd41a3563548500c4436106aa1434d5e5e19ccd4f884a89310b24ea4f9dc5cb74894985b61bd799db9a3828475d90ca4227cb3ef01edc2f5ea

Download Submit
C:\Config.Msi\e5867c9.rbs

Filesize
48KB

MD5
43549bb676e26ab0f86c28f3cb2eee2b

SHA1
68583e0e5c8f19652ebacd8e25614e49bbc2f585

SHA256
812044b2776e41f49edbc78bf4e34b1b9adb6d428725beac08977497fc6dc1e5

SHA512
ba686003bcbb16378c5a3f128e40cf1470e50e9cff524f70d62613d77d722fde7493c1513ecffbeeea03ee5030633394c447eef57ea069afb3f5d4c4a11e6edc

Download Submit
C:\Config.Msi\e5867ce.rbs

Filesize
9KB

MD5
8aa9fbad979585644beed21832a76152

SHA1
33aecd3b09b8f1fb02641349b442ff100b4f430f

SHA256
18e8195c47bd18eee75ad6546e5ddc2d3beacb77bb22a14b512306ef2f52b2d5

SHA512
f419d06122b6988404bccb9a6659615dd4d00a4d875e20e2ee45f4c2e2c03ad7e9c1380ab8231a2ee75156fea81f8058eb0a42a4d06e17edce4741a359ff06a1

Download Submit
C:\Config.Msi\e5867d3.rbs

Filesize
11KB

MD5
fab5d7026a63bed6c611e51a85672044

SHA1
1564bf17d81da8e838f7274532d384f4e027b647

SHA256
07640d0ca0f9891402c19ae3456d5d122d81c723813f04ad55c5b4b59c2f0b26

SHA512
a1fa35e9d08a10e1d5c822a545727ddb03a0c174efb9292171926a8db686172bc80a11f8dcbbabac3afbaa0c0a20ce07b242180fb98b35f4d66cfa2962b93cca

Download Submit
C:\Config.Msi\e5867d8.rbs

Filesize
8KB

MD5
c5665bf152aae567247f50f55da72627

SHA1
74303562746ee52731fc6af319d98a6b3ef83070

SHA256
9c855fdc4832d520bdab918d34dd23dc2adabe0966340e10cbc3a71d4786ec81

SHA512
852538b7a66de48636fce7b692a2a292b42293c577da8070790fac57320235ea78acf74dfb7b532b9e4c0a397cb87e7e89a26513d93b538db6960daa46a1e718

Download Submit
C:\Config.Msi\e5867d9.rbf

Filesize
143KB

MD5
33b4c87f18b4c49114d7a8980241657a

SHA1
254c67b915e45ad8584434a4af5e06ca730baa3b

SHA256
587296f3ff624295079471e529104385e5c30ddc46462096d343c76515e1d662

SHA512
42b48b4dcd76a8b2200cfafddc064c053a9d1a4b91b81dee9153322c0b2269e4d75f340c1bf7e7750351fb656445efaf1e1fe0f7e543497b247dd3f83f0c86f9

Download Submit
C:\Config.Msi\e5867da.rbf

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Config.Msi\e5867de.rbs

Filesize
87KB

MD5
e187196a872a6efe0399aed2f5386a0b

SHA1
f71fcbff9088d7a4540d178d26cb0af61a1383ec

SHA256
6044f3ce18b17657b11b9213da7aa12096baf99a3f81f44482b38d59c40ccba1

SHA512
b53af3795e9370905ed36a0041d778d389344264e24750c047ecba91ed2332faa09f7c9514c7299061563dd29a8fe1336829cdd4f6ebcb8e06db90cea5b78333

Download Submit
C:\Config.Msi\e5867e2.rbs

Filesize
131KB

MD5
7c3f3c889e35d8fecc40301468df0a44

SHA1
dbc8be6111f69616a2d7019518e9b098b3246acc

SHA256
03a2de17e1ddf215bcf5dbae4f7d787a1aff2f12966a2d1e0a4054587f13a1fc

SHA512
91810bfb3b76111c1adff1f7d9120a111bba63f70a1a7242cf638fc48452ee440a49546b0b91dc753c2c58a1181c664f7be7475fd5e817cf246bef5a8c670180

Download Submit
C:\Config.Msi\e5868ff.rbs

Filesize
8KB

MD5
31ccf726d9d176a06ecf499482e925c5

SHA1
5ff0bac9e1a82b487822ca59e1bb030d188ae49f

SHA256
15c973580282ad22f63d87bf9f0fa47cf396bc1956063fbdd47d18dd665829d1

SHA512
3582f7d280054f66ddfdabe961f0f557d5773495698321146fbf06d9d4a7b7d1e3e82c121d57097e6c32602505716a6c6579bcbc3e9acf8c2a7ea893dc0abcf0

Download Submit
C:\Config.Msi\e586903.rbs

Filesize
85KB

MD5
63fcf45a53c44897cb5fa41ae2378197

SHA1
29f2d42ca3342c1273fe476e786b7568be3e2554

SHA256
11c021ea391e02355df865ed7102e84760770b7959c61ac45716adb045c5f36d

SHA512
86ff996ee226df9bb661b40457a048aff961a6032789330d4553c33219a79c899e656a213ee45c0edf7e7a8b2ef8006740919c938db26f3483c8502cb2671993

Download Submit
C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\state.rsm

Filesize
924B

MD5
ea86a3e285ae263335ec8b5b3bb2f993

SHA1
78f123c60649614ec61711bc2bc3e76be7b2c079

SHA256
f322e918fb33c78bb63aee4c2e354d47eebf4410c4230bdcc2818129046de68f

SHA512
132c21ecda6f2e86e8900a84e74b722a2260dd4495c0328decca10304946d1583f4db295605781878660509adb8b4ed8d1b8ffaf985cb579120eeafc8e6b1210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6b21d865-27ae-4db4-a4ba-3b0b4c0e8fc0.tmp

Filesize
10KB

MD5
60cc7013a42fec6bd179eae6862253c8

SHA1
5cc45ffac8e607394c107d384f68d84ecc5f30f1

SHA256
03917c1286ec51f92a58406558555b6bb04885b934be641b65340370e6d92f9c

SHA512
c6a3dc911df517c188c27c3757ebe6885f8cc464e6d009079529f39810e64126b11380b9236dc9de8fe6fa31cc90ba0a37d6db5d6277438d94e8a2e3d3811ff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
73492862e89bb0bf85e735dcf9863e62

SHA1
73231a1730424154c8fee57f319e66b9c7330e51

SHA256
dc4201b17ffd2b989761722cc015e132e9aa65ed87870eaa075e44c88387fb39

SHA512
63a14c62c2f3318d73b7abb4cd305c1a828d4391b7ee6f130a162ef9216ef6640a35e2e84a59154bf693f62f6219b3af8e89bbcf5cbf78947ead512ab2d441e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
864a8da48d726596a1820bb07e7f3a53

SHA1
a41b8443a60776352810ce2091f91b1f18eca4c7

SHA256
6279ba47a31b8374d31853dffb238a9b2a3615699cb928ada75f503991abf984

SHA512
60c1b0c077f47a97086d7c989c8d89122c05e11d53a93eebab53f3a6326f16344dfae4691f5d72a524622cb869d3d5c0c173a8c665d6f622323a1408f0c1b919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d466a7f74e7b4d93e89151ce8b8dfe15

SHA1
6e2e57819790abe22fa880eaf32485fa708c4019

SHA256
6bac5af58fa693ad8deedb68a3693a9c7b28a00e343bdccc017df8b4e7181e87

SHA512
b7ceee6f358ed6ff5f10b9679b7a3f01e6e2379d45e2bba5613cc97f4bc74146006dc75ee16193f72133f39b8ab950071e86ecfa944455de179cb95aa69366a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ea7212726dbfe9a0df817d1bdde2cedc

SHA1
de4d35b48e8debc77615e0390ee7332b7bc23038

SHA256
d30b816919d243f5055a4ef7cc2c942a50ae57c9a834f7b8126a94b16557caa3

SHA512
52e2e681b44478abda282668cfcd06bb733e1387cec65e245b458fff55052df408d1955a9c734680cf2f91b0ecce5ed31f80075c62074d0123f1bf4fad6c3200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
071ccca9468516fc6f1ff773998a9f91

SHA1
a3f7aa4518e26134c922e2e4bd9ecfb4062c0a2c

SHA256
81093084ce0181d09538db05410687e2dd447018349bf0384cf8b9efe996e5f0

SHA512
5fae4952ccba798a815550743f3b8b2d9b7e25127ec4ba1a4a8a3664a8667d07889c5848ca027a242be2c9ce4d80ec45c303dbd7a8f4ea7220d31cb07913de7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9249fb6019517b7b5496feda318962cd

SHA1
6b044438d7389bf586f108bff1a8a953b0dfe25d

SHA256
74425a66e8b94089e75cfce1dd9315c3757360fa5b27718a076d06caf60fe3a4

SHA512
9038a825df4a9e6dd06927e7a3cd63cd6fe9611531670c3658a20c76a41120270ac13a91d07f671c89be8eb410225d48bcb4830f29cf0e8e399e76a6bd61cc2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc0e16297e3c2e818f72b5c8d48e964b

SHA1
4262b0b9653c793a37516b2e4fdc6d69765705a0

SHA256
c66e988eb5ad441483ac6e318a9ce7023780572d10db6441792a2d457ed3c503

SHA512
bffdcda8736478d22f593c061b486f124be80d50be40a13b6f4eaac063f97f84b2f40a80bc6322e75f2b73d68aa18e4dc0d7d91861e14b04828a402dc52bddde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
722580d87200b6da7043026a9a62359c

SHA1
be42b587d47adfb11a818e8225570e13ccb9e570

SHA256
f927d0663ebfc9175f8936f08443523cd486ff054fd86d383a457b85e0ec164c

SHA512
075cf267da83928b538abc7520b17d50e2f6686b2102237f349f722b0c2342cd5e14f986a6efabcc8edadad55236aa5f3e1cb535eb2970ebde1dde098ce6dc4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91864063536a259b9ba643062514335b

SHA1
b53316aaef77cced983ababf0feb699a9d21e6de

SHA256
63eb8f57d730e78de165c52f386c655dd39df6130531d0dba1ab492bc7e0ebd4

SHA512
7974ecb70a0af9514484adad02182d0973b08c94bee5e5799c9d1d7f446431a02416c5fd8be7c7c0ca70ac669de182ec9a5b2f786e86693172d2dbbb8c1bf160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
aa91a50be7ee9906ebca1710bc99646e

SHA1
285b7ef49f18c5185bc9a07801cf1545112e1717

SHA256
3bb61599e7808fbe56c351221a121831759a170444dd6b441e1a9000796eeb3f

SHA512
d7e6ea3bef1e1be5f4460583d00c3615ac6da02ef17981231e478ed63a36be4705546cd03e0b9f949f11d89ae0a3466a227e166dff01c73101f919b6badf18ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
179e59484f7e52bea78e0efe7a50c19f

SHA1
a1ecb3f3511a5982e6a75f2bf8d433b55b20d99f

SHA256
d5d81eae96b783eaccf7baa6d1b8ee0a1e4b74bf15347cf363eaa90be6383f55

SHA512
a681fc0b1ba3e35ff9c2e55326f60069e303fc3fd4b6a7c0419c42a3a8dc46594f01aa97c76a14fbe5450abd891cb76890a880cbb3ae416455d2f56617d7b818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57db0e.TMP

Filesize
371B

MD5
b6c66fc8ede7716d280b3a03e9411a3c

SHA1
6ddac7c44f24591afb63cf952675cfc49cdd505c

SHA256
0b66b17de5a701abb485025eed8a5fa5d7dd316ec2ed198ab318deffb4238ee8

SHA512
48028736170dbf5a5cebf2a477abdb4a4f8e7409a08d738c3c8bf351ff88956b6e0fbd681b2300575074b8ca8006f5a6f4457a06d05311d0b9fa0c02bc0d6257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
414e9baa3fa97e8ac3d5d2e30ce96906

SHA1
51248a375a5e37fa27cb72365d7d778110894973

SHA256
bfe28b69ced4d72ac28e44077f73d7fbea3d755c0491f95801656bf89443ef7b

SHA512
2e0b94e8f4c0656718b824e12809c36a3ca6e8288d06ac042f4628f29b98fb1262f0c8e6339bef9287b923ff704bc95a383f7dc346347ff1762579fffb75a2d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
972fa68f1c7cbd7bcf0927966be13bd5

SHA1
48580f4afcac96f68dfb388f2f65e5ecc6e5d94b

SHA256
4bbd11e2a2f7f7d0af186af047debf527975794f6fd0dc5779894ad58016a428

SHA512
ed41e1ba90d6fedbb00e6b0372d4065c4c4bf4e76c4c3acf1211426295d002ed3a090ecbfe6f16b528bb2772152ff012f11e67d30fced9ed74b7acab7babdb14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.11_(x64)_20241229171927_000_dotnet_runtime_8.0.11_win_x64.msi.log

Filesize
3KB

MD5
bc522cc47a6443392fbbc13f4fc1f76c

SHA1
5057298a3d898f26c0b86b26d06c82e71b35794d

SHA256
f831cdd0f044de186671f31886ffdc1b357482ab3892024c687ea5aa0a64c087

SHA512
0d09906f4b9793dd6740ce6c7584052ab637d7469c14383f4358349a6b5d184ab9fd694dd811f6b3c2afb628270c4b473340dac5ac37bbdb116a6b006d309736

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.11_(x64)_20241229171927_001_dotnet_hostfxr_8.0.11_win_x64.msi.log

Filesize
2KB

MD5
85d499eeb462b1f6bbfc6b2ba5a8ac6e

SHA1
5d855a21866b23d2166b8afa83229a8967109d8a

SHA256
b6e35e0843e39759d94b71b3cfcd5e10710491c8b025639efb13b9bdab451331

SHA512
b39a3cf156266843b87b7d86a1cf6fd67986d5031544f54e0b7bd3a9773c001ad7eb0be37baa91671acac5a0483123053a166c8744c6dbf205e984280f2c43a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.11_(x64)_20241229171927_002_dotnet_host_8.0.11_win_x64.msi.log

Filesize
3KB

MD5
7087da89da72f0f55c513df8a3a38f34

SHA1
9e693c075d8d62bfce7050f357adc54b2b30a462

SHA256
1537c8213413765e2933620409240e829298f1d9ca9b66c58f134750371ceb3b

SHA512
b70e59c0b5869341abd38af71ce278736cfc0d3f3b9d4214f248feaadce7edb80d96d83d5440314479c7a079ecaca53509b87b47abd701e2a7941e35300da429

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.11_(x64)_20241229171927_003_windowsdesktop_runtime_8.0.11_win_x64.msi.log

Filesize
2KB

MD5
65780037262bdc7f1ff376c799797358

SHA1
1241e34c9086bc679ea1e13e5c90ab864c5d385f

SHA256
69a3d856585e45ffa16c861e5ae2f54a7a21e2a779eff2124cad035150ec3388

SHA512
d146184220c9a028692ce7205d209b994d6de61e96f34bdd11c48871d6e045176cab8a6e671b5e41b5b0f7562d864d0aeb05a04c398657c0ea17847f13cf886a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20241229171856_000_vcRuntimeMinimum_x86.log

Filesize
2KB

MD5
bcb595ef1fbee3ecc77ca86b21d8c1b8

SHA1
5d6a95c4cb92ac79392fddec4797c1a06d4b1422

SHA256
479e7f04059a518c68bff9acf1479dd31090bfe12421d75af8a095621f1f18e6

SHA512
867b62cc71856f066a409a124b8e315067ef6ecff0c6fdbd7dd2cc0fdfe1182102585a4727791e3e4faec8f086c03197a075774d00221d6b7636ec6990c30a58

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20241229171856_001_vcRuntimeAdditional_x86.log

Filesize
2KB

MD5
c26728cd652ff82cf7bea7aceede3ad1

SHA1
06a304b98721f566281f0d8689cc55c90db58ef1

SHA256
8336ffca3a89158fcd6c4a58acbd8f4231aaa1c44c3605067cdd7deb2260bcb9

SHA512
40d5507a5cea6def888aef517b70295c0ff6468eccc2abad1cfbf130f23956263e844480bf4f546c693e5d1033ae6358bbd8f80b62884444cb36fdca84f40e01

Download Submit
C:\Users\Admin\Downloads\Enforcer.zip

Filesize
308KB

MD5
8614cd5e6d027511989823e5926cf5e3

SHA1
1cc907f26787f291e1e89afdcf89c9ae88d35a77

SHA256
fcf9fe20ad20377f58786153e7ff211fa7b71fd2cb112dbfdf181d8a999e3baf

SHA512
6cf7eae81d7b5ee52691b38bd750fd78b129ccf33e27380e6c62ef27841de3d74f716e4e88eb4fd0c190dec8ef355a26629ae7e7f8ac019b2b27be1201cd5865

Download Submit
C:\Users\Admin\Downloads\Enforcer.zip:Zone.Identifier

Filesize
191B

MD5
0bf70cac69c746518006e013f9dd6367

SHA1
62ae49b157081352fef83f3fff743a96c5e05bbd

SHA256
1299f62d63e752fb913014dcb120660ae9ce7c1ac1c6a8dfde52f26c1c2ef32c

SHA512
e81c801dd085e01af3f32c8941b639eedc77d7f371fa67c86f730aecddd07d6f29df560991e7ab62ef79922146390cbc2341b3533921374508faff935a0d660d

Download Submit
C:\Users\Admin\Downloads\Enforcer\vc_redist.x86.exe

Filesize
13.3MB

MD5
8a6f4f3282236325360a9ac4413b7bc3

SHA1
cb617803813e969be73f2e0e175a67620e53aa59

SHA256
dd1a8be03398367745a87a5e35bebdab00fdad080cf42af0c3f20802d08c25d4

SHA512
2c1facb8567a052b4fa65d173b0bda64fa5fded2cddb9073b7c28507ed95414c17d2839d06d5e961617c754cda54d6134964b1aff5c9e9cdfbace71f1de2ac3a

Download Submit
C:\Windows\Installer\MSIC4A7.tmp

Filesize
219KB

MD5
928f4b0fc68501395f93ad524a36148c

SHA1
084590b18957ca45b4a0d4576d1cc72966c3ea10

SHA256
2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae

SHA512
7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372

Download Submit
C:\Windows\Installer\MSID940.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Temp\{152FE0D1-0ECB-4411-B350-97E73A86688C}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{152FE0D1-0ECB-4411-B350-97E73A86688C}\.ba\wixstdba.dll

Filesize
215KB

MD5
f68f43f809840328f4e993a54b0d5e62

SHA1
01da48ce6c81df4835b4c2eca7e1d447be893d39

SHA256
e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

SHA512
a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

Download Submit
C:\Windows\Temp\{152FE0D1-0ECB-4411-B350-97E73A86688C}\cab54A5CABBE7274D8A22EB58060AAB7623

Filesize
842KB

MD5
a04f3e3bd8684cf660619e0f6af4d751

SHA1
2b5b1a39de1faa20d9a5774ec7b27dee5f6fc065

SHA256
b31b87a09f3aa2df573050949e87a68eeda01cb80dc974714d0603cea2c0708b

SHA512
fb3c081ad9f23661ed6f167ca878469d702f5cb60c15bb6d04c21331b43f8b88d98a680ad74ff5855e4c286260452be9e25b49b5b245d14fa30297cc8add5828

Download Submit
C:\Windows\Temp\{152FE0D1-0ECB-4411-B350-97E73A86688C}\cabB3E1576D1FEFBB979E13B1A5379E0B16

Filesize
4.9MB

MD5
654f67c3c99d57a0008427141bd1cfc6

SHA1
60887d57c8910a5034379ddc7a0ad5e2c2bfcde6

SHA256
d87d9b997b91f9e375bf3cf994b67882ce21c0fbd4d0c4611dd6f593d4a8f3be

SHA512
0f3182a9c923a51f9ffed2e8639f9bcb72ace859c6253aa860a95c2c67c6b9d80d7945042460a7f73e357614b149c9d906c101f800724825279f07902571a064

Download Submit
C:\Windows\Temp\{152FE0D1-0ECB-4411-B350-97E73A86688C}\vcRuntimeAdditional_x86

Filesize
200KB

MD5
95715c58dd2864b361dbd9e651b2f5ad

SHA1
c8b19282b7950e7b8e106b5bbccad4fc7b3aa661

SHA256
a6447de0d0d5b56b50988ae350432d68e9d83fbb566e2fcaa3f758a2b2574fea

SHA512
10eb258d1c1ab690e03fd782316133305530a7a50769263176765862a754dcf5ec258ca5805d2be447a53b29b3557b519a6cec812208d88982201c86ea8d5fb3

Download Submit
C:\Windows\Temp\{152FE0D1-0ECB-4411-B350-97E73A86688C}\vcRuntimeMinimum_x86

Filesize
200KB

MD5
975e07089d93c2540f0e91da7e1e0142

SHA1
e65a155b9f88cabf6fc34111751051f8872f1dc2

SHA256
16547c99e9dc8602603beda79bb9099d06b2f0e06273660aaffd3193d82e8bf5

SHA512
047ca9eaf996b5b89cedf0f9e9d7544cb8700bba02e10aa90fbd283fdebb2e1ec98295569f145e0dc9bbf3dbd44f64e4d02429cbcdff7e149f2804c135ee2595

Download Submit
C:\Windows\Temp\{4D48D0D8-DFC0-443D-A556-C3B1625DAEDE}\.cr\windowsdesktop-runtime-8.0.11-win-x64.exe

Filesize
608KB

MD5
fba0b1010e82ee3896e104749f505f54

SHA1
e7e43e8da6af9cd6a6b740b8f70caeb5fbfda730

SHA256
4aae588970b5de7e67c0c46b19d7e671e8186d5fd7082c1f602f57f1ced0e516

SHA512
91bd3515bde8cee82529636025f70b3ca9447338417b6b4f37074e57d5fb810be030f92b0a42fea0d4692979250c01462a41c2477dcf972f1f7554248af16543

Download Submit
C:\Windows\Temp\{5240B6DD-0043-44A6-8788-299A7016C801}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{6FE90894-E41D-4F66-A438-681F3D1B6E61}\.ba\1033\thm.wxl

Filesize
5KB

MD5
d5070cb3387a0a22b7046ae5ab53f371

SHA1
bc9da146a42bbf9496de059ac576869004702a97

SHA256
81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a

SHA512
8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3

Download Submit
C:\Windows\Temp\{E26B6A6B-1B9C-4976-AA42-F2931B02D9ED}\.cr\vc_redist.x86.exe

Filesize
669KB

MD5
f7aca1ef43beaa02107214482e6b51d6

SHA1
fb5cec36519b148119dec501cec92d894eb3b60a

SHA256
169b8f7025b301ffce5402c98c07f9e01bbadce52a2961175b777279f92624a7

SHA512
82cf5ebaa0a16e229b82e2dd550d7ab76409c89b4cfb7f163d1cce6d156db737ec5a09a3aa832b4076039665a6044aaeca3a6d311f8264492707ae281bbe7443

Download Submit
C:\Windows\Temp\{FE5196AF-5B46-4864-B8C4-7A42019706C1}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{FE5196AF-5B46-4864-B8C4-7A42019706C1}\.ba\wixstdba.dll

Filesize
190KB

MD5
f1919c6bd85d7a78a70c228a5b227fbe

SHA1
71647ebf4e7bed3bc1663d520419ac550fe630ff

SHA256
dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640

SHA512
c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb

Download Submit
C:\Windows\Temp\{FE5196AF-5B46-4864-B8C4-7A42019706C1}\dotnet_host_8.0.11_win_x64.msi

Filesize
704KB

MD5
aef2d4d02b45fa95d8abcac57e60d21b

SHA1
11c91e25dcf7f1357ab0fb0a6307a71b45dab754

SHA256
ebe13e660c208681e2f1c10fa59d8b37540f2e6187751703fa5bbb5f4b300eb1

SHA512
c78e41d5b2c845c106b088881cf72dddf64be09f72d7ac6078e944e7c9f6afb428e0bad7fec45bb539ad04694467fc302e0a915522123fe02f80bfe1762c2ef1

Download Submit
C:\Windows\Temp\{FE5196AF-5B46-4864-B8C4-7A42019706C1}\dotnet_hostfxr_8.0.11_win_x64.msi

Filesize
772KB

MD5
d73de5788ab129f16afdd990d8e6bfa9

SHA1
88cb87af50ea4999e2079d9269ce64c8eb1a584e

SHA256
4f9ac5a094e9b1b4f0285e6e69c2e914e42dcc184dfe6fe93894f8e03ca6c193

SHA512
bfc32f9a20e30045f5207446c6ab6e8ef49a3fd7a5a41491c2242e10fee8efd2f82f81c3ff3bf7681e5e660fde065a315a89d87e9f488c863421fe1d6381ba3b

Download Submit
C:\Windows\Temp\{FE5196AF-5B46-4864-B8C4-7A42019706C1}\dotnet_runtime_8.0.11_win_x64.msi

Filesize
26.3MB

MD5
b9c6d23462adef092b8a5b7880531b03

SHA1
9e8c4f7f48d38fb54a93789a583852869c074f2d

SHA256
2e23da54aa1ff64de09021ab089c1be6d4a323bdf0d8f46f78b5c6a33df83109

SHA512
18623991c5690e516541eaf867f22b3a1a02317392178943143bedc7f7eda5e02e69665c3c4a5fa50ade516a191bbbf16fd71e60f3225f660fb10ebc25cd01a5

Download Submit
C:\Windows\Temp\{FE5196AF-5B46-4864-B8C4-7A42019706C1}\windowsdesktop_runtime_8.0.11_win_x64.msi

Filesize
29.1MB

MD5
230fed97d6f8eab7800e2316fef53c00

SHA1
7a97f51462584f6a8cc9eb08da654dea4d2b7fba

SHA256
c9aaa2ab9905abbbecff1ad3c3ecbae1f4d7fe8a063f3bfd2fcfe5176fcb169d

SHA512
e0af63d92aecc632b1273e63b5327d2ca9ea3d7a086807205043e4bc76050a22de786e419c1d95a8a8521f39af8c4dc6cf9563dd88e3174e5e87a2d30a6f2352

Download Submit
memory/836-503-0x0000000000140000-0x00000000001B7000-memory.dmp

Filesize
476KB

Download
memory/1216-541-0x0000000000140000-0x00000000001B7000-memory.dmp

Filesize
476KB

Download
memory/1692-540-0x0000000000140000-0x00000000001B7000-memory.dmp

Filesize
476KB

Download
memory/2820-1409-0x0000000000B60000-0x0000000000BD6000-memory.dmp

Filesize
472KB

Download
memory/3472-1435-0x0000000000B60000-0x0000000000BD6000-memory.dmp

Filesize
472KB

Download
memory/3716-1434-0x0000000000B60000-0x0000000000BD6000-memory.dmp

Filesize
472KB

Download
memory/4244-298-0x0000000005AD0000-0x0000000005B62000-memory.dmp

Filesize
584KB

Download
memory/4244-297-0x0000000005FE0000-0x0000000006586000-memory.dmp

Filesize
5.6MB

Download
memory/4244-1464-0x0000000001740000-0x000000000174A000-memory.dmp

Filesize
40KB

Download
memory/4244-296-0x0000000000F60000-0x0000000000FBC000-memory.dmp

Filesize
368KB

Download
memory/4728-588-0x000001EFA4420000-0x000001EFA4421000-memory.dmp

Filesize
4KB

Download
memory/4728-581-0x000001EFA4420000-0x000001EFA4421000-memory.dmp

Filesize
4KB

Download
memory/4728-582-0x000001EFA4420000-0x000001EFA4421000-memory.dmp

Filesize
4KB

Download
memory/4728-583-0x000001EFA4420000-0x000001EFA4421000-memory.dmp

Filesize
4KB

Download
memory/4728-587-0x000001EFA4420000-0x000001EFA4421000-memory.dmp

Filesize
4KB

Download
memory/4728-590-0x000001EFA4420000-0x000001EFA4421000-memory.dmp

Filesize
4KB

Download
memory/4728-592-0x000001EFA4420000-0x000001EFA4421000-memory.dmp

Filesize
4KB

Download
memory/4728-593-0x000001EFA4420000-0x000001EFA4421000-memory.dmp

Filesize
4KB

Download
memory/4728-591-0x000001EFA4420000-0x000001EFA4421000-memory.dmp

Filesize
4KB

Download
memory/4728-589-0x000001EFA4420000-0x000001EFA4421000-memory.dmp

Filesize
4KB

Download