2b118648b91d43a773fce18a7e934e80f9aff590ee6500c221693074310a6cfe

Analysis

user interaction
yes
max time kernel
83s
max time network
71s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EDGEALERT Installers/windowsdesktop-runtime-8.0.25-win-x64.exe
Size 55.8MB
Sample260415-lcbfxaax3j
SHA256 2b118648b91d43a773fce18a7e934e80f9aff590ee6500c221693074310a6cfe
MD5 2f2b3b6edd03f1f38913cf017cc48563
SHA1 5af2ef45b817c57ea68d9eec9fe5a9e23d87d481
SHA512 044628141cb05423b7e3a819d3baf13cab75382174a1e528c9c00f9e93919fd2684d68b5d70293f69560316c3909c49be279290da22541ed130a91924842e8ad
SSDEEP 1572864:e49UpJrfceIERNhmLtgJWLMTv55ha5NKBHTY0b8Lh:eBJr50cWL65ueBcKI
TLSH
T19AD73337E12487BAD9F52032F53AB1782E64A11552554922EBD8EF1D3B3A4C317F3A83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{64c75e04-ef03-4544-b153-24860eac8d23} = "\"C:\\ProgramData\\Package Cache\\{64c75e04-ef03-4544-b153-24860eac8d23}\\windowsdesktop-runtime-8.0.25-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-8.0.25-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{64c75e04-ef03-4544-b153-24860eac8d23} = "\"C:\\ProgramData\\Package Cache\\{64c75e04-ef03-4544-b153-24860eac8d23}\\windowsdesktop-runtime-8.0.25-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-8.0.25-win-x64.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5716	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\zh-Hans\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\es\PresentationUI.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\netstandard.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.25\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\de\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\zh-Hans\PresentationUI.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Presentation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.25\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.25\System.Diagnostics.StackTrace.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Security.Permissions.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\tr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\pt-BR\System.Windows.Forms.Design.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\cs\System.Windows.Forms.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.Aero2.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.25\System.Reflection.TypeExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\ja\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\System.Diagnostics.PerformanceCounter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\fr\System.Windows.Forms.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\WindowsFormsIntegration.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\pl\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.25\System.Runtime.InteropServices.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XPath.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.25\System.Xml.XPath.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\pt-BR\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\ja\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\System.Windows.Forms.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.25\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.25\System.Collections.Immutable.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\zh-Hant\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\ko\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\System.IO.Packaging.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Extensions.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\zh-Hant\UIAutomationTypes.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.25\System.Security.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.25\System.Xml.XDocument.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\WindowsBase.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Forms.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\ja\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\it\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\it\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\PresentationFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Xaml.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\WindowsBase.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\zh-Hant\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.25\ja\UIAutomationProvider.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.CodeDom.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebClient.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e585166.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\CacheSize.txt	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D0E1D031-D6BB-43A5-BD42-175C0C4EE245}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI67F7.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C5343D9A-9640-4351-90D2-F6CF157C208E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6BB3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC9B6D9453D977A84.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI63CB.tmp	msiexec.exe
File created	C:\Windows\Installer\e585170.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B74.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC2AA4A35D65C3BDD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5938.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI60EA.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF49DDA5C9801CD13F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDFB6CFDD25654E7B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78B4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI669D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58516c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD323B69FDCAA1051.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{99B0C384-9362-4D4E-8DAF-23CA44E306E8}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD1C0BFF65FC350C2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6960.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF79F3FE34604CFF75.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D6B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF15AAB1601E2DD20.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F8F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58515c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF51BDD5F0417AD56D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4019B53A66E2C5BA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F9B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66EC.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CCD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D00.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI675A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2869DCCB0AA10564.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4ADF2B6743915B8A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9ED5F712454E4354.TMP	msiexec.exe
File created	C:\Windows\Installer\e585160.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE1FEBB73C2C7DFBC.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{55218133-14C8-4372-A748-614DE61D6AAA}	msiexec.exe
File created	C:\Windows\Installer\e58516c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI982C.tmp	msiexec.exe
File created	C:\Windows\Installer\e585157.msi	msiexec.exe
File created	C:\Windows\Installer\e58515c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6FC178D40309966D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D4F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5DC09157FC9C3B5C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBF886356362C8AB6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e585157.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6F11CC19E4D57FE7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9AFB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6290.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI635D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e585161.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4C885CDD44EE01E6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5743.tmp	msiexec.exe
File created	C:\Windows\Installer\e585161.msi	msiexec.exe

Executes dropped EXE 6 IoCs

pid	Process
3292	windowsdesktop-runtime-8.0.25-win-x64.exe
1864	windowsdesktop-runtime-8.0.25-win-x64.exe
5324	windowsdesktop-runtime-8.0.25-win-x64.exe
2084	windowsdesktop-runtime-8.0.25-win-x64.exe
2548	windowsdesktop-runtime-8.0.25-win-x64.exe
3608	windowsdesktop-runtime-8.0.25-win-x64.exe

Loads dropped DLL 21 IoCs

pid	Process
3292	windowsdesktop-runtime-8.0.25-win-x64.exe
4208	MsiExec.exe
4208	MsiExec.exe
3576	MsiExec.exe
3576	MsiExec.exe
236	MsiExec.exe
236	MsiExec.exe
236	MsiExec.exe
236	MsiExec.exe
2436	MsiExec.exe
2548	windowsdesktop-runtime-8.0.25-win-x64.exe
2436	MsiExec.exe
4460	windowsdesktop-runtime-8.0.15-win-x64.exe
4072	MsiExec.exe
4072	MsiExec.exe
2156	MsiExec.exe
2156	MsiExec.exe
916	MsiExec.exe
916	MsiExec.exe
5416	MsiExec.exe
5416	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.25-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.25-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.25-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.15-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.25-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.25-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.25-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.15-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.15-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.25-win-x64.exe

Modifies data under HKEY_USERS 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\130D1E0DBB6D5A34DB2471C5C0E42E54	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\130D1E0DBB6D5A34DB2471C5C0E42E54\PackageCode = "E21DB8117F2BFCA4F915BC904515CC15"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D3435C04691534092D6FFC51C702E8\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.100.48707_x64\DisplayName = "Microsoft .NET Runtime - 8.0.25 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\483C0B992639E4D4D8FA32AC443E608E\ProductName = "Microsoft .NET Runtime - 8.0.25 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\483C0B992639E4D4D8FA32AC443E608E\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{99B0C384-9362-4D4E-8DAF-23CA44E306E8}v64.100.48707\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.100.48707_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\331812558C4127347A8416D46ED1A6AA\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A9D3435C04691534092D6FFC51C702E8	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E6E137869FA5154CACEBDBFD35F2529	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\483C0B992639E4D4D8FA32AC443E608E\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.100.48707_x64\Dependents	windowsdesktop-runtime-8.0.25-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64	windowsdesktop-runtime-8.0.25-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\483C0B992639E4D4D8FA32AC443E608E\SourceList\PackageName = "dotnet-runtime-8.0.25-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\130D1E0DBB6D5A34DB2471C5C0E42E54\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F9CCC11AA771244E9CAABCE639D8671\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\331812558C4127347A8416D46ED1A6AA\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{5625BB48-295C-4113-BC92-D6A69B19B04C}\DEPENDENTS\{5625BB48-295C-4113-BC92-D6A69B19B04C}	windowsdesktop-runtime-8.0.15-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\91D0BB150F05E0D6E86B8357071893B0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F73B92EAB7C5A6744F5C6B760B0B0628	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{64c75e04-ef03-4544-b153-24860eac8d23}	windowsdesktop-runtime-8.0.25-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E097DC7E55A5F2C503FFA9FC508BAD08\130D1E0DBB6D5A34DB2471C5C0E42E54	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\483C0B992639E4D4D8FA32AC443E608E\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\130D1E0DBB6D5A34DB2471C5C0E42E54\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\130D1E0DBB6D5A34DB2471C5C0E42E54\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64\Version = "64.100.48707"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D3435C04691534092D6FFC51C702E8\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.100.48707_x64\Dependents\{64c75e04-ef03-4544-b153-24860eac8d23}	windowsdesktop-runtime-8.0.25-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\483C0B992639E4D4D8FA32AC443E608E\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{99B0C384-9362-4D4E-8DAF-23CA44E306E8}v64.100.48707\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.100.48707_x64\DisplayName = "Microsoft .NET Host FX Resolver - 8.0.25 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D3435C04691534092D6FFC51C702E8\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{C5343D9A-9640-4351-90D2-F6CF157C208E}v64.100.48707\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0287A4E04ADF05247BCA7E2A7F4BB346	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\77F253A93D25237423B0FA10091DA554	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{64c75e04-ef03-4544-b153-24860eac8d23}\Dependents\{64c75e04-ef03-4544-b153-24860eac8d23}	windowsdesktop-runtime-8.0.25-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\91D0BB150F05E0D6E86B8357071893B0\483C0B992639E4D4D8FA32AC443E608E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\130D1E0DBB6D5A34DB2471C5C0E42E54\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\130D1E0DBB6D5A34DB2471C5C0E42E54\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\331812558C4127347A8416D46ED1A6AA\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\331812558C4127347A8416D46ED1A6AA\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D3435C04691534092D6FFC51C702E8\Version = "1080344131"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\483C0B992639E4D4D8FA32AC443E608E\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.100.48707_x64\ = "{D0E1D031-D6BB-43A5-BD42-175C0C4EE245}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D3435C04691534092D6FFC51C702E8\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\84D73C53F27508B43307137413B0F9CB	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.60.31203_x64\Dependents	windowsdesktop-runtime-8.0.15-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\DOTNET_CLI_HOSTFXR_64.60.31149_X64\DEPENDENTS\{5625BB48-295C-4113-BC92-D6A69B19B04C}	windowsdesktop-runtime-8.0.15-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.100.48707_x64\Dependents\{64c75e04-ef03-4544-b153-24860eac8d23}	windowsdesktop-runtime-8.0.25-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{64c75e04-ef03-4544-b153-24860eac8d23}	windowsdesktop-runtime-8.0.25-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\483C0B992639E4D4D8FA32AC443E608E\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\130D1E0DBB6D5A34DB2471C5C0E42E54\ProductName = "Microsoft .NET Host FX Resolver - 8.0.25 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\130D1E0DBB6D5A34DB2471C5C0E42E54\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{D0E1D031-D6BB-43A5-BD42-175C0C4EE245}v64.100.48707\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64\DisplayName = "Microsoft .NET Host - 8.0.25 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\331812558C4127347A8416D46ED1A6AA\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.100.48707_x64\Version = "64.100.48707"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\331812558C4127347A8416D46ED1A6AA\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\331812558C4127347A8416D46ED1A6AA\SourceList\PackageName = "dotnet-host-8.0.25-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_64.100.48707_x64	windowsdesktop-runtime-8.0.25-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6E137869FA5154CACEBDBFD35F2529\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\331812558C4127347A8416D46ED1A6AA\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64	windowsdesktop-runtime-8.0.25-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9D3435C04691534092D6FFC51C702E8\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C5343D9A-9640-4351-90D2-F6CF157C208E}v64.100.48707\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\483C0B992639E4D4D8FA32AC443E608E	msiexec.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeIncreaseQuotaPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeSecurityPrivilege	5716	msiexec.exe
Token: SeCreateTokenPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeLockMemoryPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeIncreaseQuotaPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeMachineAccountPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeTcbPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeSecurityPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeTakeOwnershipPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeLoadDriverPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeSystemProfilePrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeSystemtimePrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeProfSingleProcessPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeIncBasePriorityPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeCreatePagefilePrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeCreatePermanentPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeBackupPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeRestorePrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeShutdownPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeDebugPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeAuditPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeSystemEnvironmentPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeChangeNotifyPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeRemoteShutdownPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeUndockPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeSyncAgentPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeEnableDelegationPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeManageVolumePrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeImpersonatePrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeCreateGlobalPrivilege	1864	windowsdesktop-runtime-8.0.25-win-x64.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe
Token: SeRestorePrivilege	5716	msiexec.exe
Token: SeTakeOwnershipPrivilege	5716	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3292	windowsdesktop-runtime-8.0.25-win-x64.exe
2548	windowsdesktop-runtime-8.0.25-win-x64.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3292	4676	windowsdesktop-runtime-8.0.25-win-x64.exe	79
PID 3292 wrote to memory of 1864	3292	windowsdesktop-runtime-8.0.25-win-x64.exe	80
PID 5324 wrote to memory of 2084	5324	windowsdesktop-runtime-8.0.25-win-x64.exe	84
PID 2084 wrote to memory of 2548	2084	windowsdesktop-runtime-8.0.25-win-x64.exe	85
PID 5716 wrote to memory of 4208	5716	msiexec.exe	86
PID 5716 wrote to memory of 3576	5716	msiexec.exe	87
PID 5716 wrote to memory of 236	5716	msiexec.exe	88
PID 5716 wrote to memory of 2436	5716	msiexec.exe	89
PID 1864 wrote to memory of 3100	1864	windowsdesktop-runtime-8.0.25-win-x64.exe	90
PID 3100 wrote to memory of 4460	3100	windowsdesktop-runtime-8.0.15-win-x64.exe	91
PID 4460 wrote to memory of 4328	4460	windowsdesktop-runtime-8.0.15-win-x64.exe	92
PID 5716 wrote to memory of 4072	5716	msiexec.exe	93
PID 5716 wrote to memory of 2156	5716	msiexec.exe	94
PID 5716 wrote to memory of 916	5716	msiexec.exe	95
PID 2548 wrote to memory of 3608	2548	windowsdesktop-runtime-8.0.25-win-x64.exe	96
PID 5716 wrote to memory of 5416	5716	msiexec.exe	97

C:\Users\Admin\AppData\Local\Temp\EDGEALERT Installers\windowsdesktop-runtime-8.0.25-win-x64.exe
"C:\Users\Admin\AppData\Local\Temp\EDGEALERT Installers\windowsdesktop-runtime-8.0.25-win-x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\Temp\{8A2B9051-F893-42A7-9482-46BCCA07DEF4}\.cr\windowsdesktop-runtime-8.0.25-win-x64.exe
  "C:\Windows\Temp\{8A2B9051-F893-42A7-9482-46BCCA07DEF4}\.cr\windowsdesktop-runtime-8.0.25-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\EDGEALERT Installers\windowsdesktop-runtime-8.0.25-win-x64.exe" -burn.filehandle.attached=732 -burn.filehandle.self=580
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\Temp\{5F4A084F-4BFF-468C-B49E-95E51B646B07}\.be\windowsdesktop-runtime-8.0.25-win-x64.exe
    "C:\Windows\Temp\{5F4A084F-4BFF-468C-B49E-95E51B646B07}\.be\windowsdesktop-runtime-8.0.25-win-x64.exe" -q -burn.elevated BurnPipe.{A4418928-EB56-4586-A501-9B2CDA9EF441} {E1C06B1D-15EA-47E9-9133-4C899AA8958D} 3292
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
      "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={64c75e04-ef03-4544-b153-24860eac8d23} -burn.filehandle.self=1048 -burn.embedded BurnPipe.{9009F793-E6A0-4124-AC6A-20844F77A406} {6B18FCD9-D762-4844-8FDC-BB3EEBDC7DBB} 1864
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3100
    - - C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        
        "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={64c75e04-ef03-4544-b153-24860eac8d23} -burn.filehandle.self=1048 -burn.embedded BurnPipe.{9009F793-E6A0-4124-AC6A-20844F77A406} {6B18FCD9-D762-4844-8FDC-BB3EEBDC7DBB} 1864
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4460
      - C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        
        "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{503C2A50-F242-4D07-972B-727B76882D7F} {B7E4BF2A-CBC7-47B8-8D48-1899170ABB78} 4460
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4328

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 213DDBA517D3C82E0928DC4F07EB6C35
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4208
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D34E82BFAE8398EE5FF410F0B8276683
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3576
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 30AA6EF71713A7D76F02F9C3432F4A7B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:236
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8A634823002A96DA8D2C495CD17F49D0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2436
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 973FCD5B0A3C4E267655E45AEE5846A1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4072
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 232587AD7A7592392AFA8B8730E760A7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2156
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5F845928A87B22841A3114D425EAFD98
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DC8E633FF91A372610F3B74C9132582E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5416

C:\ProgramData\Package Cache\{64c75e04-ef03-4544-b153-24860eac8d23}\windowsdesktop-runtime-8.0.25-win-x64.exe
"C:\ProgramData\Package Cache\{64c75e04-ef03-4544-b153-24860eac8d23}\windowsdesktop-runtime-8.0.25-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5324
- C:\ProgramData\Package Cache\{64c75e04-ef03-4544-b153-24860eac8d23}\windowsdesktop-runtime-8.0.25-win-x64.exe
  "C:\ProgramData\Package Cache\{64c75e04-ef03-4544-b153-24860eac8d23}\windowsdesktop-runtime-8.0.25-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.25_(x64)_20260415102341.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\ProgramData\Package Cache\{64c75e04-ef03-4544-b153-24860eac8d23}\windowsdesktop-runtime-8.0.25-win-x64.exe
    "C:\ProgramData\Package Cache\{64c75e04-ef03-4544-b153-24860eac8d23}\windowsdesktop-runtime-8.0.25-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{64c75e04-ef03-4544-b153-24860eac8d23}\windowsdesktop-runtime-8.0.25-win-x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.25_(x64)_20260415102341.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\ProgramData\Package Cache\{64c75e04-ef03-4544-b153-24860eac8d23}\windowsdesktop-runtime-8.0.25-win-x64.exe
      "C:\ProgramData\Package Cache\{64c75e04-ef03-4544-b153-24860eac8d23}\windowsdesktop-runtime-8.0.25-win-x64.exe" -q -burn.elevated BurnPipe.{769C1520-CA11-4F37-877C-E424E389E773} {EACF5531-3C18-45A6-9E04-2DCFDF9112DF} 2548
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58515a.rbs

Path C:\Config.Msi\e58515a.rbs
Size 48KB
SHA256 2cc42f744d87c84015ba93ca1e782dc3854a958aacccfbea984762c931506d31
MD5 564e1f79e038954eb72c8748918d60f1
SHA1 0b0848999eb83bc30a5f92c7a812eb7ac6027dae
SHA512 9adcd59d927d589bc79d0bfff4a2cda4f052bbb78f2854c233530e36c560726755cccd3a89b0e710b1d4c8537cf36d4f920d58f63ee423b62de395a88f136d06
SSDEEP 1536:rSHml7MTNGoeTwcwNtq+iz36E2w/7rEu2DGCuxDEnoEIpeoal1SHhr1a/2ffKB2Z:h
TLSH
T10F233120AB00D2E7F2333DA0A722DD0867964D8B5704D9DE60CE462FCD567DD8ABC5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58515f.rbs

Path C:\Config.Msi\e58515f.rbs
Size 9KB
SHA256 fa322f0f5acbde02c5aac3de75db7ab2c02511888075ad1505fb0a858f3776c5
MD5 d81872315c21faf4d99400dd788767cf
SHA1 9af0241c60be9e045667c32fef2939b56b7d116a
SHA512 4bfc2ec0781152eac928baeb5476fca8fc315894ef831fc783fc7c1fe051a33a052fe0413748f26e7a3e54f3bcb085ce60672dc4fecaf8232fe6f6a6f0d6c3ae
SSDEEP 192:08DGJw6cZLCVBm2ICm2xz+2yKEVl76jspIzY:0y0msmiiAE
TLSH
T105120201BB0082D3F9971FF5C70727113BFBD3E59611A20B099DA1646F47B885E992EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585164.rbs

Path C:\Config.Msi\e585164.rbs
Size 11KB
SHA256 279685b6238867052870d1fcde1103d8f3f9bb78588e4251525e30bba7fa87e7
MD5 cd72078c2efb5e7717ff5527ba249c60
SHA1 ec1366000dcb89c9d8625a6ef731de9285fd30a5
SHA512 15fd18ff940e68b939bf00426529986ecd900e1deb7c9f9c2725c8949bbd755d670d555e6754467e6220390badc0f5092464a8d6d5a9da6d2ca10b52802e848a
SSDEEP 192:0L6wXqsZdp5HaAriQ9C1Bd2I9d2/2LJEUux5lspv:0nqsZdp5H8RdPdge
TLSH
T121324243E640D6C2E8E22B35C7C71BB13B72D3E58322634B29DCE6759E573C51E9418A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585169.rbs

Path C:\Config.Msi\e585169.rbs
Size 8KB
SHA256 82acd5ac9689024ee285c475cd9418912f8b6801cc922fffb473efddc4560860
MD5 563c97559fa0f4aa31384ad3f70db7a9
SHA1 78cfc5268cf844197dc3a1941c5361cf6128cba5
SHA512 1c87e300bda39344edcac1adc8e2ba09eb7cd6d939df90f05a1c5c57d3a7c7b24795f39f8982ba4f7de66e35913a9c2ada07a25417e2b510197255190d7b3367
SSDEEP 192:r8q4xRFxER3xP/nlkhVSczdrCFgTD8e0W1co0RVo0X3sw/ii6s:r8q4xRF+R35/nlkhVSczQFAD8ezczXzV
TLSH
T177121F07B60081F3EA612735E71327B17BABD79E8304435F10ACB4695B46BC21EE55EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58516a.rbf

Path C:\Config.Msi\e58516a.rbf
Size 143KB
SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
MD5 7d4ea76b6e0659fdd36b34499f964aea
SHA1 6b7700ed5632d176fc0efbc5611192644bc391d4
SHA512 41ecf5f0a70828d114056bacd8fde364e2685e3c2f58a785540af7056e3698b027cd3bcce64ab840814ad3d2c5a0eac0a3528cdd88b737eb02671e816eff27cf
SSDEEP 1536:8vJ9psmemUoXVpuoM+/7BUNs9OFVJqp+uIBQepE4XKF3QcOzm:8vJ9psmeIBcV8pQFq4XKF3QP6
TLSH
T1FBE3C31AD29802E8C06E6179C7568A41B7337C6687E1D3CB53D0F53E1F766909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58516b.rbf

Path C:\Config.Msi\e58516b.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e58516f.rbs

Path C:\Config.Msi\e58516f.rbs
Size 88KB
SHA256 21d05b967f23d078ddc21e7f5650de3cdde438aed7cf34e496d13a867cf15201
MD5 865458cdf813990480a27d20c84560c1
SHA1 543f5d94d8e1c97890709c70c5f183d92086f158
SHA512 9a0556fa1efa34603dfefd82419528053a335edccd2d8c080a39e67cb255aa3974df2537546bc05d6e61af4e66aa7147a21294c3cbace96eab358436f83949ba
SSDEEP 1536:0fHKUnajfvaMHERLycnvcP3RxbKHd6nqzzgeFR57xLLrQ/dG+JR7FzI+37RH1PP9:5/xt01Wg/ESd+c9stk5/VG
TLSH
T1C393F4696704C791DA332958073BDA4C9F548C7EA340C95612CE41BBE8E7B9B9FBC8C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585173.rbs

Path C:\Config.Msi\e585173.rbs
Size 132KB
SHA256 32d7b462374cbf417c479ec22a74d669e7658d2acfb3c18253ec85bd0e4d47a9
MD5 350927d57cb2546aaaa9deeca2753610
SHA1 6f0268f37df4938ae9613cb98a4ef49925fa8958
SHA512 33c93ed40b300aa8050d3c424a661a8aab7cf51f30281343c20e57d6982342d3d78d719c4cac56a76ebea72f0a212553ec5a1eed2f81bf642052658505051896
SSDEEP 3072:TMrS6moQnqroUOVa377XMco9MmJMG0Ob6Ew7XAxTY:sKXMRD
TLSH
T1C4D3DF5F2394D0E2C43239349B3BAB4CAD134E764355805B9AE9A12EDE777C72FA48C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585290.rbs

Path C:\Config.Msi\e585290.rbs
Size 8KB
SHA256 b2ce816b751e69aed694f3bb7121a929de733bb87d382fa93021594c5fe796bd
MD5 7fb0bdda38b2d47b2ddbc6a000fb3b54
SHA1 8d4a8ca5bfb191e8a15646f1b10ef4e7e6964eec
SHA512 c706b91b681b5c503e13255f723fe527c5ed8b38198568c192b6d3fb31dd83bff715d1075e8ee7e86eb0713c8497bbbb3ab172ff70a476bc94ed455b5e7a8700
SSDEEP 192:VzdHRXx+RqxqkHHhYPR6a2OrI9mT2kcOgiHK+L8K+RXKo6mi:VBRXsRq8BnP
TLSH
T19D020F26B649C1E3FA662A31D6032B70BFB7D2D98314438B10DD75609F17784AE583DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585294.rbs

Path C:\Config.Msi\e585294.rbs
Size 86KB
SHA256 d470be50e1de34e074532d8e4ea886c5415bfa0139949a4f2f7753be0876a9b2
MD5 33ed10458ac80853374bddf18f10b755
SHA1 2d51caa9f58833e0b015b0567e28f3d5ee971176
SHA512 5f8e31c36d4a8c52a279365ddc56651dd2cf691aa376d66882a8f0e9d7d9060c87e1b1ad4c7cabfe0868cc70be9e53125e1ba0b914e7b1d3a425b8272fa7e015
SSDEEP 384:VrQRsvRvIOJif+YIp4eafmC/0QAXjB8tbIURpcAhdO/qAlFIHafTC9v7ahhFEDuy:VYoNEz1tmyOFc6b/p3JOV
TLSH
T10983BD276FC8D0F3D231797067725B4C7F128E664310C09A56E9924FCB3FBA96E98486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58534f.rbs

Path C:\Config.Msi\e58534f.rbs
Size 3KB
SHA256 cb3d9a09c3f17385ee2f3d58f13c5bb72738e4b8e2deeb5ae588b301743d235b
MD5 4e91e8ca7155f6b6401ee8d8e0af6134
SHA1 547beb56fcefb0662f590bdb619118e3f10a5e24
SHA512 ca1e652af10ad8225f5bd71fc4e3b8914022f1770d8e91bc394ec93ea1f3dd07c7c4b958926bf936d94751176cf3c6a404d348828c0633f0a7dd1b769dd0654a
TLSH
T10681E003AE00D6C2EDE32B30C95B0B6533B7D6EAC7118387408C91B14D97BDAEED9685
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{64c75e04-ef03-4544-b153-24860eac8d23}\state.rsm
Size 1KB
SHA256 58afe6e988e8159cadc9e17646e053f76bc903488a5af77355f11ce8f07504cc
MD5 1cfd54e2bbd2c355735c1ec9739a05d3
SHA1 f40b3f99cfa4c90c33a5966daafc8d9ca2eff021
SHA512 8e24e7523a0ccfa28e03b82f5b5cf6d4b26b592877519c5ebb18c8421e768bda7c1778febfcac2cc72b7c75a8c4886f033b520d00bdc1a9416bf8d0cdd9747aa
TLSH
T1F811D1516FF91019E3B7AF30BEF19214697EB8210D32D11D0100604A8E32B80CD70B36
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260415102357_000_windowsdesktop_runtime_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260415102357_000_windowsdesktop_runtime_8.0.15_win_x64.msi.log
Size 1KB
SHA256 c1fa1002c35e40cf1e2695889a1f87e7e68b1809efa290fb1b5ad1e6744e6343
MD5 b14049c3430eded66fe30a0a86c342f7
SHA1 91bf1b3fa2399da93a4039748844601dc96c6084
SHA512 219394dea4ef7bec76c0d875e45058ad71f1619c5502463a62c63649e3ee6104fdd46cb15a4ddce69879f63a2e239763574eb0a34c308b0a11f7d3d1048b71da
TLSH
T13541CB662AD50884B1B66707DEF3C1525E33FCCAA834DF4C5385821A076BD0768AC7BE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260415102357_001_dotnet_hostfxr_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260415102357_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
Size 1KB
SHA256 58d099e574ba0e888f566837493b322524ab61d8706d3759f0ca13f549b6fb2d
MD5 072c01a04011f8da77db7e9e8c686e35
SHA1 104b99769583da1f79c9d3ec5d04d66f41eee6ba
SHA512 83f32df35ed1f7b77f910df00ddb9a138e0f632c3e130487b394c3c7f1fcd9e230fc540b70c15fbd737adb5c5027d23722f7a1beb488a482c38e95adad77080b
TLSH
T1F741D1651BD40D45B1B75747DEF3C0A2AA33FCD2A8349F4C2385821A076BD0268AC7BE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260415102357_002_dotnet_runtime_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260415102357_002_dotnet_runtime_8.0.15_win_x64.msi.log
Size 3KB
SHA256 9cf6e1fbe67208a9de2990e219333841a7857e9d8b456ae6d371182e08f6a620
MD5 a07abec0df3e060537727343d21728b5
SHA1 7addabc8423fc8596974ca840bb9e3d72679a668
SHA512 371c6488c1142f528cf9ef91bf895f47b5a2808baca2002a843b8b80a62a5db997f0a6a54123d82544bf3442e1d00201b9fb4aba25f9d74ac23e2d83fe05ed8f
TLSH
T1A651C91A1AE54C06B1B2D707DEF3C0525937BDC668349B4D23C9871A479BC0678BC7BA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.25_(x64)_20260415102341_000_dotnet_runtime_8.0.25_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.25_(x64)_20260415102341_000_dotnet_runtime_8.0.25_win_x64.msi.log
Size 3KB
SHA256 fcfd40c1779d52096454d18f5e6147dfe761d2134d08272899493255ef55bf1b
MD5 a1ab9b8c047f26151759b4666924a071
SHA1 a575b922ff28caeced7c812ce5585ccb2d66cf91
SHA512 0f7a2caad25b1edc88a6db7a918822281b11732fe0f2e418dc0d11f399f8087eaaf5cbc563715ce1b6c0a585484adae9c6f54925214da38c3c12a0acb8077176
TLSH
T16181C8695BE50946B2B35707DDF3C4537A73BCC66830DF4D2385831A026B805A97CBBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.25_(x64)_20260415102341_001_dotnet_hostfxr_8.0.25_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.25_(x64)_20260415102341_001_dotnet_hostfxr_8.0.25_win_x64.msi.log
Size 2KB
SHA256 c1bfed47187afb11959aee9a87c0f57803998f60c914bd85faa22f5d5bdd55e5
MD5 d9caecba8908fadb9653e86f0ae3c7a2
SHA1 9aa328766fe73a71267cb793fcf93af5484a3160
SHA512 d9f2efb53ea4cd95313b72a8e664d027188deb732659fb52a6ea3e65377f2c3b6c8679b4cca1a49c086be94656242d2e0afd44f7d358e73082c90d4e18778f8a
TLSH
T1354104151BE50986B1B65747EEF3C4529A33FDD26830DB4D1345831A06ABC00A8ACBBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.25_(x64)_20260415102341_002_dotnet_host_8.0.25_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.25_(x64)_20260415102341_002_dotnet_host_8.0.25_win_x64.msi.log
Size 4KB
SHA256 8d4855a396e581bdb020f2b849885596aeee8facbc78d9f180f73e8de1b814ab
MD5 632f9ad36550a64a606fb81abb1d24a9
SHA1 f9c4aa61dc46cb30b46cf0f46007d3296157f921
SHA512 b9fed6faec15a9cdd24941cbb78e110fd2a5be7697fb8e5c74ca9443520e62eb51270fa07652c22185ed3489f9658223bb7852042490aa1141ba5e57c573daab
TLSH
T19C812B151BE50885B2B75707DEF38417AB33BCD26834DF4C5386831A46AB901A87CBBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.25_(x64)_20260415102341_003_windowsdesktop_runtime_8.0.25_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.25_(x64)_20260415102341_003_windowsdesktop_runtime_8.0.25_win_x64.msi.log
Size 2KB
SHA256 fa3fdd926c9eb57f7365c76d029ecfd45907dfd1cf39b817a0963af92b85f040
MD5 623247826c38ec20e91a2e582f68d05e
SHA1 b04d20dc85adc5336885dc9c1b8ab1dd3fde6575
SHA512 f5a1b0c3e0a8ec5703b670880400755de825c995233440689defdfb4e1aaf0fe3508c7612a16de35e653616f2498c402add91d181d1bbf5a6610a339b8f21569
TLSH
T15741081A1BE50946B1B66B07DDF3C022AA33FC936874DF4C1385831A476BD01686CBAA
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5743.tmp

Path C:\Windows\Installer\MSI5743.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{43F3B726-5FA7-4093-A45D-DC88E2422F40}\.ba\thm.xml
Size 11KB
SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
MD5 302563a713b142ee41b59e3eeac53a90
SHA1 1340e90cc3c6c5fc19a7feb61d7779f4a4f0fdb5
SHA512 c9d4dfc20802bb542178300d1044bb94b35593b834ab0b50875a32953f890e48da456199128500e2c1fee26eaaf8c2c4fcaffb308b37914215f900cdd5c4cbc8
SSDEEP 96:eCdhlFGZRd4UyAi0Rz96zYFGiRdl6dXXdT9gUoLNEmRG3QBinRFRK03K8+GGI9ki:eCSfiozEW/A
TLSH
T1A2325BA986DE7C00D232E711ABF271D6AF126862C4C46E58F94C39BB4FE25406C7727D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{5F4A084F-4BFF-468C-B49E-95E51B646B07}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{5F4A084F-4BFF-468C-B49E-95E51B646B07}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_8.0.25_win_x64.msi

Path C:\Windows\Temp\{5F4A084F-4BFF-468C-B49E-95E51B646B07}\dotnet_host_8.0.25_win_x64.msi
Size 708KB
SHA256 359902b20d0ea3bbfdbf931888ee61c367b6a6755a4ae40a47a357fec4654be3
MD5 8d5bda7d228cc3372feee1e9cc046af9
SHA1 716028583f7af855e1836e813f7cd6f7543653a8
SHA512 75a68247b4ed87b3c97554c421b806f8135553dfb2ab5b43055fd9ce8fb99080e99b395807693a7d4c4e6d05c375489810e76f33a2d3a4a7283d434cd414203d
SSDEEP 12288:Iyv/7gAgV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:IyvzgzXdc3/7Rin+s
TLSH
T14DF49D237D80803AD9BA0D71853AD7B16F3DBD204A64899B5380B91DDDF11C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_hostfxr_8.0.25_win_x64.msi

Path C:\Windows\Temp\{5F4A084F-4BFF-468C-B49E-95E51B646B07}\dotnet_hostfxr_8.0.25_win_x64.msi
Size 776KB
SHA256 3fdb418ff39aeafac3ea8775584a4055fe8bacad4f468a696f1c093d153d6411
MD5 c75c3b6d5bb4002d5c02c02cbedd6b62
SHA1 4279c7ae0155159c0435c94982778c897eececb4
SHA512 8074ede8b35fc2ba1a1eadbba6a567f636d91a33829e4bbbf4d7e08c1d8bc884a186930d96e71ea8e7f00155162c04a1f78820214a0d802e7297d3650a8e6041
SSDEEP 12288:tln3ZcMv8Ow0hV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:Pn3D0OxXdc3/7Rin+s
TLSH
T1C3F4AD137D80803AD9BA0D719539D7B16F3EBD204A64899B6380B91DDDF11C0AF36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_8.0.25_win_x64.msi

Path C:\Windows\Temp\{5F4A084F-4BFF-468C-B49E-95E51B646B07}\dotnet_runtime_8.0.25_win_x64.msi
Size 26.3MB
SHA256 79950240a01eb0cf23a8ece02389ace4ee0183eda747f34efd9dc487a1595a73
MD5 4533b52e9349486b966319eb50637cbb
SHA1 5c526dca4411b93bd29fa09e3e334780497569e0
SHA512 6fa6380de692ae6dfb3363e06d27a241a8f9ea9627d4f9089e06f1532055d32bdc68a685069543eb931079764dcf4e498f271445892beb4cbe5d9db09477a969
SSDEEP 786432:TEy1MzgTBksYHtQ3vnEqTvke5MmNFd9Yn:L16yDYHtL6fNFT2
TLSH
T1EB57332BBD80C9BAC87A5C36893BD316163DED01422498076764B61EEDF21E05F72BD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop_runtime_8.0.25_win_x64.msi

Path C:\Windows\Temp\{5F4A084F-4BFF-468C-B49E-95E51B646B07}\windowsdesktop_runtime_8.0.25_win_x64.msi
Size 29.0MB
SHA256 0592872dd56a7c9d74931c5154aa12d62bb7ac34795ec4b720f7807fe1d2ba14
MD5 04079664e03802a4133ac317b228a51a
SHA1 f32d26f87b709bda9ceba07498d13db87f336e6f
SHA512 461de5a0ec16e7d622f2d8a3268efd5ad96b8d271928ac438fd7d71fad04f5cc60fb9e642b2b2a74710fcf8e86689fe9d5a1d7da0d926d6e60000757280d7af2
SSDEEP 786432:bQuv7PFK7UNMqvqXeFcUykaRRmQQvoU9mRKfW3SdM5zNDREiG0:UW7PkQNMqvc++gAaW3SdM5zNDii
TLSH
T153673307BD818137C8BE1D32813BA7758F3A4C10AA568A276395B51DEFF11D05F72AE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-8.0.25-win-x64.exe

Path C:\Windows\Temp\{8A2B9051-F893-42A7-9482-46BCCA07DEF4}\.cr\windowsdesktop-runtime-8.0.25-win-x64.exe
Size 608KB
SHA256 16e2ec97ffb0380fc61d48a1c52312e02aad800850fb921886bd2eeec44c6c16
MD5 83e80644c5ae40593159c1e73d0b5db3
SHA1 c5f227f3ed1378bd1d91881b249cecce26115dd1
SHA512 2cdbb9a119305820e852a0aa15be9af6e4733060244ce26c8b0d4ea893c471dd288c6d9dc6c2248801f641267f4cfa29f18d679e4b8b201077bdb0c59247b56d
SSDEEP 12288:RmEsd9PZfePv3xl7ft7V+6uC+zd5qLl/w3wGkWauQZrDnmB:Rm39PZfePv3r7fm6t+jqpo3TQhW
TLSH
T1A8D48D32A5614032E7F10673BD28D6303E3CE328275488AAE7D4AD1D7EA84D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{AE89EEF8-E530-4C15-836B-FCB0CCA30167}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-413-0x0000000002E30000-0x0000000002E94000-memory.dmp

Download

memory/916-885-0x0000000002D60000-0x0000000002DC4000-memory.dmp

Download

memory/1864-640-0x0000000002DD0000-0x0000000002E34000-memory.dmp

Download

memory/1864-928-0x0000000002DD0000-0x0000000002E34000-memory.dmp

Download

memory/2084-783-0x00000000008B0000-0x0000000000914000-memory.dmp

Download

memory/2084-925-0x00000000008B0000-0x0000000000914000-memory.dmp

Download

memory/2156-865-0x0000000002770000-0x00000000027D4000-memory.dmp

Download

memory/2436-760-0x0000000002FA0000-0x0000000003004000-memory.dmp

Download

memory/2548-784-0x0000000002980000-0x00000000029E4000-memory.dmp

Download

memory/2548-924-0x0000000002980000-0x00000000029E4000-memory.dmp

Download

memory/3100-891-0x0000000000650000-0x00000000006C6000-memory.dmp

Download

memory/3100-892-0x0000000002DE0000-0x0000000002E44000-memory.dmp

Download

memory/3292-930-0x0000000001550000-0x00000000015B4000-memory.dmp

Download

memory/3292-368-0x0000000001550000-0x00000000015B4000-memory.dmp

Download

memory/3576-348-0x0000000002D20000-0x0000000002D84000-memory.dmp

Download

memory/3608-923-0x0000000001500000-0x0000000001564000-memory.dmp

Download

memory/4072-843-0x0000000000A20000-0x0000000000A84000-memory.dmp

Download

memory/4208-322-0x00000000011F0000-0x0000000001254000-memory.dmp

Download

memory/4328-886-0x0000000000650000-0x00000000006C6000-memory.dmp

Download

memory/4328-887-0x0000000001260000-0x00000000012C4000-memory.dmp

Download

memory/4460-889-0x0000000000650000-0x00000000006C6000-memory.dmp

Download

memory/4460-890-0x0000000000FF0000-0x0000000001054000-memory.dmp

Download

memory/4676-367-0x00000000013E0000-0x0000000001444000-memory.dmp

Download

memory/4676-931-0x00000000013E0000-0x0000000001444000-memory.dmp

Download

memory/5324-91-0x0000000001820000-0x0000000001884000-memory.dmp

Download

memory/5416-915-0x0000000002340000-0x00000000023A4000-memory.dmp

Download

memory/5716-781-0x00000269ED940000-0x00000269ED94C000-memory.dmp

Download

memory/5716-782-0x00000269EDB10000-0x00000269EDBFA000-memory.dmp

Download