Overview

overview

7

Static

static

1

FSLabs Con...52.rar

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    681s
  • max time network
    688s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 10:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FSLabs Control Center-2020-2024_2.0.1.152.rar
  • Size 102.7MB
  • Sample260808-mapfesdn21
  • SHA256 a5510c6d0745f01b6864c82f150a5485c9513d0de58eda3b1cbfd6b0b2fa2970
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutioninstallerpersistenceransomware

Malware Config

Signatures

  • Executes dropped EXE 44 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 15 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 55 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\FSLabs Control Center-2020-2024_2.0.1.152.rar"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:5832
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:256
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd1ca3c728,0x7ffd1ca3c734,0x7ffd1ca3c740
      2⤵
        PID:3260
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,7017701128238134422,6174360749238581885,262144 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
        2⤵
          PID:1932
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1504,i,7829694488661837543,11276299542048729662,524288 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
          2⤵
          • System Time Discovery
          PID:5568
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,12162807535440806741,9715881553509999342,524288 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
          2⤵
            PID:4760
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,13478745412168254782,15560307442535969548,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
            2⤵
              PID:4796
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,8370364450573620394,15390438423474709926,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
              2⤵
                PID:5328
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4632,i,1720492372499417615,17828542588091369659,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
                2⤵
                  PID:4672
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,11549528849625270365,5445496974520216131,524288 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
                  2⤵
                    PID:1952
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,8068420060615082394,9481382401565234409,524288 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
                    2⤵
                      PID:5472
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5512,i,16187682069874498956,13740756316267524208,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
                      2⤵
                        PID:960
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5524,i,18059215056430952129,16519084093874362889,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
                        2⤵
                          PID:5884
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5812,i,10040831288702631273,7455556428733263820,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
                          2⤵
                            PID:1356
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5416,i,9477501360832679146,467843378104520693,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
                            2⤵
                              PID:2544
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5592,i,7644728996262824976,12016145412271302594,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
                              2⤵
                                PID:5900
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5688,i,7289833337945675706,3087592779949956107,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
                                2⤵
                                  PID:4292
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5564,i,895711466676203244,1319101303024499537,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
                                  2⤵
                                    PID:1576
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5700,i,6639682368638448159,13011114778316148181,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
                                    2⤵
                                      PID:2856
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5440,i,1572061880671139124,16521862607021132729,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
                                      2⤵
                                        PID:5244
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5564,i,3997576871309557554,4679147109197240100,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
                                        2⤵
                                          PID:3908
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5768,i,12773895608646221182,16894617901071697904,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
                                          2⤵
                                            PID:3228
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,14467688159687698262,420557093000538821,524288 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
                                            2⤵
                                              PID:4956
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,1169333145575332568,7332179755803618029,524288 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
                                              2⤵
                                                PID:4492
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3716,i,6740300793328943800,4210309168237388192,524288 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
                                                2⤵
                                                  PID:3576
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3956,i,16199127202365185667,11389216322405903495,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:9
                                                  2⤵
                                                    PID:4572
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3396,i,1540130467414776540,6240743082566582966,2097152 --field-trial-handle=1976,i,3525508006962420080,887602400455376357,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
                                                    2⤵
                                                      PID:4504
                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                    1⤵
                                                      PID:4472
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                      1⤵
                                                        PID:5220
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                        1⤵
                                                        • Modifies data under HKEY_USERS
                                                        PID:3844
                                                      • C:\Windows\System32\rundll32.exe
                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                        1⤵
                                                          PID:4512
                                                        • C:\Users\Admin\Desktop\New folder\FSLabs Control Center v2.0.1.152.exe
                                                          "C:\Users\Admin\Desktop\New folder\FSLabs Control Center v2.0.1.152.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4308
                                                          • C:\Users\Admin\AppData\Local\Temp\is-NOPN5.tmp\FSLabs Control Center v2.0.1.152.tmp
                                                            "C:\Users\Admin\AppData\Local\Temp\is-NOPN5.tmp\FSLabs Control Center v2.0.1.152.tmp" /SL5="$402B2,100321184,822272,C:\Users\Admin\Desktop\New folder\FSLabs Control Center v2.0.1.152.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Enumerates connected drives
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1872
                                                            • C:\Program Files\dotnet\dotnet.exe
                                                              "C:\Program Files\dotnet\dotnet.exe" --list-runtimes
                                                              3⤵
                                                              • System Time Discovery
                                                              PID:3720
                                                            • C:\Program Files\dotnet\dotnet.exe
                                                              "C:\Program Files\dotnet\dotnet.exe" --list-runtimes
                                                              3⤵
                                                              • System Time Discovery
                                                              PID:5836
                                                            • C:\Program Files\dotnet\dotnet.exe
                                                              "C:\Program Files\dotnet\dotnet.exe" --list-runtimes
                                                              3⤵
                                                              • System Time Discovery
                                                              PID:1392
                                                            • C:\Program Files\dotnet\dotnet.exe
                                                              "C:\Program Files\dotnet\dotnet.exe" --list-runtimes
                                                              3⤵
                                                              • System Time Discovery
                                                              PID:3908
                                                            • C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\dotnet60_x64.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\dotnet60_x64.exe" /lcid 1033 /passive /norestart
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3340
                                                              • C:\Windows\Temp\{C6105550-25C9-489F-ABDB-967212C13570}\.cr\dotnet60_x64.exe
                                                                "C:\Windows\Temp\{C6105550-25C9-489F-ABDB-967212C13570}\.cr\dotnet60_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\dotnet60_x64.exe" -burn.filehandle.attached=600 -burn.filehandle.self=696 /lcid 1033 /passive /norestart
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5344
                                                                • C:\Windows\Temp\{8C3E20AC-1239-485B-8ADC-3E0D90B8BA77}\.be\dotnet-runtime-6.0.36-win-x64.exe
                                                                  "C:\Windows\Temp\{8C3E20AC-1239-485B-8ADC-3E0D90B8BA77}\.be\dotnet-runtime-6.0.36-win-x64.exe" -q -burn.elevated BurnPipe.{5BFA72F7-AA1C-44ED-B1D9-926C24267E2D} {AD0CE4C0-BAD0-480A-8DD3-C1B51F3776D2} 5344
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  • System Location Discovery: System Language Discovery
                                                                  • System Time Discovery
                                                                  • Modifies registry class
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5880
                                                            • C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\dotnet60desktop_x64.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\dotnet60desktop_x64.exe" /lcid 1033 /passive /norestart
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4512
                                                              • C:\Windows\Temp\{507A3DE6-6DEA-4D7B-9F1F-2EB3298B849C}\.cr\dotnet60desktop_x64.exe
                                                                "C:\Windows\Temp\{507A3DE6-6DEA-4D7B-9F1F-2EB3298B849C}\.cr\dotnet60desktop_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\dotnet60desktop_x64.exe" -burn.filehandle.attached=596 -burn.filehandle.self=696 /lcid 1033 /passive /norestart
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:3060
                                                                • C:\Windows\Temp\{10A77776-5553-4384-8932-6FD640D35E4E}\.be\windowsdesktop-runtime-6.0.36-win-x64.exe
                                                                  "C:\Windows\Temp\{10A77776-5553-4384-8932-6FD640D35E4E}\.be\windowsdesktop-runtime-6.0.36-win-x64.exe" -q -burn.elevated BurnPipe.{AA9F7C14-58F2-4ED0-AAF7-D43F03EF283A} {AA48F5BA-6FC1-43EA-9A11-6B438DAC6A8F} 3060
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  PID:1580
                                                                  • C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
                                                                    "C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0532b8f2-12d7-43de-95fc-7b87006758a8} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{CA7318EB-0B2A-4789-B2EF-455AC598FBF1} {4556CA36-DA4C-4FC0-836A-87EF1ECD69CE} 1580
                                                                    6⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4892
                                                                    • C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
                                                                      "C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0532b8f2-12d7-43de-95fc-7b87006758a8} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{CA7318EB-0B2A-4789-B2EF-455AC598FBF1} {4556CA36-DA4C-4FC0-836A-87EF1ECD69CE} 1580
                                                                      7⤵
                                                                      • Loads dropped DLL
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1516
                                                                      • C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
                                                                        "C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -q -burn.elevated BurnPipe.{104373CC-B209-4BCF-943C-A4BC22335609} {FE9399F4-A350-4C5E-A4FB-A14DFC6035D2} 1516
                                                                        8⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5404
                                                            • C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\dotnet80_x64.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\dotnet80_x64.exe" /lcid 1033 /passive /norestart
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3984
                                                              • C:\Windows\Temp\{068F3856-7734-420C-97A2-D290F7CB9BD8}\.cr\dotnet80_x64.exe
                                                                "C:\Windows\Temp\{068F3856-7734-420C-97A2-D290F7CB9BD8}\.cr\dotnet80_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\dotnet80_x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /lcid 1033 /passive /norestart
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:1496
                                                                • C:\Windows\Temp\{AC188E14-B51B-4BBA-8095-5DE766DEE051}\.be\dotnet-runtime-8.0.19-win-x64.exe
                                                                  "C:\Windows\Temp\{AC188E14-B51B-4BBA-8095-5DE766DEE051}\.be\dotnet-runtime-8.0.19-win-x64.exe" -q -burn.elevated BurnPipe.{E3DB71E2-21DC-49D4-A721-1489A2BEC34B} {2391D4EE-7A3D-40F1-9A67-204AEA64C139} 1496
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  • System Location Discovery: System Language Discovery
                                                                  • System Time Discovery
                                                                  • Modifies registry class
                                                                  PID:2204
                                                            • C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\dotnet80desktop_x64.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\dotnet80desktop_x64.exe" /lcid 1033 /passive /norestart
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5496
                                                              • C:\Windows\Temp\{65293C3D-C2B3-47C8-A6EA-B092E6D81C4C}\.cr\dotnet80desktop_x64.exe
                                                                "C:\Windows\Temp\{65293C3D-C2B3-47C8-A6EA-B092E6D81C4C}\.cr\dotnet80desktop_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\dotnet80desktop_x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /lcid 1033 /passive /norestart
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:4880
                                                                • C:\Windows\Temp\{1057B9C8-C3A9-4F1F-9880-FA3B6353B5AE}\.be\windowsdesktop-runtime-8.0.19-win-x64.exe
                                                                  "C:\Windows\Temp\{1057B9C8-C3A9-4F1F-9880-FA3B6353B5AE}\.be\windowsdesktop-runtime-8.0.19-win-x64.exe" -q -burn.elevated BurnPipe.{9B09E209-D8BB-47B8-AC64-90877CBEE483} {F949727F-890E-4FEE-A196-08E34BADB2C9} 4880
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  PID:1480
                                                                  • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                                                                    "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={6b2575e2-0248-44c3-93f3-2eba040331ed} -burn.filehandle.self=1108 -burn.embedded BurnPipe.{AC4EEB30-3C4F-4CAC-A023-671998F3FEA0} {441A77F8-3400-48DB-A730-1D2A3DC908D7} 1480
                                                                    6⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1696
                                                                    • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                                                                      "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 -uninstall -quiet -burn.related.upgrade -burn.ancestors={6b2575e2-0248-44c3-93f3-2eba040331ed} -burn.filehandle.self=1108 -burn.embedded BurnPipe.{AC4EEB30-3C4F-4CAC-A023-671998F3FEA0} {441A77F8-3400-48DB-A730-1D2A3DC908D7} 1480
                                                                      7⤵
                                                                      • Loads dropped DLL
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4532
                                                                      • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                                                                        "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{999B0067-CF1E-436B-A000-22D0C9FB1E17} {60D2E39E-DDBA-4C24-B67B-C3E6DF939737} 4532
                                                                        8⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry class
                                                                        PID:3892
                                                            • C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\vcredist2022_x64.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\vcredist2022_x64.exe" /passive /norestart
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:3212
                                                              • C:\Windows\Temp\{165A0E16-2818-43E8-8868-2E2FE000A44D}\.cr\vcredist2022_x64.exe
                                                                "C:\Windows\Temp\{165A0E16-2818-43E8-8868-2E2FE000A44D}\.cr\vcredist2022_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\vcredist2022_x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /passive /norestart
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:2100
                                                                • C:\Windows\Temp\{CCA636EE-ABAF-4143-97A4-3EE9FD5DD08F}\.be\VC_redist.x64.exe
                                                                  "C:\Windows\Temp\{CCA636EE-ABAF-4143-97A4-3EE9FD5DD08F}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{8D319821-5E42-4EEE-9B94-57A9A957F6AB} {1E3905FA-A17F-407B-AE2B-3C8DC776189B} 2100
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  PID:5252
                                                            • C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\_isetup\_setup64.tmp
                                                              helper 105 0x62C
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:3896
                                                            • C:\FlightSimLabs\ControlCenter\FSLControlCenter.exe
                                                              "C:\FlightSimLabs\ControlCenter\FSLControlCenter.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3712
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                "cmd.exe" /c powershell -Command "Get-MpPreference | Select-Object -ExpandProperty EnableControlledFolderAccess"
                                                                4⤵
                                                                • Executes a command shell one-liner
                                                                PID:4360
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -Command "Get-MpPreference | Select-Object -ExpandProperty EnableControlledFolderAccess"
                                                                  5⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5832
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                "cmd.exe" /c Get-NetFirewallProfile -Profile Domain,Private,Public | Select-Object -ExpandProperty Enabled
                                                                4⤵
                                                                • Executes a command shell one-liner
                                                                PID:2984
                                                        • C:\Windows\system32\msiexec.exe
                                                          C:\Windows\system32\msiexec.exe /V
                                                          1⤵
                                                          • Enumerates connected drives
                                                          • Drops file in System32 directory
                                                          • Drops file in Program Files directory
                                                          • Drops file in Windows directory
                                                          • Modifies data under HKEY_USERS
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2808
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 6AE7F500255071E79CA0904203E9AB9B
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1208
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding AFCC1E73EDBC13B881D1D772CD1B58E6
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4360
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 7CE4479AC00BACC7E7A904E5E7A207D4
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2752
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 845F77B1E20E2DC84FA24D08533C5B19
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3128
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding BFE6BDE258CB54C311ACF0E20FEA2D10
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4848
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding C114CA7F3F074011E3FCC9400277094D
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5388
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 6A8A17BF42E30E46245A8623515EEC0A
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3616
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding ADF320BA980F0B0975941B7FE42668FE
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2292
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 4633823F1CE947E9887D3F216A72DFA5
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1384
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 085B89599237C340DA0CA0EB0F96A17A
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5656
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding E216D3C20433F5A61CE8456E6DA96047
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4496
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 469077340DB1448E499F7F27D80FF6CF
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1796
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 2B9CF160CA52A33E02C3DBC66D5D36EA
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5400
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding A0E028C67025104C18896A73CBC26614
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4076
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 7EC3287F255343BCAC7767D67AA30047
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4992
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 7C7A0A43420CF2D68F372A56F885E411
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:6108
                                                        • C:\ProgramData\Package Cache\{9d3fc73f-1cf4-412c-a1c9-d2ad28ccbd62}\dotnet-runtime-6.0.36-win-x64.exe
                                                          "C:\ProgramData\Package Cache\{9d3fc73f-1cf4-412c-a1c9-d2ad28ccbd62}\dotnet-runtime-6.0.36-win-x64.exe" /burn.runonce
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • System Time Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5516
                                                          • C:\ProgramData\Package Cache\{9d3fc73f-1cf4-412c-a1c9-d2ad28ccbd62}\dotnet-runtime-6.0.36-win-x64.exe
                                                            "C:\ProgramData\Package Cache\{9d3fc73f-1cf4-412c-a1c9-d2ad28ccbd62}\dotnet-runtime-6.0.36-win-x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.36_(x64)_20260808111947.log" /lcid 1033
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • System Time Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1536
                                                            • C:\ProgramData\Package Cache\{9d3fc73f-1cf4-412c-a1c9-d2ad28ccbd62}\dotnet-runtime-6.0.36-win-x64.exe
                                                              "C:\ProgramData\Package Cache\{9d3fc73f-1cf4-412c-a1c9-d2ad28ccbd62}\dotnet-runtime-6.0.36-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{9d3fc73f-1cf4-412c-a1c9-d2ad28ccbd62}\dotnet-runtime-6.0.36-win-x64.exe" -burn.filehandle.attached=580 -burn.filehandle.self=600 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.36_(x64)_20260808111947.log" /lcid 1033
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • System Time Discovery
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4836
                                                              • C:\ProgramData\Package Cache\{9d3fc73f-1cf4-412c-a1c9-d2ad28ccbd62}\dotnet-runtime-6.0.36-win-x64.exe
                                                                "C:\ProgramData\Package Cache\{9d3fc73f-1cf4-412c-a1c9-d2ad28ccbd62}\dotnet-runtime-6.0.36-win-x64.exe" -q -burn.elevated BurnPipe.{B9AD9C34-26BD-4A6A-99A1-A9FCA7393CDF} {15A44CC5-F18F-4764-95ED-021CDBA6BA19} 4836
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • System Time Discovery
                                                                • Modifies registry class
                                                                PID:4732
                                                        • C:\ProgramData\Package Cache\{0532b8f2-12d7-43de-95fc-7b87006758a8}\windowsdesktop-runtime-6.0.36-win-x64.exe
                                                          "C:\ProgramData\Package Cache\{0532b8f2-12d7-43de-95fc-7b87006758a8}\windowsdesktop-runtime-6.0.36-win-x64.exe" /burn.runonce
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:964
                                                          • C:\ProgramData\Package Cache\{0532b8f2-12d7-43de-95fc-7b87006758a8}\windowsdesktop-runtime-6.0.36-win-x64.exe
                                                            "C:\ProgramData\Package Cache\{0532b8f2-12d7-43de-95fc-7b87006758a8}\windowsdesktop-runtime-6.0.36-win-x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.36_(x64)_20260808112001.log" /lcid 1033
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5944
                                                            • C:\ProgramData\Package Cache\{0532b8f2-12d7-43de-95fc-7b87006758a8}\windowsdesktop-runtime-6.0.36-win-x64.exe
                                                              "C:\ProgramData\Package Cache\{0532b8f2-12d7-43de-95fc-7b87006758a8}\windowsdesktop-runtime-6.0.36-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0532b8f2-12d7-43de-95fc-7b87006758a8}\windowsdesktop-runtime-6.0.36-win-x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.36_(x64)_20260808112001.log" /lcid 1033
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious use of FindShellTrayWindow
                                                              PID:4884
                                                              • C:\ProgramData\Package Cache\{0532b8f2-12d7-43de-95fc-7b87006758a8}\windowsdesktop-runtime-6.0.36-win-x64.exe
                                                                "C:\ProgramData\Package Cache\{0532b8f2-12d7-43de-95fc-7b87006758a8}\windowsdesktop-runtime-6.0.36-win-x64.exe" -q -burn.elevated BurnPipe.{0D87BE5D-A068-49E7-91D6-64A9F0900363} {39A02600-7129-4A02-818B-6A4102E16D1F} 4884
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry class
                                                                PID:4596
                                                                • C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
                                                                  "C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0532b8f2-12d7-43de-95fc-7b87006758a8} -burn.filehandle.self=960 -burn.embedded BurnPipe.{EA8D88ED-0118-41B7-A47E-469163E2ED45} {DBA2ED67-B54D-4FAF-9A24-BB1DDF554DAA} 4596
                                                                  5⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4952
                                                                  • C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
                                                                    "C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0532b8f2-12d7-43de-95fc-7b87006758a8} -burn.filehandle.self=960 -burn.embedded BurnPipe.{EA8D88ED-0118-41B7-A47E-469163E2ED45} {DBA2ED67-B54D-4FAF-9A24-BB1DDF554DAA} 4596
                                                                    6⤵
                                                                    • Loads dropped DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4948
                                                                    • C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
                                                                      "C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -q -burn.elevated BurnPipe.{64EEDF0F-A41C-49FD-9ED4-8EE0FF75DD8E} {A0ECAEB8-3B28-4639-A927-81ADE04E48FF} 4948
                                                                      7⤵
                                                                      • Modifies registry class
                                                                      PID:5412
                                                        • C:\ProgramData\Package Cache\{04f2ebb7-4f99-4441-bcc6-f5c28c103f3f}\dotnet-runtime-8.0.19-win-x64.exe
                                                          "C:\ProgramData\Package Cache\{04f2ebb7-4f99-4441-bcc6-f5c28c103f3f}\dotnet-runtime-8.0.19-win-x64.exe" /burn.runonce
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • System Time Discovery
                                                          PID:1468
                                                          • C:\ProgramData\Package Cache\{04f2ebb7-4f99-4441-bcc6-f5c28c103f3f}\dotnet-runtime-8.0.19-win-x64.exe
                                                            "C:\ProgramData\Package Cache\{04f2ebb7-4f99-4441-bcc6-f5c28c103f3f}\dotnet-runtime-8.0.19-win-x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_8.0.19_(x64)_20260808112026.log" /lcid 1033
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • System Time Discovery
                                                            PID:1980
                                                            • C:\ProgramData\Package Cache\{04f2ebb7-4f99-4441-bcc6-f5c28c103f3f}\dotnet-runtime-8.0.19-win-x64.exe
                                                              "C:\ProgramData\Package Cache\{04f2ebb7-4f99-4441-bcc6-f5c28c103f3f}\dotnet-runtime-8.0.19-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{04f2ebb7-4f99-4441-bcc6-f5c28c103f3f}\dotnet-runtime-8.0.19-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_8.0.19_(x64)_20260808112026.log" /lcid 1033
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • System Time Discovery
                                                              • Suspicious use of FindShellTrayWindow
                                                              PID:236
                                                              • C:\ProgramData\Package Cache\{04f2ebb7-4f99-4441-bcc6-f5c28c103f3f}\dotnet-runtime-8.0.19-win-x64.exe
                                                                "C:\ProgramData\Package Cache\{04f2ebb7-4f99-4441-bcc6-f5c28c103f3f}\dotnet-runtime-8.0.19-win-x64.exe" -q -burn.elevated BurnPipe.{B6B92E4D-FA54-44AC-B891-5705DCF8E0CC} {FBAF180A-DEB3-4CAA-ADC9-077FEDAB6446} 236
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • System Location Discovery: System Language Discovery
                                                                • System Time Discovery
                                                                • Modifies registry class
                                                                PID:4116
                                                        • C:\ProgramData\Package Cache\{6b2575e2-0248-44c3-93f3-2eba040331ed}\windowsdesktop-runtime-8.0.19-win-x64.exe
                                                          "C:\ProgramData\Package Cache\{6b2575e2-0248-44c3-93f3-2eba040331ed}\windowsdesktop-runtime-8.0.19-win-x64.exe" /burn.runonce
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1308
                                                          • C:\ProgramData\Package Cache\{6b2575e2-0248-44c3-93f3-2eba040331ed}\windowsdesktop-runtime-8.0.19-win-x64.exe
                                                            "C:\ProgramData\Package Cache\{6b2575e2-0248-44c3-93f3-2eba040331ed}\windowsdesktop-runtime-8.0.19-win-x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.19_(x64)_20260808112035.log" /lcid 1033
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:620
                                                            • C:\ProgramData\Package Cache\{6b2575e2-0248-44c3-93f3-2eba040331ed}\windowsdesktop-runtime-8.0.19-win-x64.exe
                                                              "C:\ProgramData\Package Cache\{6b2575e2-0248-44c3-93f3-2eba040331ed}\windowsdesktop-runtime-8.0.19-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{6b2575e2-0248-44c3-93f3-2eba040331ed}\windowsdesktop-runtime-8.0.19-win-x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=584 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.19_(x64)_20260808112035.log" /lcid 1033
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of FindShellTrayWindow
                                                              PID:936
                                                              • C:\ProgramData\Package Cache\{6b2575e2-0248-44c3-93f3-2eba040331ed}\windowsdesktop-runtime-8.0.19-win-x64.exe
                                                                "C:\ProgramData\Package Cache\{6b2575e2-0248-44c3-93f3-2eba040331ed}\windowsdesktop-runtime-8.0.19-win-x64.exe" -q -burn.elevated BurnPipe.{27B191A3-0AC4-4CA1-AC69-EFF4CFC58132} {4DC7F1AB-CB3E-47FD-9AE7-2565698A6033} 936
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry class
                                                                PID:1052
                                                                • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                                                                  "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={6b2575e2-0248-44c3-93f3-2eba040331ed} -burn.filehandle.self=964 -burn.embedded BurnPipe.{73E47979-0C09-4B1B-B846-1305849ECEAA} {7D24E73D-D808-4E8E-83DD-9CBA9A67BE40} 1052
                                                                  5⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:700
                                                                  • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                                                                    "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 -uninstall -quiet -burn.related.upgrade -burn.ancestors={6b2575e2-0248-44c3-93f3-2eba040331ed} -burn.filehandle.self=964 -burn.embedded BurnPipe.{73E47979-0C09-4B1B-B846-1305849ECEAA} {7D24E73D-D808-4E8E-83DD-9CBA9A67BE40} 1052
                                                                    6⤵
                                                                    • Loads dropped DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4472
                                                                    • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                                                                      "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{BCADCCA1-83DB-4D2E-8E39-DCBF3A912552} {52B63693-AC9B-4669-82DB-7A987FE7DB17} 4472
                                                                      7⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5784
                                                        • C:\Windows\system32\vssvc.exe
                                                          C:\Windows\system32\vssvc.exe
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          PID:4768
                                                        • C:\Windows\system32\srtasks.exe
                                                          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                          1⤵
                                                            PID:3384
                                                          • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                                            "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4468
                                                            • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                                              "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260808112055.log"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1196
                                                              • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                                                "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260808112055.log"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:628
                                                                • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                                                  "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9C0E1E45-0EBD-43B2-A01B-1BEBE393ED26} {72EBBD75-A2C3-4D43-AE77-75DEC862BF2C} 628
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  PID:5760
                                                                  • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1016 -burn.embedded BurnPipe.{BAD9A821-3CE6-4A03-A67E-A8E06FA218CB} {8F6C49CB-7A9A-4F3C-81FB-B3BDD6BD06E5} 5760
                                                                    5⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1100
                                                                    • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1016 -burn.embedded BurnPipe.{BAD9A821-3CE6-4A03-A67E-A8E06FA218CB} {8F6C49CB-7A9A-4F3C-81FB-B3BDD6BD06E5} 5760
                                                                      6⤵
                                                                      • Loads dropped DLL
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2828
                                                                      • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{ED0F3593-482D-4A36-B827-806ADD404F22} {F724326C-EB8E-496E-969D-DF11CB338642} 2828
                                                                        7⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:3780
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                            1⤵
                                                              PID:1812
                                                            • C:\Windows\system32\NOTEPAD.EXE
                                                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New folder\README.txt
                                                              1⤵
                                                                PID:5400
                                                              • C:\Windows\System32\SecurityHealthHost.exe
                                                                \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                1⤵
                                                                  PID:4168
                                                                • C:\Windows\System32\DataExchangeHost.exe
                                                                  C:\Windows\System32\DataExchangeHost.exe -Embedding
                                                                  1⤵
                                                                    PID:2376
                                                                  • C:\FlightSimLabs\ControlCenter\FSLControlCenter.exe
                                                                    "C:\FlightSimLabs\ControlCenter\FSLControlCenter.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:2672
                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                      "cmd.exe" /c powershell -Command "Get-MpPreference | Select-Object -ExpandProperty EnableControlledFolderAccess"
                                                                      2⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:2892
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell -Command "Get-MpPreference | Select-Object -ExpandProperty EnableControlledFolderAccess"
                                                                        3⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:3624
                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                      "cmd.exe" /c Get-NetFirewallProfile -Profile Domain,Private,Public | Select-Object -ExpandProperty Enabled
                                                                      2⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:3076
                                                                  • C:\FlightSimLabs\ControlCenter\FSLControlCenter.exe
                                                                    "C:\FlightSimLabs\ControlCenter\FSLControlCenter.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5076
                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                      "cmd.exe" /c powershell -Command "Get-MpPreference | Select-Object -ExpandProperty EnableControlledFolderAccess"
                                                                      2⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:3444
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell -Command "Get-MpPreference | Select-Object -ExpandProperty EnableControlledFolderAccess"
                                                                        3⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:2644
                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                      "cmd.exe" /c Get-NetFirewallProfile -Profile Domain,Private,Public | Select-Object -ExpandProperty Enabled
                                                                      2⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:5424
                                                                  • C:\FlightSimLabs\ControlCenter\unins000.exe
                                                                    "C:\FlightSimLabs\ControlCenter\unins000.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3556
                                                                    • C:\Users\Admin\AppData\Local\Temp\iu-14D2N.tmp\_unins.tmp
                                                                      "C:\Users\Admin\AppData\Local\Temp\iu-14D2N.tmp\_unins.tmp" /SECONDPHASE="C:\FlightSimLabs\ControlCenter\unins000.exe" /FIRSTPHASEWND=$A0294
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1736
                                                                  • C:\FlightSimLabs\ControlCenter\FSLControlCenter.exe
                                                                    "C:\FlightSimLabs\ControlCenter\FSLControlCenter.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:3692
                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                      "cmd.exe" /c powershell -Command "Get-MpPreference | Select-Object -ExpandProperty EnableControlledFolderAccess"
                                                                      2⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:3020
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell -Command "Get-MpPreference | Select-Object -ExpandProperty EnableControlledFolderAccess"
                                                                        3⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:6092
                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                      "cmd.exe" /c Get-NetFirewallProfile -Profile Domain,Private,Public | Select-Object -ExpandProperty Enabled
                                                                      2⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:4184

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v16

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        e5b60ad.rbs
                                                                        • Path C:\Config.Msi\e5b60ad.rbs
                                                                        • Size 56KB
                                                                        • SHA256 83360057e2a1316eef3cd414027682cff2bc81fd79f9bd2da403d205fe7d9457
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b60b2.rbs
                                                                        • Path C:\Config.Msi\e5b60b2.rbs
                                                                        • Size 9KB
                                                                        • SHA256 e769484a979895d528b2915f51125280ded16faf2caa1c0cbbfd897306c8649b
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b60b6.rbs
                                                                        • Path C:\Config.Msi\e5b60b6.rbs
                                                                        • Size 3KB
                                                                        • SHA256 09f8f7535ee85e2a0b244136d5e2c0cc90cf8cfc1f87af257673de41989b7e8f
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        e5b60ba.rbs
                                                                        • Path C:\Config.Msi\e5b60ba.rbs
                                                                        • Size 11KB
                                                                        • SHA256 fc78fdc0a8276409bc7ff075a763818d05aef92b43327aba3d8bd5497e1bae39
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b60bf.rbs
                                                                        • Path C:\Config.Msi\e5b60bf.rbs
                                                                        • Size 8KB
                                                                        • SHA256 80e7004ffb9ce6303b94e4cbb5726c04409ed53d81018451cf4f2623d5d2d4da
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b60c1.rbf
                                                                        • Path C:\Config.Msi\e5b60c1.rbf
                                                                        • Size 3B
                                                                        • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        e5b60c4.rbs
                                                                        • Path C:\Config.Msi\e5b60c4.rbs
                                                                        • Size 4KB
                                                                        • SHA256 521e6d7f283b48fe782050d0898ab0478ecaecc623635937c63c3eab8294ba5e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b60c5.rbf
                                                                        • Path C:\Config.Msi\e5b60c5.rbf
                                                                        • Size 136KB
                                                                        • SHA256 d4401f5fbdea869bb7211b00594746ef6962b7dd2bfceb749889b920070c3f9f
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b60ca.rbs
                                                                        • Path C:\Config.Msi\e5b60ca.rbs
                                                                        • Size 87KB
                                                                        • SHA256 177a1e269b7c46661b74983b05676b850448d835f07706e85963bc7dd8e31ed9
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b60ce.rbs
                                                                        • Path C:\Config.Msi\e5b60ce.rbs
                                                                        • Size 132KB
                                                                        • SHA256 66575c6f387339967118d6aa7b353b3b1048d0ee5838699c80c6cacb13ccb4af
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b61eb.rbs
                                                                        • Path C:\Config.Msi\e5b61eb.rbs
                                                                        • Size 8KB
                                                                        • SHA256 b1b9977a1bef120701443705cd5246222533b71cc05f4b59c8f8b3bf38fa31e3
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b61ef.rbs
                                                                        • Path C:\Config.Msi\e5b61ef.rbs
                                                                        • Size 102KB
                                                                        • SHA256 f15ebddf39ed66ed504d0001c57cbf7072fb64130090bbd2bbb85232a93f746e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b62d3.rbs
                                                                        • Path C:\Config.Msi\e5b62d3.rbs
                                                                        • Size 48KB
                                                                        • SHA256 f72191b8c3d5b9a46456fa8c725df516bb4b110ab7a8aba8e55169951db655ff
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b62d8.rbs
                                                                        • Path C:\Config.Msi\e5b62d8.rbs
                                                                        • Size 9KB
                                                                        • SHA256 9e9acb464b21f8f8b2a890019d917f30362b5525b4dc820cd3cb8b1f407049bc
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b62dd.rbs
                                                                        • Path C:\Config.Msi\e5b62dd.rbs
                                                                        • Size 11KB
                                                                        • SHA256 3b56e0b07ccf2077d0f1fe43d481a889377242fd087e6f9d77a6d0a39b1dc248
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b62e3.rbs
                                                                        • Path C:\Config.Msi\e5b62e3.rbs
                                                                        • Size 8KB
                                                                        • SHA256 7430780a1c30cb87b2a4db330ba93b2e651c782d2b037d68987afd862ba0cddf
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b62e4.rbf
                                                                        • Path C:\Config.Msi\e5b62e4.rbf
                                                                        • Size 143KB
                                                                        • SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b62e9.rbs
                                                                        • Path C:\Config.Msi\e5b62e9.rbs
                                                                        • Size 87KB
                                                                        • SHA256 16023c78d7f9deda75ab556b0f378f033e7c054ad22d34f3cc67d9de24bd5fe2
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b62ed.rbs
                                                                        • Path C:\Config.Msi\e5b62ed.rbs
                                                                        • Size 132KB
                                                                        • SHA256 033967154e271dd59954f55bbe1261e39d72a2475d2615547fc5117f02bd9b74
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b640a.rbs
                                                                        • Path C:\Config.Msi\e5b640a.rbs
                                                                        • Size 8KB
                                                                        • SHA256 220cec40887aafdd4f1390c5cfe313de9bb3ec5a7ee82f7d21fa1004bd4f5cac
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b640e.rbs
                                                                        • Path C:\Config.Msi\e5b640e.rbs
                                                                        • Size 86KB
                                                                        • SHA256 b1edcd6f6bcac01468f11f50fd8c7885a95a526faec4e08115c65f769b56fcfe
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b64cc.rbs
                                                                        • Path C:\Config.Msi\e5b64cc.rbs
                                                                        • Size 19KB
                                                                        • SHA256 6dec22f7819b192bccebe51f5a6aefe9547945b86835e5804d9a415862615dda
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b64d8.rbs
                                                                        • Path C:\Config.Msi\e5b64d8.rbs
                                                                        • Size 19KB
                                                                        • SHA256 feb5b882fc053d8e082635b7bab833ebb52cbcc45a6f4e079991fff0683dc2d3
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b64df.rbs
                                                                        • Path C:\Config.Msi\e5b64df.rbs
                                                                        • Size 21KB
                                                                        • SHA256 2c7d570a804c7dd5cc79fd39a293ea276fce72368dab32ae79ef7e9b6ebc255f
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b64ee.rbs
                                                                        • Path C:\Config.Msi\e5b64ee.rbs
                                                                        • Size 21KB
                                                                        • SHA256 e463194192f39316c1ad5b56598ad5a46ac7c7b9640310d620e91214f4f9fabb
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        ThirdPartyNotices.txt
                                                                        • Path C:\Program Files\dotnet\ThirdPartyNotices.txt
                                                                        • Size 93KB
                                                                        • SHA256 1271701f435f7fe4aa81dc7e273ca80b6391b73580ee20b35a956052c95de4cf
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        ThirdPartyNotices.txt
                                                                        • Path C:\Program Files\dotnet\ThirdPartyNotices.txt
                                                                        • Size 78KB
                                                                        • SHA256 d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        state.rsm
                                                                        • Path C:\ProgramData\Package Cache\{9d3fc73f-1cf4-412c-a1c9-d2ad28ccbd62}\state.rsm
                                                                        • Size 936B
                                                                        • SHA256 0588113868a527913d5ac5957627559a222d0b33cb8fd7d2253c53f72d04fc52
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        BookmarkMergedSurfaceOrdering
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                        • Size 6B
                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        f_000005
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
                                                                        • Size 25KB
                                                                        • SHA256 8e5aa213cf6e2bee54875c0b066451f91b682bb9c56c004f49e92b9bb3dda243
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        the-real-index
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                        • Size 744B
                                                                        • SHA256 248967834feeddf64c146721432013039993dd5af8463cec1847eb9f40df2e33
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        messages.json
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                        • Size 593B
                                                                        • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        craw_background.js
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                        • Size 531KB
                                                                        • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        CURRENT
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                                                        • Size 16B
                                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        data_1
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
                                                                        • Size 264KB
                                                                        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        Network Persistent State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                        • Size 5KB
                                                                        • SHA256 981f9b4d78498d0278232e9d0a6d5df9ca1536933cc4fcbad1f387803b6b139e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        SCT Auditing Pending Reports
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                        • Size 2B
                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        TransportSecurity
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                        • Size 1KB
                                                                        • SHA256 e527018d08e9c331b38d7c23765828bb8612785e099165758b97c8a2830b5d4f
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                        • Size 12KB
                                                                        • SHA256 338bb1a33c4927a0da2019c4a43c58b29b61fb20db5723e926bb08b32f9ed53b
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Secure Preferences
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                        • Size 11KB
                                                                        • SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        the-real-index
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                        • Size 72B
                                                                        • SHA256 40fcfe6ecd0327034f5e69f0db3cb6bafe29a59e069394ac35a8414c476e7200
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        the-real-index~RFe5a5c5a.TMP
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a5c5a.TMP
                                                                        • Size 48B
                                                                        • SHA256 5a1da53c53ec096d74e0e39e5ef172c55254141ee5b5c33d4a3eea2c78651d1c
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        data_0
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_0
                                                                        • Size 8KB
                                                                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        data_2
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_2
                                                                        • Size 8KB
                                                                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        data_3
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_3
                                                                        • Size 8KB
                                                                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        MANIFEST-000001
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                                                                        • Size 41B
                                                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 4KB
                                                                        • SHA256 af3f3b9202e131a0e728074f88bbebc939ac6003fcc9d742c3d5639b08e5e7ca
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 124KB
                                                                        • SHA256 37a4ebbd9aa9c627c7331e9f8dced03546d3de7f8a7c141965ea7f041f26432b
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                        • Size 124KB
                                                                        • SHA256 b6d3e88489d2317a00dbfc713123130e57a7dc1061fda934f7a809212eab8679
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Microsoft_.NET_Runtime_-_6.0.36_(x64)_20260808111947_000_dotnet_runtime_6.0.36_win_x64.msi.log
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.36_(x64)_20260808111947_000_dotnet_runtime_6.0.36_win_x64.msi.log
                                                                        • Size 4KB
                                                                        • SHA256 ab6443acab38d6bbc61c18e9fc198df88732c9b7ef41cdf4a341e468e25d405d
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        Microsoft_.NET_Runtime_-_6.0.36_(x64)_20260808111947_001_dotnet_hostfxr_6.0.36_win_x64.msi.log
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.36_(x64)_20260808111947_001_dotnet_hostfxr_6.0.36_win_x64.msi.log
                                                                        • Size 2KB
                                                                        • SHA256 89d13c5439b8f8c5ed04157c30ecd76b306403043118e1a77aa9c094ac8bf49c
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        Microsoft_.NET_Runtime_-_6.0.36_(x64)_20260808111947_002_dotnet_host_6.0.36_win_x64.msi.log
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_6.0.36_(x64)_20260808111947_002_dotnet_host_6.0.36_win_x64.msi.log
                                                                        • Size 2KB
                                                                        • SHA256 69cdfe1ae978ab0823bd3965e50a532488a6f80ed8ed6b45cb001a5184efc744
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        __PSScriptPolicyTest_o4wpijuf.0z4.ps1
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o4wpijuf.0z4.ps1
                                                                        • Size 60B
                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        dotnet60_x64.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\dotnet60_x64.exe
                                                                        • Size 26.8MB
                                                                        • SHA256 6bdad7bc4c41fe93d4ae7b0312b1d017cfe369d28e7e2e421f5b675f9feefe84
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        dotnet80_x64.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\dotnet80_x64.exe
                                                                        • Size 27.2MB
                                                                        • SHA256 a5d25de54a86486ab9924ad585d579bd4aa5c8e15641d410c8b9360210fb5c1e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        isxdl.dll
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\isxdl.dll
                                                                        • Size 121KB
                                                                        • SHA256 b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        vcredist2022_x64.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-5N4NL.tmp\vcredist2022_x64.exe
                                                                        • Size 24.4MB
                                                                        • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        FSLabs Control Center v2.0.1.152.tmp
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-NOPN5.tmp\FSLabs Control Center v2.0.1.152.tmp
                                                                        • Size 3.3MB
                                                                        • SHA256 310f57ac97491858c6479d1975e140545c27f52be23f8012715b855793744c11
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        messages.json
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir256_2041981043\CRX_INSTALL\_locales\en\messages.json
                                                                        • Size 450B
                                                                        • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        CCLog.txt
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\CCLog.txt
                                                                        • Size 335B
                                                                        • SHA256 52f11e122393ab423724f01ad2acb8b9858cdd95247b0473be9a79e7fb2210d9
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        CCLog.txt
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\CCLog.txt
                                                                        • Size 1KB
                                                                        • SHA256 c6c65acd25e77e68e7018028b009b4e6d08bb14b7a5864d8feeb5bed5929863c
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        CCLog.txt
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\CCLog.txt
                                                                        • Size 2KB
                                                                        • SHA256 513515a77f2625ab032e3eca1d692dea256e9cb4dddfe9d9e2581dadd55c8a20
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        CCLog.txt
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\CCLog.txt
                                                                        • Size 3KB
                                                                        • SHA256 faa1b137f2922db202a06b5a758de318a83eeaf24a41a3b3727ed6cefb6952b8
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        CCLog.txt
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\CCLog.txt
                                                                        • Size 4KB
                                                                        • SHA256 6a060b50388d0d8cad7d6b6118636788ba0c967119766998ea922267593508af
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-DE035.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\Splashscreens\is-DE035.tmp
                                                                        • Size 1.3MB
                                                                        • SHA256 f8937f3cf0362ce9146297649abd0880f94e0734d7adb6b325af62b2cdf32029
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-3EFMJ.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-3EFMJ.tmp
                                                                        • Size 44KB
                                                                        • SHA256 55af6d7a87375405202af49d6d01ee074e99cb2b9836b368045df1c454153078
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-3U6SH.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-3U6SH.tmp
                                                                        • Size 24KB
                                                                        • SHA256 67857d2eaa52d9afc90eb0430ebf14d5968ea8a9d51e1d4edcf3e6f6d1014ec0
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-48PBN.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-48PBN.tmp
                                                                        • Size 45KB
                                                                        • SHA256 53faf9c63b593cd4e686816c35de9d91e6f9af9dd4fb7b5cbab8f3c663829384
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-58FRJ.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-58FRJ.tmp
                                                                        • Size 25KB
                                                                        • SHA256 c24a910b33d564d7c82554e33b5ff56fbdbe24699150da992721fd947028f9bf
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-59TNU.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-59TNU.tmp
                                                                        • Size 24KB
                                                                        • SHA256 86cb3ae6b321b15d00219009ac805f494003c84792b20008d9fb36ab673fbc26
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-5K16G.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-5K16G.tmp
                                                                        • Size 43KB
                                                                        • SHA256 7e3c792c9a5d8d6dc742b85c4d09b437ade0e6651470228181d2cc6cb7c67a61
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-64JQU.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-64JQU.tmp
                                                                        • Size 44KB
                                                                        • SHA256 b86f7d56277f046cab4a4840b7dbca0d634d1c76e00135804dd6fd0956549629
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-8PP0M.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-8PP0M.tmp
                                                                        • Size 25KB
                                                                        • SHA256 3bc01e858d5990bff18ced8aacb39b81e8daf3d35cb1f639ea46e04fcd6695a4
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-B2HBD.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-B2HBD.tmp
                                                                        • Size 10KB
                                                                        • SHA256 2be7d0d827770de4c185558ed27010e5b6b543f9fea1ad4fcf879367180c3638
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-BNHP6.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-BNHP6.tmp
                                                                        • Size 45KB
                                                                        • SHA256 7c62351552866d5f25fbb75e9c4791fe518b8d772da1b57b9d8a3307174fb80d
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-CEBL6.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-CEBL6.tmp
                                                                        • Size 43KB
                                                                        • SHA256 3e0941384debde9a751b638aeecb702503cbccdfdc96db6099bd826779a8170a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-CGU4L.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-CGU4L.tmp
                                                                        • Size 24KB
                                                                        • SHA256 abfac3e7159d1cb7e03c6eeddb1ca269fd10937f774fc9974a391c9aecf99f0f
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-CSR50.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-CSR50.tmp
                                                                        • Size 24KB
                                                                        • SHA256 96ae6cce7308574f315446c1175bfa01d097a9157b4caff743623896be8be700
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-FJAQP.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-FJAQP.tmp
                                                                        • Size 24KB
                                                                        • SHA256 214bfb69281b8865f4a16eaf7240026a49075548c9783e68e1d8ed2dce7062bb
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-H8TOS.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-H8TOS.tmp
                                                                        • Size 24KB
                                                                        • SHA256 202b18b289b5e10a2c9aa27cfa93b9b52ea9572028b1891d7c61e295f7bd519a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-HGT64.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-HGT64.tmp
                                                                        • Size 24KB
                                                                        • SHA256 d3151fd39f86c7689c2ba63961c6940a79bb836bd3769aa293feb595f3bf323f
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-IJIPE.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-IJIPE.tmp
                                                                        • Size 24KB
                                                                        • SHA256 27e01ef8a3b9363441f3fd6a4c119c6ebc85377d05dd6b3976455f1493aaaf1e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-LFLC8.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-LFLC8.tmp
                                                                        • Size 23KB
                                                                        • SHA256 8b4da13409502bad9847ebfa735ee9254f1e78e521281889ec24e2e6a592c97f
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-PG8TK.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-PG8TK.tmp
                                                                        • Size 25KB
                                                                        • SHA256 5626bda4bd2d3724934cd2df440c5552877b2471524167f0fa7a91609afa24d1
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-SOM4O.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-SOM4O.tmp
                                                                        • Size 42KB
                                                                        • SHA256 0e2bf65a5127feac1ea42c82e06aa3578acb5b220adca70dac11a4c8bf95fa46
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        is-VIBO3.tmp
                                                                        • Path C:\Users\Admin\AppData\Roaming\FlightSimLabs\bin\PackageImages\is-VIBO3.tmp
                                                                        • Size 25KB
                                                                        • SHA256 dcad1425a8023f413a592b474ee52755502624cb854862dc2a3cd4e391814d4e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        MSI686B.tmp
                                                                        • Path C:\Windows\Installer\MSI686B.tmp
                                                                        • Size 219KB
                                                                        • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        MSI86DB.tmp
                                                                        • Path C:\Windows\Installer\MSI86DB.tmp
                                                                        • Size 225KB
                                                                        • SHA256 3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b60cb.msi
                                                                        • Path C:\Windows\Installer\e5b60cb.msi
                                                                        • Size 28.4MB
                                                                        • SHA256 c463d23e60c2169da0e10d1cfb097d2ae27f25102ac55d4589069bbe2c4a2276
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        e5b64d9.msi
                                                                        • Path C:\Windows\Installer\e5b64d9.msi
                                                                        • Size 208KB
                                                                        • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{1057B9C8-C3A9-4F1F-9880-FA3B6353B5AE}\.ba\1028\thm.wxl
                                                                        • Size 5KB
                                                                        • SHA256 c0413edfd13fd27eeab7b8ce60963668236466c48f4173c29f84093011c281af
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{1057B9C8-C3A9-4F1F-9880-FA3B6353B5AE}\.ba\1029\thm.wxl
                                                                        • Size 6KB
                                                                        • SHA256 c92d3efd72d6d14148f9931128ee4143affd1da517eb358ab88ed4138c1434a4
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{1057B9C8-C3A9-4F1F-9880-FA3B6353B5AE}\.ba\1031\thm.wxl
                                                                        • Size 6KB
                                                                        • SHA256 0c4203a81dcd01d53378036af78cffcf9e9a5af7754dfbdd56584ae74c21cc61
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{1057B9C8-C3A9-4F1F-9880-FA3B6353B5AE}\.ba\1036\thm.wxl
                                                                        • Size 6KB
                                                                        • SHA256 6af5c2bc88b1e5ce188a97dd9204061d66369ec2689b3657aff1dc6188f44f22
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{1057B9C8-C3A9-4F1F-9880-FA3B6353B5AE}\.ba\1040\thm.wxl
                                                                        • Size 6KB
                                                                        • SHA256 344acd0d3665ba489eb30ebc0f902c625e1ad33a4e2b5ba7cdd7e463658d5557
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{1057B9C8-C3A9-4F1F-9880-FA3B6353B5AE}\.ba\1041\thm.wxl
                                                                        • Size 6KB
                                                                        • SHA256 00aec52b4564bc07302881fcfd510f7cca535ac9e05cfd95a86738171626f6c4
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{1057B9C8-C3A9-4F1F-9880-FA3B6353B5AE}\.ba\1046\thm.wxl
                                                                        • Size 5KB
                                                                        • SHA256 4d6a2d306abe77e7dbdb2609f6198b4cf99b3f9dc15b9dc72951592ad2f64384
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{1057B9C8-C3A9-4F1F-9880-FA3B6353B5AE}\.ba\1055\thm.wxl
                                                                        • Size 6KB
                                                                        • SHA256 285e32e649eb71a68f29bca7321a6cade50d79f94dd89e50ece1197dd70e7633
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{1057B9C8-C3A9-4F1F-9880-FA3B6353B5AE}\.ba\3082\thm.wxl
                                                                        • Size 5KB
                                                                        • SHA256 fab76fa9382a7793309c9b07d5baaa3efd8553172d46f8b69e22e30b635bb146
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        windowsdesktop-runtime-8.0.19-win-x64.exe
                                                                        • Path C:\Windows\Temp\{1057B9C8-C3A9-4F1F-9880-FA3B6353B5AE}\.be\windowsdesktop-runtime-8.0.19-win-x64.exe
                                                                        • Size 608KB
                                                                        • SHA256 938aaccda89ae551a7c289ca6b48ada28a5e3eb2ae9b6617dca81f6fbada1993
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.xml
                                                                        • Path C:\Windows\Temp\{10A77776-5553-4384-8932-6FD640D35E4E}\.ba\thm.xml
                                                                        • Size 11KB
                                                                        • SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        windowsdesktop-runtime-6.0.36-win-x64.exe
                                                                        • Path C:\Windows\Temp\{10A77776-5553-4384-8932-6FD640D35E4E}\.be\windowsdesktop-runtime-6.0.36-win-x64.exe
                                                                        • Size 608KB
                                                                        • SHA256 9b8b7390579a87b3f6a1370a31c92ebdcbbf0d43a4007ee6f66f3c1887681b15
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        wixstdba.dll
                                                                        • Path C:\Windows\Temp\{14A7BE72-ECEF-4CCE-8C64-B66EE9C08DA6}\.ba\wixstdba.dll
                                                                        • Size 197KB
                                                                        • SHA256 41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        license.rtf
                                                                        • Path C:\Windows\Temp\{40073CFE-3986-4C23-A7AE-8074F6216DA1}\.ba\license.rtf
                                                                        • Size 9KB
                                                                        • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{40073CFE-3986-4C23-A7AE-8074F6216DA1}\.ba\thm.wxl
                                                                        • Size 2KB
                                                                        • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        thm.xml
                                                                        • Path C:\Windows\Temp\{40073CFE-3986-4C23-A7AE-8074F6216DA1}\.ba\thm.xml
                                                                        • Size 8KB
                                                                        • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{88875421-5523-4D59-A76F-883CBAEFCD28}\.ba\1033\thm.wxl
                                                                        • Size 5KB
                                                                        • SHA256 0d2abde2e4974cc8b7231f017975180d67592ee6d3418cd6dc52e2bc4bf03e50
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        bg.png
                                                                        • Path C:\Windows\Temp\{8C3E20AC-1239-485B-8ADC-3E0D90B8BA77}\.ba\bg.png
                                                                        • Size 4KB
                                                                        • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        wixstdba.dll
                                                                        • Path C:\Windows\Temp\{8C3E20AC-1239-485B-8ADC-3E0D90B8BA77}\.ba\wixstdba.dll
                                                                        • Size 190KB
                                                                        • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        dotnet_host_6.0.36_win_x64.msi
                                                                        • Path C:\Windows\Temp\{8C3E20AC-1239-485B-8ADC-3E0D90B8BA77}\dotnet_host_6.0.36_win_x64.msi
                                                                        • Size 716KB
                                                                        • SHA256 f73830d5f64e7a920aef8ae2c101b3dea69a5feb47c10d1d6b2141235c4156ae
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        dotnet_hostfxr_6.0.36_win_x64.msi
                                                                        • Path C:\Windows\Temp\{8C3E20AC-1239-485B-8ADC-3E0D90B8BA77}\dotnet_hostfxr_6.0.36_win_x64.msi
                                                                        • Size 780KB
                                                                        • SHA256 ccb99abeb554c877236697168ad75bf6fb905c986ddbdb463a8e16cf430a1c0d
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        dotnet_runtime_6.0.36_win_x64.msi
                                                                        • Path C:\Windows\Temp\{8C3E20AC-1239-485B-8ADC-3E0D90B8BA77}\dotnet_runtime_6.0.36_win_x64.msi
                                                                        • Size 25.9MB
                                                                        • SHA256 db92e057f649d4804d3a758aedade71a3b63991ca318077d4340e47c4bdba8e7
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{9433984C-A0B3-4DC2-A61B-09C0BEE8E5CE}\.ba\1033\thm.wxl
                                                                        • Size 5KB
                                                                        • SHA256 835aa38b22480e84ccdf9f925ef2cd640e015bc2077674a6313c5175ea3db5be
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        wixstdba.dll
                                                                        • Path C:\Windows\Temp\{A929EF50-FE41-48B1-B58D-6379FF04074D}\.ba\wixstdba.dll
                                                                        • Size 215KB
                                                                        • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        dotnet-runtime-8.0.19-win-x64.exe
                                                                        • Path C:\Windows\Temp\{AC188E14-B51B-4BBA-8095-5DE766DEE051}\.be\dotnet-runtime-8.0.19-win-x64.exe
                                                                        • Size 607KB
                                                                        • SHA256 ea8966ec4dbc2d17f83b7dcba77c17489a939a19f9172c6a2ddc213afd6f0a7e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        dotnet60_x64.exe
                                                                        • Path C:\Windows\Temp\{C6105550-25C9-489F-ABDB-967212C13570}\.cr\dotnet60_x64.exe
                                                                        • Size 607KB
                                                                        • SHA256 5ac56fcb09a960d3ee116443c937df9bfb0f10e46474403715aef60dd3fd2587
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        logo.png
                                                                        • Path C:\Windows\Temp\{CCA636EE-ABAF-4143-97A4-3EE9FD5DD08F}\.ba\logo.png
                                                                        • Size 1KB
                                                                        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        VC_redist.x64.exe
                                                                        • Path C:\Windows\Temp\{CCA636EE-ABAF-4143-97A4-3EE9FD5DD08F}\.be\VC_redist.x64.exe
                                                                        • Size 670KB
                                                                        • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{E6323EA9-2D23-4FB6-9560-D0B280A0FBE5}\.ba\1042\thm.wxl
                                                                        • Size 6KB
                                                                        • SHA256 1b1b0700aa6677afe3581b8b3f4934bf85f4750c544a108e1d5f1b688078e1cf
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{E6323EA9-2D23-4FB6-9560-D0B280A0FBE5}\.ba\1045\thm.wxl
                                                                        • Size 6KB
                                                                        • SHA256 d92b3838de7a1685ccbd04fc9c123704fbd198bfd284d8faece4a3663494e75a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{E6323EA9-2D23-4FB6-9560-D0B280A0FBE5}\.ba\1049\thm.wxl
                                                                        • Size 7KB
                                                                        • SHA256 c7cc8e0bdd4f82da33984f553b576412df69c5e1e5b8479542d024cb6b41d050
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        thm.wxl
                                                                        • Path C:\Windows\Temp\{E6323EA9-2D23-4FB6-9560-D0B280A0FBE5}\.ba\2052\thm.wxl
                                                                        • Size 5KB
                                                                        • SHA256 3bb9ce59ba1c4b76fa6b35f544e2b04c85387053edd8b25d8c8d4fe637fb0a85
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        eula.rtf
                                                                        • Path C:\Windows\Temp\{E6323EA9-2D23-4FB6-9560-D0B280A0FBE5}\.ba\eula.rtf
                                                                        • Size 46KB
                                                                        • SHA256 72f2e7b06c562f1dd6cb3f6efdccd9ae620a183e598856ab3cba6d712254824a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        memory/700-3034-0x0000000000AD0000-0x0000000000B46000-memory.dmp
                                                                        Download

                                                                        memory/700-3102-0x0000000000AD0000-0x0000000000B46000-memory.dmp
                                                                        Download

                                                                        memory/1100-3267-0x0000000000C70000-0x0000000000CE7000-memory.dmp
                                                                        Download

                                                                        memory/1516-1971-0x0000000000090000-0x0000000000106000-memory.dmp
                                                                        Download

                                                                        memory/1696-3026-0x0000000000AD0000-0x0000000000B46000-memory.dmp
                                                                        Download

                                                                        memory/1736-5511-0x0000000000A20000-0x0000000000D85000-memory.dmp
                                                                        Download

                                                                        memory/1872-5400-0x0000000000210000-0x0000000000575000-memory.dmp
                                                                        Download

                                                                        memory/1872-5329-0x0000000000210000-0x0000000000575000-memory.dmp
                                                                        Download

                                                                        memory/1872-2078-0x0000000000210000-0x0000000000575000-memory.dmp
                                                                        Download

                                                                        memory/1872-806-0x0000000000210000-0x0000000000575000-memory.dmp
                                                                        Download

                                                                        memory/1872-812-0x0000000000210000-0x0000000000575000-memory.dmp
                                                                        Download

                                                                        memory/1872-2525-0x0000000000210000-0x0000000000575000-memory.dmp
                                                                        Download

                                                                        memory/1872-4259-0x0000000000210000-0x0000000000575000-memory.dmp
                                                                        Download

                                                                        memory/1872-804-0x0000000000210000-0x0000000000575000-memory.dmp
                                                                        Download

                                                                        memory/1872-816-0x0000000000210000-0x0000000000575000-memory.dmp
                                                                        Download

                                                                        memory/1872-935-0x0000000000210000-0x0000000000575000-memory.dmp
                                                                        Download

                                                                        memory/2644-5492-0x0000024567190000-0x0000024567242000-memory.dmp
                                                                        Download

                                                                        memory/2828-3266-0x0000000000C70000-0x0000000000CE7000-memory.dmp
                                                                        Download

                                                                        memory/3556-5512-0x00000000003A0000-0x0000000000705000-memory.dmp
                                                                        Download

                                                                        memory/3624-5457-0x0000016E2D8D0000-0x0000016E2D982000-memory.dmp
                                                                        Download

                                                                        memory/3780-3264-0x0000000000C70000-0x0000000000CE7000-memory.dmp
                                                                        Download

                                                                        memory/3892-3023-0x0000000000AD0000-0x0000000000B46000-memory.dmp
                                                                        Download

                                                                        memory/4308-5401-0x0000000000630000-0x0000000000708000-memory.dmp
                                                                        Download

                                                                        memory/4308-792-0x0000000000630000-0x0000000000708000-memory.dmp
                                                                        Download

                                                                        memory/4308-803-0x0000000000630000-0x0000000000708000-memory.dmp
                                                                        Download

                                                                        memory/4472-3101-0x0000000000AD0000-0x0000000000B46000-memory.dmp
                                                                        Download

                                                                        memory/4472-3035-0x0000000000AD0000-0x0000000000B46000-memory.dmp
                                                                        Download

                                                                        memory/4532-3025-0x0000000000AD0000-0x0000000000B46000-memory.dmp
                                                                        Download

                                                                        memory/4892-1972-0x0000000000090000-0x0000000000106000-memory.dmp
                                                                        Download

                                                                        memory/4948-1963-0x0000000000090000-0x0000000000106000-memory.dmp
                                                                        Download

                                                                        memory/4952-1964-0x0000000000090000-0x0000000000106000-memory.dmp
                                                                        Download

                                                                        memory/5404-1969-0x0000000000090000-0x0000000000106000-memory.dmp
                                                                        Download

                                                                        memory/5412-1961-0x0000000000090000-0x0000000000106000-memory.dmp
                                                                        Download

                                                                        memory/5784-3036-0x0000000000AD0000-0x0000000000B46000-memory.dmp
                                                                        Download

                                                                        memory/5784-3099-0x0000000000AD0000-0x0000000000B46000-memory.dmp
                                                                        Download

                                                                        memory/5832-5422-0x00000290F0260000-0x00000290F026A000-memory.dmp
                                                                        Download

                                                                        memory/5832-5421-0x00000290F01A0000-0x00000290F0252000-memory.dmp
                                                                        Download

                                                                        memory/5832-5420-0x00000290F0070000-0x00000290F008E000-memory.dmp
                                                                        Download

                                                                        memory/5832-5417-0x00000290EFFB0000-0x00000290EFFD2000-memory.dmp
                                                                        Download