Overview

overview

6

Static

static

1

Install_PVKiosk.exe

windows10-2004-x64

6

Install_PVKiosk.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    208s
  • max time network
    186s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/08/2026, 04:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Install_PVKiosk.exe
  • Size 442.0MB
  • Sample260814-ele25acl21
  • SHA256 c6f979d070460013befd80bd52408957f21d025f9cd1b42c6bcfc2fa7f4bd0d4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationransomwaretrojan

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 19 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Accessibility Features 1 TTPs

    Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.

    persistenceprivilege_escalation
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Install_PVKiosk.exe
    "C:\Users\Admin\AppData\Local\Temp\Install_PVKiosk.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Users\Admin\AppData\Local\Temp\is-8F9X6XIJ8L.tmp\Install_PVKiosk.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8F9X6XIJ8L.tmp\Install_PVKiosk.tmp" /SL5="$50254,462222001,893440,C:\Users\Admin\AppData\Local\Temp\Install_PVKiosk.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C dotnet --list-runtimes > "C:\Users\Admin\AppData\Local\Temp\is-ZEF2WD579P.tmp\dotnet.txt" 2>&1
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:3584
        • C:\Program Files\dotnet\dotnet.exe
          dotnet --list-runtimes
          4⤵
          • System Time Discovery
          PID:4776
      • C:\Users\Admin\AppData\Local\Temp\is-ZEF2WD579P.tmp\windowsdesktop-runtime-8.0.23-win-x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-ZEF2WD579P.tmp\windowsdesktop-runtime-8.0.23-win-x64.exe" /passive
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1016
        • C:\Windows\Temp\{5EBC4E23-26AD-4E9F-A8F2-BEA2FE7366EB}\.cr\windowsdesktop-runtime-8.0.23-win-x64.exe
          "C:\Windows\Temp\{5EBC4E23-26AD-4E9F-A8F2-BEA2FE7366EB}\.cr\windowsdesktop-runtime-8.0.23-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-ZEF2WD579P.tmp\windowsdesktop-runtime-8.0.23-win-x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=692 /passive
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4476
          • C:\Windows\Temp\{F12D4D1C-95CD-4EF2-AED5-57B912EB1232}\.be\windowsdesktop-runtime-8.0.23-win-x64.exe
            "C:\Windows\Temp\{F12D4D1C-95CD-4EF2-AED5-57B912EB1232}\.be\windowsdesktop-runtime-8.0.23-win-x64.exe" -q -burn.elevated BurnPipe.{0001FEE0-DCAB-4474-AFB3-120A0E57CC85} {54FF6842-931F-422C-98C2-186E3EB3301B} 4476
            5⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1216
            • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
              "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d653912d-5c24-4e13-9238-531257889178} -burn.filehandle.self=1020 -burn.embedded BurnPipe.{478CECEA-0972-4FD8-B437-DF5AE997297A} {77B03155-C9BB-450E-9E8A-F589FF622B0C} 1216
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1472
              • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d653912d-5c24-4e13-9238-531257889178} -burn.filehandle.self=1020 -burn.embedded BurnPipe.{478CECEA-0972-4FD8-B437-DF5AE997297A} {77B03155-C9BB-450E-9E8A-F589FF622B0C} 1216
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3328
                • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                  "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{5E7BC8BE-EA4A-4DF4-B941-58055454CAC6} {CB164886-8BBD-46BC-8B29-61E2C8865B3D} 3328
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:3376
      • C:\Windows\SysWOW64\msiexec.exe
        "msiexec" /i C:\ProgramData\Yamaha_Uninstaller\{16FCE6E3-02A1-4607-AB5B-395B2E005D00}\PVControlPVKIOSK64.msi
        3⤵
        • Badlisted process makes network request
        • Enumerates connected drives
        • Event Triggered Execution: Installer Packages
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:3904
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4268
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 118D022865B69A3265B15C2C91D7C14B
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:836
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding FD058CD1CA8AE408C9F45D5CF9ED248A
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1732
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 1A19771C73B8040A87EEF773BF453DAA
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4564
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 17775DEF80179EA136973B9F9631931D
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4032
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7E4483571CFAA2497999B3663920AB2A
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2260
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F6F1E62904507E7A6455991C066609AE
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4116
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6C00B2D3DCDD8FAE6E48C19A9256213F
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1452
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding DD4CB9586D3A0A2A73EDA0C71F475853
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3732
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 384A0653346C5BF020D0007C2EEBF5F2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3280
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 2346BCDD9927D6F6B54EC2C2B8661105
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4448
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 986005D46C5236A382B0D62B6BAB4876
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1528
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:652
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 55A2CB9A3EA838654B088E862B0A931D
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5052
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding ACBFD27627C1A67CEF6747DBC6DC2F7F E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:3324
    • C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe
      "C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1956
      • C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe
        "C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe" /passive /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031820.log"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe
          "C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe" -burn.filehandle.attached=652 -burn.filehandle.self=660 /passive /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031820.log"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4800
          • C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe
            "C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\windowsdesktop-runtime-8.0.23-win-x64.exe" -q -burn.elevated BurnPipe.{BEBE80BC-8491-45DD-8D1C-0145B50E484C} {C5B625FC-0654-4BFA-85CC-9DC7D4A51F33} 4800
            4⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1824
            • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
              "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d653912d-5c24-4e13-9238-531257889178} -burn.filehandle.self=1132 -burn.embedded BurnPipe.{C03A84DC-B27A-4FBA-926F-FB207ABFA251} {82873E9D-0653-42EB-8573-C25B64265E21} 1824
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3992
              • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=536 -burn.filehandle.self=544 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d653912d-5c24-4e13-9238-531257889178} -burn.filehandle.self=1132 -burn.embedded BurnPipe.{C03A84DC-B27A-4FBA-926F-FB207ABFA251} {82873E9D-0653-42EB-8573-C25B64265E21} 1824
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3452
                • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                  "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{2942F195-112F-48EC-867F-17E76A3FC0E1} {566C96BE-2D09-4C76-AAEB-82728F68640B} 3452
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:1336
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1184
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2216
      • C:\Program Files\Yamaha\ProVisionaire Control PLUS\V3.1\PVKiosk\pvkiosk\pvKiosk.exe
        "C:\Program Files\Yamaha\ProVisionaire Control PLUS\V3.1\PVKiosk\pvkiosk\pvKiosk.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4668
        • C:\Program Files\Yamaha\ProVisionaire Control PLUS\V3.1\PVKiosk\pvkioskcore\pvkioskcore.exe
          provisionaireKiosk_20260817032007_4668 260 --standby
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          PID:3100

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            Windows Command Shell

            1
            T1059.003

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            2
            T1546

            Accessibility Features

            1
            T1546.008

            Installer Packages

            1
            T1546.016

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            2
            T1546

            Accessibility Features

            1
            T1546.008

            Installer Packages

            1
            T1546.016

            Defense Evasion

            Modify Registry

            1
            T1112

            System Binary Proxy Execution

            1
            T1218

            Msiexec

            1
            T1218.007

            Credential Access

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            4
            T1012

            System Information Discovery

            5
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Time Discovery

            1
            T1124

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e58d8ca.rbs
            • Path C:\Config.Msi\e58d8ca.rbs
            • Size 48KB
            • SHA256 73d506f0b9b078d8a880c4ebda6a471c226140787131c5218e2ad555f45bf355
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58d8cf.rbs
            • Path C:\Config.Msi\e58d8cf.rbs
            • Size 9KB
            • SHA256 fb406fb63ee0ec01205ea7433854bb3c373502d89186772ac958047d088316a0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58d8d4.rbs
            • Path C:\Config.Msi\e58d8d4.rbs
            • Size 11KB
            • SHA256 a9461b4e689c7ebbf66a75dde4b707e2cdb086d474752b8eb527a0f62a14d003
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58d8d9.rbs
            • Path C:\Config.Msi\e58d8d9.rbs
            • Size 8KB
            • SHA256 3427eda7f7856da2e7652e4ee0e7770e6f9f6ca46750ff51da6034406b87fab0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58d8da.rbf
            • Path C:\Config.Msi\e58d8da.rbf
            • Size 143KB
            • SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58d8db.rbf
            • Path C:\Config.Msi\e58d8db.rbf
            • Size 3B
            • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
            • MD5 SHA1 SHA512
            Submit Download

            e58d8de.rbs
            • Path C:\Config.Msi\e58d8de.rbs
            • Size 3KB
            • SHA256 fd808f13e1382d850bc1a150707a8dd8be32683db14501b429801f412fdcf011
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            e58d8e2.rbs
            • Path C:\Config.Msi\e58d8e2.rbs
            • Size 87KB
            • SHA256 b51bfc577453dd7bd6017253761b4b45a1f8e210acbf87f3f9958ba88e57e030
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58d8e6.rbs
            • Path C:\Config.Msi\e58d8e6.rbs
            • Size 3KB
            • SHA256 554facc3de42047518835d00e06b24a02497f7ba44ef157bc58ef887f1c00d11
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            e58d8e9.rbs
            • Path C:\Config.Msi\e58d8e9.rbs
            • Size 3KB
            • SHA256 b8958741b0ba3ba4e4c3fa14623b9b984d12d57b8ba9edaf9e4f69e13f3d2fea
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            e58d8ec.rbs
            • Path C:\Config.Msi\e58d8ec.rbs
            • Size 132KB
            • SHA256 1461e395cdaa87d6aebded00766ca116870e7774994ec7e8dc61858e573b1e69
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58da09.rbs
            • Path C:\Config.Msi\e58da09.rbs
            • Size 3KB
            • SHA256 d17136a66bf206b1fd3fb39b252aeb2dca81501f365639f611e217d055dde8a2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            e58da0c.rbs
            • Path C:\Config.Msi\e58da0c.rbs
            • Size 8KB
            • SHA256 eec11c061a15f237bcd167532f43ceef1dca310217d7293a674673e9d080e074
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58da10.rbs
            • Path C:\Config.Msi\e58da10.rbs
            • Size 86KB
            • SHA256 8296398b0dee2a3ec965ff51e739d2084f71b5979003f79f1cacf6e1e6c52cb0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58daca.rbs
            • Path C:\Config.Msi\e58daca.rbs
            • Size 343KB
            • SHA256 4c9714ec26cbff6742596aae4890784e0b756e8ca71352716937b2345e9b6c52
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            state.rsm
            • Path C:\ProgramData\Package Cache\{d653912d-5c24-4e13-9238-531257889178}\state.rsm
            • Size 1KB
            • SHA256 ad1189f772f8c56dfce78fb97d20c73384593dd29b856c155ddb441f24f75929
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260817031847_000_windowsdesktop_runtime_8.0.15_win_x64.msi.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260817031847_000_windowsdesktop_runtime_8.0.15_win_x64.msi.log
            • Size 1KB
            • SHA256 9365d250d168688875a06c3b75931e3e40ee31084c82497b9feff9b5be664722
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031820_000_dotnet_runtime_8.0.23_win_x64.msi.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031820_000_dotnet_runtime_8.0.23_win_x64.msi.log
            • Size 2KB
            • SHA256 eecbb9d63be1868e21e74fce5c7e62aaf013ca1719e1f9a7c9dd14a27c4baa66
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031820_001_dotnet_hostfxr_8.0.23_win_x64.msi.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031820_001_dotnet_hostfxr_8.0.23_win_x64.msi.log
            • Size 2KB
            • SHA256 0ee02cf10a05a233650c320d099ccedc2b346ad9093dab4d98698dfc240ead63
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031820_002_dotnet_host_8.0.23_win_x64.msi.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031820_002_dotnet_host_8.0.23_win_x64.msi.log
            • Size 2KB
            • SHA256 87b2ad83050789b5ba4652ed4c2788e43f065bfa86a5989bdf099acdabcf55cd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031820_003_windowsdesktop_runtime_8.0.23_win_x64.msi.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.23_(x64)_20260817031820_003_windowsdesktop_runtime_8.0.23_win_x64.msi.log
            • Size 2KB
            • SHA256 d18ea1cf590b332f047c157842eb8207e64abf41965228da26283a508ef4d597
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Install_PVKiosk.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\is-8F9X6XIJ8L.tmp\Install_PVKiosk.tmp
            • Size 4.2MB
            • SHA256 fd417243e02823655f1f9fcab0ddd3dc4aa5910e01499e5e2823bf89b1873227
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.txt
            • Path C:\Users\Admin\AppData\Local\Temp\is-ZEF2WD579P.tmp\dotnet.txt
            • Size 552B
            • SHA256 3a540187aba2047118a389c22152a488c215f21766cd75e59c187f7c414bddb1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            controller.pvksk
            • Path C:\Users\Admin\AppData\Roaming\Yamaha\PVKiosk\V1.0\tmp\4964edcd-2483-469d-98b6-1147324729e2\resources\files\controller.pvksk
            • Size 3KB
            • SHA256 55415c91e45806a3bc8f6d44512f2e8a393d8456ab7b56f34250c256ca886e4c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSIE4BE.tmp
            • Path C:\Windows\Installer\MSIE4BE.tmp
            • Size 219KB
            • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIFB08.tmp
            • Path C:\Windows\Installer\MSIFB08.tmp
            • Size 149KB
            • SHA256 386a4209241d3424783e2456ef79988a1032a9f4ead891b5551253520e439ee0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pvKiosk.exe
            • Path C:\Windows\Installer\{16FCE6E3-02A1-4607-AB5B-395B2E005D00}\pvKiosk.exe
            • Size 1.5MB
            • SHA256 384b26a5682f3c27456494ff6c015b0aa907f135e51e74d42bcbb9d18c8f5589
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            windowsdesktop-runtime-8.0.23-win-x64.exe
            • Path C:\Windows\Temp\{5EBC4E23-26AD-4E9F-A8F2-BEA2FE7366EB}\.cr\windowsdesktop-runtime-8.0.23-win-x64.exe
            • Size 608KB
            • SHA256 e7355cfd7aa1900736771ef9669590f57d59d72f7eac8caa39198dd6eba7267f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.xml
            • Path C:\Windows\Temp\{63770D24-E9BC-46B9-BB26-07E66075F500}\.ba\thm.xml
            • Size 11KB
            • SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.wxl
            • Path C:\Windows\Temp\{93271D5F-5279-4C08-A17B-4B249E1B1AB0}\.ba\1033\thm.wxl
            • Size 5KB
            • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bg.png
            • Path C:\Windows\Temp\{F12D4D1C-95CD-4EF2-AED5-57B912EB1232}\.ba\bg.png
            • Size 4KB
            • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{F12D4D1C-95CD-4EF2-AED5-57B912EB1232}\.ba\wixstdba.dll
            • Size 190KB
            • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_host_8.0.23_win_x64.msi
            • Path C:\Windows\Temp\{F12D4D1C-95CD-4EF2-AED5-57B912EB1232}\dotnet_host_8.0.23_win_x64.msi
            • Size 708KB
            • SHA256 b9e8d1240cbad28c368e5c83ca87584678622573dda73b50998f4ddbc003727d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_hostfxr_8.0.23_win_x64.msi
            • Path C:\Windows\Temp\{F12D4D1C-95CD-4EF2-AED5-57B912EB1232}\dotnet_hostfxr_8.0.23_win_x64.msi
            • Size 776KB
            • SHA256 a8e69ac1e5b6ca7eafac1978ff32056ad7822dedb5de05256c9e776cf6fc4e36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_runtime_8.0.23_win_x64.msi
            • Path C:\Windows\Temp\{F12D4D1C-95CD-4EF2-AED5-57B912EB1232}\dotnet_runtime_8.0.23_win_x64.msi
            • Size 26.1MB
            • SHA256 5335709233149cba79ceae94477d2d89b6219cc6a6abf637f3d499ce018dd478
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            windowsdesktop_runtime_8.0.23_win_x64.msi
            • Path C:\Windows\Temp\{F12D4D1C-95CD-4EF2-AED5-57B912EB1232}\windowsdesktop_runtime_8.0.23_win_x64.msi
            • Size 29.0MB
            • SHA256 d1adad0c9f2d2272926a61e9171df6b216e658a52962e46ada091561d9604985
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/816-1045-0x00000000008E0000-0x0000000000D2B000-memory.dmp
            Download

            memory/816-5-0x0000000001060000-0x0000000001061000-memory.dmp
            Download

            memory/816-142-0x00000000008E0000-0x0000000000D2B000-memory.dmp
            Download

            memory/816-1609-0x00000000008E0000-0x0000000000D2B000-memory.dmp
            Download

            memory/816-13-0x0000000001060000-0x0000000001061000-memory.dmp
            Download

            memory/816-12-0x00000000008E0000-0x0000000000D2B000-memory.dmp
            Download

            memory/1336-1029-0x0000000000C30000-0x0000000000CA6000-memory.dmp
            Download

            memory/1472-1024-0x0000000000C30000-0x0000000000CA6000-memory.dmp
            Download

            memory/2908-1610-0x0000000000E20000-0x0000000000F09000-memory.dmp
            Download

            memory/2908-11-0x0000000000E20000-0x0000000000F09000-memory.dmp
            Download

            memory/2908-0-0x0000000000E20000-0x0000000000F09000-memory.dmp
            Download

            memory/3328-1023-0x0000000000C30000-0x0000000000CA6000-memory.dmp
            Download

            memory/3376-1021-0x0000000000C30000-0x0000000000CA6000-memory.dmp
            Download

            memory/3452-1031-0x0000000000C30000-0x0000000000CA6000-memory.dmp
            Download

            memory/3992-1032-0x0000000000C30000-0x0000000000CA6000-memory.dmp
            Download

            memory/4668-1613-0x00007FFF93280000-0x00007FFF93841000-memory.dmp
            Download

            memory/4668-1715-0x0000029FC80D0000-0x0000029FC865C000-memory.dmp
            Download

            memory/4668-1717-0x0000029FC80D0000-0x0000029FC865C000-memory.dmp
            Download

            memory/4668-1726-0x0000029FC80D0000-0x0000029FC865C000-memory.dmp
            Download