Overview

overview

8

Static

static

3

MakuTweake...up.exe

windows10-2004-x64

8

MakuTweake...up.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/08/2026, 11:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MakuTweaker 5.7.3 Setup.exe
  • Size 13.3MB
  • Sample260817-ncdmdaba59
  • SHA256 110175b154fe403a689ca10abe1a6534245018abcd1e91a1ea99daa306b406f2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutioninstallerpersistencetrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Modifies boot configuration data using bcdedit 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 61 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 26 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MakuTweaker 5.7.3 Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MakuTweaker 5.7.3 Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Users\Admin\AppData\Local\Temp\is-Q78ELZF6M4.tmp\MakuTweaker 5.7.3 Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-Q78ELZF6M4.tmp\MakuTweaker 5.7.3 Setup.tmp" /SL5="$2017A,12443314,852480,C:\Users\Admin\AppData\Local\Temp\MakuTweaker 5.7.3 Setup.exe"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2820
      • C:\Users\Admin\AppData\Local\Temp\is-1ZBZ7GZDX1.tmp\dotnet8.exe
        "C:\Users\Admin\AppData\Local\Temp\is-1ZBZ7GZDX1.tmp\dotnet8.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1868
        • C:\Windows\Temp\{A8EEDF59-5646-4D50-9DDA-F40AC120A802}\.cr\dotnet8.exe
          "C:\Windows\Temp\{A8EEDF59-5646-4D50-9DDA-F40AC120A802}\.cr\dotnet8.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-1ZBZ7GZDX1.tmp\dotnet8.exe" -burn.filehandle.attached=556 -burn.filehandle.self=692 /install /quiet /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4236
          • C:\Windows\Temp\{270F2AF4-9C7D-4D0C-B761-04ABEEFDCBA5}\.be\windowsdesktop-runtime-8.0.30-win-x64.exe
            "C:\Windows\Temp\{270F2AF4-9C7D-4D0C-B761-04ABEEFDCBA5}\.be\windowsdesktop-runtime-8.0.30-win-x64.exe" -q -burn.elevated BurnPipe.{927A9574-A832-4919-810D-8197D4210427} {2C62E590-4144-4479-A41B-9DF669B80AE9} 4236
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3560
            • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
              "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d374321a-d08b-4207-8ef4-6953f782a26c} -burn.filehandle.self=1004 -burn.embedded BurnPipe.{6DD2CA95-3B48-4FA5-956B-A678DD96884A} {EE49B5CF-92B0-4C39-A0B2-6A6570DAC6BD} 3560
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1088
              • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d374321a-d08b-4207-8ef4-6953f782a26c} -burn.filehandle.self=1004 -burn.embedded BurnPipe.{6DD2CA95-3B48-4FA5-956B-A678DD96884A} {EE49B5CF-92B0-4C39-A0B2-6A6570DAC6BD} 3560
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2708
                • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                  "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{5EBA1B64-EDF1-4A3C-B3E0-F3A9C8570AAB} {2B93B09C-9338-476C-AF33-75E225FC0F3D} 2708
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:624
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6B606E1ACA217A6D0843C7648A7C1854
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1832
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 282A8A485C0E47F6F614223B492FA402
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:404
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding FBCFF6DBA5AA312EE398B8F4BCCC5E7C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4732
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 8D9C7A592909B61F3EC95F23BDBA7407
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1324
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E36F3197EB868ABBE24608A9E7727A59
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4560
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7F478A697E641BC0B4CC7DE7E60C3E7F
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2456
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding FC61DCA1A9C9241948C48E56E0663B01
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1916
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7C0C3B403884C64CE4F341BBB2D574CF
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5464
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7493CEADEB921BB71EDDECE0AB562695
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2320
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 5F4A97DD86888B13B2DDE8761CC98D44
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5716
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 45B9CFB5EE29D9D38888A39224A0DF73
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:6048
  • C:\ProgramData\Package Cache\{d374321a-d08b-4207-8ef4-6953f782a26c}\windowsdesktop-runtime-8.0.30-win-x64.exe
    "C:\ProgramData\Package Cache\{d374321a-d08b-4207-8ef4-6953f782a26c}\windowsdesktop-runtime-8.0.30-win-x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:380
    • C:\ProgramData\Package Cache\{d374321a-d08b-4207-8ef4-6953f782a26c}\windowsdesktop-runtime-8.0.30-win-x64.exe
      "C:\ProgramData\Package Cache\{d374321a-d08b-4207-8ef4-6953f782a26c}\windowsdesktop-runtime-8.0.30-win-x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.30_(x64)_20260817121529.log" /install
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5564
      • C:\ProgramData\Package Cache\{d374321a-d08b-4207-8ef4-6953f782a26c}\windowsdesktop-runtime-8.0.30-win-x64.exe
        "C:\ProgramData\Package Cache\{d374321a-d08b-4207-8ef4-6953f782a26c}\windowsdesktop-runtime-8.0.30-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d374321a-d08b-4207-8ef4-6953f782a26c}\windowsdesktop-runtime-8.0.30-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.30_(x64)_20260817121529.log" /install
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4808
        • C:\ProgramData\Package Cache\{d374321a-d08b-4207-8ef4-6953f782a26c}\windowsdesktop-runtime-8.0.30-win-x64.exe
          "C:\ProgramData\Package Cache\{d374321a-d08b-4207-8ef4-6953f782a26c}\windowsdesktop-runtime-8.0.30-win-x64.exe" -q -burn.elevated BurnPipe.{100CFAA6-4254-4FFD-990C-5476D44DA6C0} {AFDBD7F1-968A-4A50-8BB4-022A406E177B} 4808
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:1048
  • C:\Program Files\MarkAdderly\MakuTweaker\MakuTweaker.exe
    "C:\Program Files\MarkAdderly\MakuTweaker\MakuTweaker.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2704
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Get-AppxPackage | Select -ExpandProperty Name"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4844
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Get-AppxPackage -Name 'Microsoft.MixedReality.Portal' | Remove-AppxPackage Get-AppxPackage -Name 'Microsoft.MicrosoftSolitaireCollection' | Remove-AppxPackage Get-AppxPackage -Name 'Microsoft.GetHelp' | Remove-AppxPackage Get-AppxPackage -Name 'Microsoft.MSPaint' | Remove-AppxPackage Get-AppxPackage -Name 'Microsoft.3DBuilder' | Remove-AppxPackage Get-AppxPackage -Name 'Microsoft.Microsoft3DViewer' | Remove-AppxPackage Get-AppxPackage -Name 'Microsoft.Office.OneNote' | Remove-AppxPackage Get-AppxPackage -Name 'Microsoft.BingWeather' | Remove-AppxPackage Get-AppxPackage -Name 'Microsoft.MicrosoftStickyNotes' | Remove-AppxPackage Get-AppxPackage -Name 'Microsoft.Getstarted' | Remove-AppxPackage Get-AppxPackage -Name 'Microsoft.People' | Remove-AppxPackage Get-AppxPackage -Name 'Microsoft.WindowsPeopleExperienceHost' | Remove-AppxPackage Get-AppxPackage -Name 'Microsoft.Copilot' | Remove-AppxPackage Get-AppxPackage -Name 'Microsoft.MicrosoftOfficeHub' | Remove-AppxPackage"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:5384
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Get-AppxPackage | Select -ExpandProperty Name"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4984
    • C:\Windows\SYSTEM32\bcdedit.exe
      "bcdedit" /enum {globalsettings}
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:2840
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v ActiveHoursStart /t REG_DWORD /d 9 /f && reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v ActiveHoursEnd /t REG_DWORD /d 2 /f && reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v PauseFeatureUpdatesStartTime /t REG_SZ /d "2015-01-01T00:00:00Z" /f && reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v PauseQualityUpdatesStartTime /t REG_SZ /d "2015-01-01T00:00:00Z" /f && reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v PauseUpdatesExpiryTime /t REG_SZ /d "2077-01-01T00:00:00Z" /f && reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v PauseFeatureUpdatesEndTime /t REG_SZ /d "2077-01-01T00:00:00Z" /f && reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v PauseQualityUpdatesEndTime /t REG_SZ /d "2077-01-01T00:00:00Z" /f && reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v PauseUpdatesStartTime /t REG_SZ /d "2015-01-01T00:00:00Z" /f"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5812
      • C:\Windows\system32\reg.exe
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v ActiveHoursStart /t REG_DWORD /d 9 /f
        3⤵
          PID:5244
        • C:\Windows\system32\reg.exe
          reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v ActiveHoursEnd /t REG_DWORD /d 2 /f
          3⤵
            PID:3068
          • C:\Windows\system32\reg.exe
            reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v PauseFeatureUpdatesStartTime /t REG_SZ /d "2015-01-01T00:00:00Z" /f
            3⤵
              PID:4552
            • C:\Windows\system32\reg.exe
              reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v PauseQualityUpdatesStartTime /t REG_SZ /d "2015-01-01T00:00:00Z" /f
              3⤵
                PID:5200
              • C:\Windows\system32\reg.exe
                reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v PauseUpdatesExpiryTime /t REG_SZ /d "2077-01-01T00:00:00Z" /f
                3⤵
                  PID:5912
                • C:\Windows\system32\reg.exe
                  reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v PauseFeatureUpdatesEndTime /t REG_SZ /d "2077-01-01T00:00:00Z" /f
                  3⤵
                    PID:4240
                  • C:\Windows\system32\reg.exe
                    reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v PauseQualityUpdatesEndTime /t REG_SZ /d "2077-01-01T00:00:00Z" /f
                    3⤵
                      PID:2456
                    • C:\Windows\system32\reg.exe
                      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings /v PauseUpdatesStartTime /t REG_SZ /d "2015-01-01T00:00:00Z" /f
                      3⤵
                        PID:400
                    • C:\Windows\SYSTEM32\cmd.exe
                      "cmd.exe" /c del /f /s /q %windir%\SoftwareDistribution\Download\*
                      2⤵
                        PID:5052
                    • C:\Windows\system32\rundll32.exe
                      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MixedReality.Portal_8wekyb3d8bbwe
                      1⤵
                        PID:5636
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                        1⤵
                          PID:1276
                        • C:\Windows\system32\rundll32.exe
                          "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe
                          1⤵
                            PID:3728
                          • C:\Windows\system32\rundll32.exe
                            "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe
                            1⤵
                              PID:3480
                            • C:\Windows\system32\rundll32.exe
                              "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe
                              1⤵
                              • System Time Discovery
                              PID:4832
                            • C:\Windows\system32\rundll32.exe
                              "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.GetHelp_8wekyb3d8bbwe
                              1⤵
                                PID:5908
                              • C:\Windows\system32\rundll32.exe
                                "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MSPaint_8wekyb3d8bbwe
                                1⤵
                                  PID:1364
                                • C:\Windows\system32\rundll32.exe
                                  "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.UI.Xaml.2.0_8wekyb3d8bbwe
                                  1⤵
                                    PID:4636
                                  • C:\Windows\system32\rundll32.exe
                                    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Microsoft3DViewer_8wekyb3d8bbwe
                                    1⤵
                                      PID:3492
                                    • C:\Windows\system32\rundll32.exe
                                      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Office.OneNote_8wekyb3d8bbwe
                                      1⤵
                                        PID:4852
                                      • C:\Windows\system32\AUDIODG.EXE
                                        C:\Windows\system32\AUDIODG.EXE 0x3f0 0x388
                                        1⤵
                                          PID:116
                                        • C:\Windows\system32\rundll32.exe
                                          "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Advertising.Xaml_8wekyb3d8bbwe
                                          1⤵
                                            PID:1936
                                          • C:\Windows\system32\rundll32.exe
                                            "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.BingWeather_8wekyb3d8bbwe
                                            1⤵
                                              PID:2160
                                            • C:\Windows\system32\rundll32.exe
                                              "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Services.Store.Engagement_8wekyb3d8bbwe
                                              1⤵
                                                PID:5756
                                              • C:\Windows\system32\rundll32.exe
                                                "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Services.Store.Engagement_8wekyb3d8bbwe
                                                1⤵
                                                  PID:1064
                                                • C:\Windows\system32\rundll32.exe
                                                  "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe
                                                  1⤵
                                                    PID:2616
                                                  • C:\Windows\system32\rundll32.exe
                                                    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Getstarted_8wekyb3d8bbwe
                                                    1⤵
                                                      PID:3740
                                                    • C:\Windows\system32\rundll32.exe
                                                      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe
                                                      1⤵
                                                        PID:1692
                                                      • C:\Windows\system32\rundll32.exe
                                                        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe
                                                        1⤵
                                                        • System Time Discovery
                                                        PID:4796
                                                      • C:\Windows\system32\rundll32.exe
                                                        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.People_8wekyb3d8bbwe
                                                        1⤵
                                                          PID:1984
                                                        • C:\Windows\system32\rundll32.exe
                                                          "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe
                                                          1⤵
                                                            PID:6056
                                                          • C:\Windows\system32\rundll32.exe
                                                            "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe
                                                            1⤵
                                                              PID:4664

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  e586cd1.rbs
                                                                  • Path C:\Config.Msi\e586cd1.rbs
                                                                  • Size 48KB
                                                                  • SHA256 3e501683c727070aa821a43bc86fd855c84f67b426a325d1b8b0459147498978
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  e586cd6.rbs
                                                                  • Path C:\Config.Msi\e586cd6.rbs
                                                                  • Size 9KB
                                                                  • SHA256 4c79f9eec8227aab1dd1430481d6be1c3d366b7c19960edee9a6e10e06cee137
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  e586cdb.rbs
                                                                  • Path C:\Config.Msi\e586cdb.rbs
                                                                  • Size 11KB
                                                                  • SHA256 4d798acb78408a988ab2fdd7fde25503e2772909a60cf19765f62f658dcd4eed
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  e586ce0.rbs
                                                                  • Path C:\Config.Msi\e586ce0.rbs
                                                                  • Size 8KB
                                                                  • SHA256 3aa26c8b8898eae9659f5d9d5b37fb57bcdb4829f141631d15da0ec3a2c6c9f7
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  e586ce1.rbf
                                                                  • Path C:\Config.Msi\e586ce1.rbf
                                                                  • Size 143KB
                                                                  • SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  e586ce2.rbf
                                                                  • Path C:\Config.Msi\e586ce2.rbf
                                                                  • Size 3B
                                                                  • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  e586ce5.rbs
                                                                  • Path C:\Config.Msi\e586ce5.rbs
                                                                  • Size 3KB
                                                                  • SHA256 21ea91c94a3a0316e5c51e5d5ab79eab5ed99c52bec5769b4d70f1baf499b7ae
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  e586ce9.rbs
                                                                  • Path C:\Config.Msi\e586ce9.rbs
                                                                  • Size 87KB
                                                                  • SHA256 a3384c591777b397115cffbdccebd9a50b8c0bf991e170eafbfb332ed0340f37
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  e586ced.rbs
                                                                  • Path C:\Config.Msi\e586ced.rbs
                                                                  • Size 3KB
                                                                  • SHA256 cda63a65e1f3fc221912cb1f6a4d3c07a0b1c53151c5f71c5cf13117210f62ac
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  e586cf0.rbs
                                                                  • Path C:\Config.Msi\e586cf0.rbs
                                                                  • Size 3KB
                                                                  • SHA256 a4e8889d0552f39a90706cfc7b51494dd9e8738c3f2cab40569170b7146468be
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  e586cf3.rbs
                                                                  • Path C:\Config.Msi\e586cf3.rbs
                                                                  • Size 132KB
                                                                  • SHA256 08f3078a6e5c8f4714489eef10ff93cee3d2308e1c7e7adf84b86972c99cb714
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  e586e10.rbs
                                                                  • Path C:\Config.Msi\e586e10.rbs
                                                                  • Size 8KB
                                                                  • SHA256 cad54f76473d0516476f7b588935c8400058ea98dc0ac568fbb6d52136468485
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  e586e14.rbs
                                                                  • Path C:\Config.Msi\e586e14.rbs
                                                                  • Size 86KB
                                                                  • SHA256 6dae92e8870e8417b93e33601298a9b97f62b363dd4cf77aa7409c9f9700e36c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  e586ecf.rbs
                                                                  • Path C:\Config.Msi\e586ecf.rbs
                                                                  • Size 3KB
                                                                  • SHA256 f2d1f185392c87a68397bc7ead004e73051b76237449e27a7c2e5a4a2911fa10
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  MakuTweaker.exe
                                                                  • Path C:\Program Files\MarkAdderly\MakuTweaker\MakuTweaker.exe
                                                                  • Size 165KB
                                                                  • SHA256 d38b99934f686b149a11160f0ccbe0ee8d5b6cd060accf22e57e8704b41cd81d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  state.rsm
                                                                  • Path C:\ProgramData\Package Cache\{d374321a-d08b-4207-8ef4-6953f782a26c}\state.rsm
                                                                  • Size 980B
                                                                  • SHA256 76736b139f124c31faa2506668f5fbfb89f6406a6cba4dbe70b29d449b8fed26
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  0gakovez.newcfg
                                                                  • Path C:\Users\Admin\AppData\Local\MarkAdderly\MakuTweaker_Url_qgiyyepz0cofqcgnuruwp0uc3dazhawo\5.7.3.0\0gakovez.newcfg
                                                                  • Size 1KB
                                                                  • SHA256 aa63dc0e1f33d4923d4c04fca9733fef55ea3ce192a40b7764f04c6ff78fe533
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  40mizfpw.newcfg
                                                                  • Path C:\Users\Admin\AppData\Local\MarkAdderly\MakuTweaker_Url_qgiyyepz0cofqcgnuruwp0uc3dazhawo\5.7.3.0\40mizfpw.newcfg
                                                                  • Size 1KB
                                                                  • SHA256 242446c6fe9efc5276c21c33fe5552eca81e5347c5d70cc689e929485aabca68
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  5rhrzqth.newcfg
                                                                  • Path C:\Users\Admin\AppData\Local\MarkAdderly\MakuTweaker_Url_qgiyyepz0cofqcgnuruwp0uc3dazhawo\5.7.3.0\5rhrzqth.newcfg
                                                                  • Size 1KB
                                                                  • SHA256 3d8214ac6ac1a7dd035e300791dd2c8e0f9625a24c363ca456b17bcf0c88b7d4
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  bahhcww0.newcfg
                                                                  • Path C:\Users\Admin\AppData\Local\MarkAdderly\MakuTweaker_Url_qgiyyepz0cofqcgnuruwp0uc3dazhawo\5.7.3.0\bahhcww0.newcfg
                                                                  • Size 1KB
                                                                  • SHA256 38b4052cda566bce17b43baed636737ba2393c7ae88a4dc6919f8ef774586740
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  bd1jejoe.newcfg
                                                                  • Path C:\Users\Admin\AppData\Local\MarkAdderly\MakuTweaker_Url_qgiyyepz0cofqcgnuruwp0uc3dazhawo\5.7.3.0\bd1jejoe.newcfg
                                                                  • Size 800B
                                                                  • SHA256 5d8a06654331d7fce2a51cff24a66b6b98094183a0a1345e40ebb8be25733ed9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  goee0epb.newcfg
                                                                  • Path C:\Users\Admin\AppData\Local\MarkAdderly\MakuTweaker_Url_qgiyyepz0cofqcgnuruwp0uc3dazhawo\5.7.3.0\goee0epb.newcfg
                                                                  • Size 1KB
                                                                  • SHA256 e9a310d319afc78257db8ea1dab14cfa86cf60a6bac711adbb9179bd58141118
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  gx2hxzcn.newcfg
                                                                  • Path C:\Users\Admin\AppData\Local\MarkAdderly\MakuTweaker_Url_qgiyyepz0cofqcgnuruwp0uc3dazhawo\5.7.3.0\gx2hxzcn.newcfg
                                                                  • Size 1KB
                                                                  • SHA256 a7b03e17db82aa8bfbeb71d2cc51e33a1ec0e0f580f121d43d1ed234f67e2a29
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  htms3tlm.newcfg
                                                                  • Path C:\Users\Admin\AppData\Local\MarkAdderly\MakuTweaker_Url_qgiyyepz0cofqcgnuruwp0uc3dazhawo\5.7.3.0\htms3tlm.newcfg
                                                                  • Size 1KB
                                                                  • SHA256 c9fbfcbfe76ec7c8e8a4851938684c5390ec5972d02877c886cac2f886a9a70a
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  uiknb2ac.newcfg
                                                                  • Path C:\Users\Admin\AppData\Local\MarkAdderly\MakuTweaker_Url_qgiyyepz0cofqcgnuruwp0uc3dazhawo\5.7.3.0\uiknb2ac.newcfg
                                                                  • Size 925B
                                                                  • SHA256 8353db6eb1ea7ec5f268e3932dfc13a705442b7243ac535d489c98bf2587921a
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  user.config
                                                                  • Path C:\Users\Admin\AppData\Local\MarkAdderly\MakuTweaker_Url_qgiyyepz0cofqcgnuruwp0uc3dazhawo\5.7.3.0\user.config
                                                                  • Size 677B
                                                                  • SHA256 616ba3eb706da2f8d7602adf27bc8e5d6d46dad38a6075cbd2d838000370d71d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  zx2glm4y.newcfg
                                                                  • Path C:\Users\Admin\AppData\Local\MarkAdderly\MakuTweaker_Url_qgiyyepz0cofqcgnuruwp0uc3dazhawo\5.7.3.0\zx2glm4y.newcfg
                                                                  • Size 925B
                                                                  • SHA256 ddc737513daa59c1703985ea10e80a01d593b511a20fe0f448b318f394c76b88
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260817121557_000_windowsdesktop_runtime_8.0.15_win_x64.msi.log
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260817121557_000_windowsdesktop_runtime_8.0.15_win_x64.msi.log
                                                                  • Size 1KB
                                                                  • SHA256 2e273cad66be2fcfc6614a8bc8ffaa9a83d1767bd10e761243bcf8dc922fb0a7
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260817121557_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260817121557_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
                                                                  • Size 1KB
                                                                  • SHA256 d747520ed0f3736aefeb3db5e1ac31145db6fa76e45070665ef6d41829f3f6e7
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Microsoft_Windows_Desktop_Runtime_-_8.0.30_(x64)_20260817121529_000_dotnet_runtime_8.0.30_win_x64.msi.log
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.30_(x64)_20260817121529_000_dotnet_runtime_8.0.30_win_x64.msi.log
                                                                  • Size 4KB
                                                                  • SHA256 6e81d287afb379911ad6e7d1313188c2eedba53c3b8a9d1a8733c975e1499ee4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Microsoft_Windows_Desktop_Runtime_-_8.0.30_(x64)_20260817121529_001_dotnet_hostfxr_8.0.30_win_x64.msi.log
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.30_(x64)_20260817121529_001_dotnet_hostfxr_8.0.30_win_x64.msi.log
                                                                  • Size 2KB
                                                                  • SHA256 f78b0e9c29d8f3fb042d9f548734a3978a22bd568a56274e6b90856cc63365e5
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Microsoft_Windows_Desktop_Runtime_-_8.0.30_(x64)_20260817121529_002_dotnet_host_8.0.30_win_x64.msi.log
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.30_(x64)_20260817121529_002_dotnet_host_8.0.30_win_x64.msi.log
                                                                  • Size 2KB
                                                                  • SHA256 4e4d15589b1122044265c9223d038377022e72940ac2849d19320607c25ffbce
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Microsoft_Windows_Desktop_Runtime_-_8.0.30_(x64)_20260817121529_003_windowsdesktop_runtime_8.0.30_win_x64.msi.log
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.30_(x64)_20260817121529_003_windowsdesktop_runtime_8.0.30_win_x64.msi.log
                                                                  • Size 2KB
                                                                  • SHA256 6ecea17415426d8193bf84534dd6f2491ef64d14fc876a6fca7341329826f90b
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  __PSScriptPolicyTest_21qmqhfj.g1x.ps1
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_21qmqhfj.g1x.ps1
                                                                  • Size 60B
                                                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  MakuTweaker 5.7.3 Setup.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-Q78ELZF6M4.tmp\MakuTweaker 5.7.3 Setup.tmp
                                                                  • Size 4.7MB
                                                                  • SHA256 2c7c55deb27bf804c44ab728c14253281483c6f71683826bb7e3c39873fced50
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  MSI8112.tmp
                                                                  • Path C:\Windows\Installer\MSI8112.tmp
                                                                  • Size 219KB
                                                                  • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  thm.xml
                                                                  • Path C:\Windows\Temp\{1091E717-3AE8-4E9A-BC8B-E0C75D1CE148}\.ba\thm.xml
                                                                  • Size 11KB
                                                                  • SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  bg.png
                                                                  • Path C:\Windows\Temp\{270F2AF4-9C7D-4D0C-B761-04ABEEFDCBA5}\.ba\bg.png
                                                                  • Size 4KB
                                                                  • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  wixstdba.dll
                                                                  • Path C:\Windows\Temp\{270F2AF4-9C7D-4D0C-B761-04ABEEFDCBA5}\.ba\wixstdba.dll
                                                                  • Size 190KB
                                                                  • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  dotnet_host_8.0.30_win_x64.msi
                                                                  • Path C:\Windows\Temp\{270F2AF4-9C7D-4D0C-B761-04ABEEFDCBA5}\dotnet_host_8.0.30_win_x64.msi
                                                                  • Size 704KB
                                                                  • SHA256 0b0ad63c7b18e6c0773e4afad568791f05ddc9a3946a35df4cfd0794a64ad3ce
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  dotnet_hostfxr_8.0.30_win_x64.msi
                                                                  • Path C:\Windows\Temp\{270F2AF4-9C7D-4D0C-B761-04ABEEFDCBA5}\dotnet_hostfxr_8.0.30_win_x64.msi
                                                                  • Size 776KB
                                                                  • SHA256 a2cc64bb41815b405400f508d8e84011d9f4d5a7ec8dd7510f3138c7fe64967d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  dotnet_runtime_8.0.30_win_x64.msi
                                                                  • Path C:\Windows\Temp\{270F2AF4-9C7D-4D0C-B761-04ABEEFDCBA5}\dotnet_runtime_8.0.30_win_x64.msi
                                                                  • Size 26.3MB
                                                                  • SHA256 d7c6b8b56118c229b6eeb3843b3595f40501e2a3b3ebe7ae80416daefa638111
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  windowsdesktop_runtime_8.0.30_win_x64.msi
                                                                  • Path C:\Windows\Temp\{270F2AF4-9C7D-4D0C-B761-04ABEEFDCBA5}\windowsdesktop_runtime_8.0.30_win_x64.msi
                                                                  • Size 29.0MB
                                                                  • SHA256 cc6e4c72fd57ff5d39ea0efee670285d1eba1c498538e4de6b6d16358429c91e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  thm.wxl
                                                                  • Path C:\Windows\Temp\{7D558376-3D4B-46E9-A91D-BE2C33B0DC7A}\.ba\1033\thm.wxl
                                                                  • Size 5KB
                                                                  • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  dotnet8.exe
                                                                  • Path C:\Windows\Temp\{A8EEDF59-5646-4D50-9DDA-F40AC120A802}\.cr\dotnet8.exe
                                                                  • Size 607KB
                                                                  • SHA256 c9df5886d7f3fd3386e47226ea119753f2be71b699fc9d814dccaa82859d6a1a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  memory/624-955-0x0000000000750000-0x00000000007C6000-memory.dmp
                                                                  Download

                                                                  memory/1088-958-0x0000000000750000-0x00000000007C6000-memory.dmp
                                                                  Download

                                                                  memory/1276-1192-0x00000213B0140000-0x00000213B0141000-memory.dmp
                                                                  Download

                                                                  memory/1276-1193-0x00000213B0250000-0x00000213B0251000-memory.dmp
                                                                  Download

                                                                  memory/1276-1191-0x00000213B0140000-0x00000213B0141000-memory.dmp
                                                                  Download

                                                                  memory/1276-1189-0x00000213B0110000-0x00000213B0111000-memory.dmp
                                                                  Download

                                                                  memory/1276-1173-0x000002139FDA0000-0x000002139FDB0000-memory.dmp
                                                                  Download

                                                                  memory/1276-1157-0x000002139FCA0000-0x000002139FCB0000-memory.dmp
                                                                  Download

                                                                  memory/1688-1069-0x0000000000830000-0x000000000090F000-memory.dmp
                                                                  Download

                                                                  memory/1688-7-0x0000000000830000-0x000000000090F000-memory.dmp
                                                                  Download

                                                                  memory/1688-0-0x0000000000830000-0x000000000090F000-memory.dmp
                                                                  Download

                                                                  memory/2708-957-0x0000000000750000-0x00000000007C6000-memory.dmp
                                                                  Download

                                                                  memory/2820-8-0x0000000000390000-0x0000000000872000-memory.dmp
                                                                  Download

                                                                  memory/2820-1068-0x0000000000390000-0x0000000000872000-memory.dmp
                                                                  Download

                                                                  memory/2820-23-0x0000000000390000-0x0000000000872000-memory.dmp
                                                                  Download

                                                                  memory/2820-9-0x00000000012F0000-0x00000000012F1000-memory.dmp
                                                                  Download

                                                                  memory/2820-5-0x00000000012F0000-0x00000000012F1000-memory.dmp
                                                                  Download

                                                                  memory/2820-144-0x0000000000390000-0x0000000000872000-memory.dmp
                                                                  Download

                                                                  memory/4844-1121-0x0000022E654C0000-0x0000022E654E2000-memory.dmp
                                                                  Download

                                                                  memory/4844-1129-0x0000022E65950000-0x0000022E65966000-memory.dmp
                                                                  Download

                                                                  memory/4844-1131-0x0000022E659E0000-0x0000022E65A06000-memory.dmp
                                                                  Download

                                                                  memory/4844-1130-0x0000022E65970000-0x0000022E6597A000-memory.dmp
                                                                  Download