Overview

overview

8

Static

static

5

SaNet.st.D....0.zip

windows10-2004-x64

1

SaNet.st.D....0.zip

windows11-ltsc_2024-x64

8

SaNet.st.D...DD.exe

windows10-2004-x64

1

SaNet.st.D...DD.exe

windows11-ltsc_2024-x64

1

SaNet.st.D...DD.exe

windows10-2004-x64

1

SaNet.st.D...DD.exe

windows11-ltsc_2024-x64

1

SaNet.st.D...in.exe

windows10-2004-x64

4

SaNet.st.D...in.exe

windows11-ltsc_2024-x64

6

Resubmissions

24/10/2026, 14:11

261024-rhfkpscs5j8

24/10/2026, 14:06

261024-retyxsvthx7

24/10/2026, 13:43

261024-q1hbksas6z8

24/10/2026, 13:39

261024-qye4faas6s5

24/10/2026, 13:35

261024-qvv1gsb12j5

Analysis

  • user interaction
    yes
  • max time kernel
    317s
  • max time network
    318s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 14:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SaNet.st.Disk.Drill.Enterprise.6.3.1398.0.zip
  • Size 60.6MB
  • Sample261024-rhfkpscs5j
  • SHA256 bf267acff6b64b53adb4fd99ee84bb85eb25e0b3000e8b6e1ae454246ba0f4d3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarebootkitdefense_evasiondiscoverypersistencespywaretrojan

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 47 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 15 IoCs
    defense_evasionspywaretrojan
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0.zip
    1⤵
      PID:6120
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2524
      • C:\Users\Admin\Documents\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\disk-drill-win.exe
        "C:\Users\Admin\Documents\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\disk-drill-win.exe"
        1⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2252
        • C:\Windows\TEMP\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.ba\wixstdba.exe
          "C:\Windows\TEMP\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{40DB3934-D180-4707-BA5C-6EE6A7E763AD} {96B2CBD6-DB07-4939-BDAA-AB9743EEC8C2}
          2⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4940
          • C:\Program Files\CleverFiles\Disk Drill\DDLauncher.exe
            "C:\Program Files\CleverFiles\Disk Drill\DDLauncher.exe"
            3⤵
            • Executes dropped EXE
            PID:2996
            • C:\Windows\SYSTEM32\robocopy.exe
              "robocopy" "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.12" "C:\Program Files\CleverFiles\Disk Drill\dotnet\shared\Microsoft.NETCore.App\9.0.12" /MIR /MT:8
              4⤵
              • Drops file in Program Files directory
              PID:3216
            • C:\Windows\SYSTEM32\robocopy.exe
              "robocopy" "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.12" "C:\Program Files\CleverFiles\Disk Drill\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.12" /MIR /MT:8
              4⤵
              • Drops file in Program Files directory
              PID:2696
            • C:\Windows\SYSTEM32\robocopy.exe
              "robocopy" "C:\Program Files\dotnet\host\fxr\9.0.12" "C:\Program Files\CleverFiles\Disk Drill\dotnet\host\fxr\9.0.12" /MIR /MT:8
              4⤵
                PID:1988
              • C:\Program Files\CleverFiles\Disk Drill\DD.exe
                "DD.exe"
                4⤵
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Enumerates connected drives
                • Writes to the Master Boot Record (MBR)
                • Direct Volume Access: Opens a physical disk for reading
                • Reads the TCP/IP host and domain name from the registry
                • Checks SCSI registry key(s)
                • Checks processor information in registry
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Modifies system certificate store
                • NTFS ADS
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:1572
          • C:\Windows\TEMP\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe
            "C:\Windows\TEMP\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe" runtime 9 Microsoft.WindowsDesktop.App
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:5688
          • C:\Windows\TEMP\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.be\DiskDrillSetup.6.3.1398.0.exe
            "C:\Windows\TEMP\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.be\DiskDrillSetup.6.3.1398.0.exe" -q -burn.elevated BurnPipe.{E92BF1A1-C329-4010-96A1-F53E9FCF89C4} {200A9CB4-BFEB-4DDC-82EA-881F02FE871F} 2252
            2⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:3256
            • C:\ProgramData\Package Cache\B618F601A1989A696C8EFA0208EFD977A3BFE9A8DF8ACE8FAE9EEF20262240E7\vc_redist.14.50.35719.x64.exe
              "C:\ProgramData\Package Cache\B618F601A1989A696C8EFA0208EFD977A3BFE9A8DF8ACE8FAE9EEF20262240E7\vc_redist.14.50.35719.x64.exe" -log "C:\Users\Admin\AppData\Local\Temp\Disk_Drill_6.3.1398.0_20261024151316_000_vcredist_2019_x64.exe.log" -burn.embedded BurnPipe.{6CF62F6F-510A-4972-9F09-DAE4FA429689} {8C1825B4-E5C5-4518-96B1-6F8EEC40BC3C} 3256 /install /quiet /norestart
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4776
              • C:\Windows\Temp\{794207B1-EF39-469F-9114-9CB1564F085A}\.cr\vc_redist.14.50.35719.x64.exe
                "C:\Windows\Temp\{794207B1-EF39-469F-9114-9CB1564F085A}\.cr\vc_redist.14.50.35719.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\B618F601A1989A696C8EFA0208EFD977A3BFE9A8DF8ACE8FAE9EEF20262240E7\vc_redist.14.50.35719.x64.exe" -burn.filehandle.attached=768 -burn.filehandle.self=772 -log "C:\Users\Admin\AppData\Local\Temp\Disk_Drill_6.3.1398.0_20261024151316_000_vcredist_2019_x64.exe.log" -burn.embedded BurnPipe.{6CF62F6F-510A-4972-9F09-DAE4FA429689} {8C1825B4-E5C5-4518-96B1-6F8EEC40BC3C} 3256 /install /quiet /norestart
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5072
                • C:\Windows\Temp\{253298E5-1157-48F7-B22D-A31965AABBBE}\.be\VC_redist.x64.exe
                  "C:\Windows\Temp\{253298E5-1157-48F7-B22D-A31965AABBBE}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1BD0263E-C682-45D9-887B-DA609287B39B} {54FF0FFB-67B3-452B-8DE3-22ABEB8D0336} 5072
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4708
            • C:\ProgramData\Package Cache\A6687EF328597C90093A4278A12A0059496711801D84A40DC730511BADDE3D94\vc_redist.14.50.35719.x86.exe
              "C:\ProgramData\Package Cache\A6687EF328597C90093A4278A12A0059496711801D84A40DC730511BADDE3D94\vc_redist.14.50.35719.x86.exe" -log "C:\Users\Admin\AppData\Local\Temp\Disk_Drill_6.3.1398.0_20261024151316_001_vcredist_2019_x86.exe.log" -burn.embedded BurnPipe.{BFF0E885-E971-48DF-89DF-E3F68BA30843} {8669271C-920A-4BB9-A7C0-EDC2C9602623} 3256 /install /quiet /norestart
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2196
              • C:\Windows\Temp\{E3E9F3ED-34FE-40A7-90E9-092F4B45C5F3}\.cr\vc_redist.14.50.35719.x86.exe
                "C:\Windows\Temp\{E3E9F3ED-34FE-40A7-90E9-092F4B45C5F3}\.cr\vc_redist.14.50.35719.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\A6687EF328597C90093A4278A12A0059496711801D84A40DC730511BADDE3D94\vc_redist.14.50.35719.x86.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 -log "C:\Users\Admin\AppData\Local\Temp\Disk_Drill_6.3.1398.0_20261024151316_001_vcredist_2019_x86.exe.log" -burn.embedded BurnPipe.{BFF0E885-E971-48DF-89DF-E3F68BA30843} {8669271C-920A-4BB9-A7C0-EDC2C9602623} 3256 /install /quiet /norestart
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2464
                • C:\Windows\Temp\{0C299B2D-EC52-479E-8F1E-659FAC83F1B1}\.be\VC_redist.x86.exe
                  "C:\Windows\Temp\{0C299B2D-EC52-479E-8F1E-659FAC83F1B1}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{614F57A7-A89B-49BA-9827-AA97D47DED29} {E331920C-D46F-4111-A429-0DC7FBDF233A} 2464
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:3624
                  • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e4ccf1b-d073-4cfe-8a24-e86185719b56} -burn.filehandle.self=1080 -burn.embedded BurnPipe.{10FD715B-5B8D-4949-9167-A87BF9AF5238} {35BAD8A1-4AD8-43E6-AD47-03062D6E22D2} 3624
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3876
                    • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e4ccf1b-d073-4cfe-8a24-e86185719b56} -burn.filehandle.self=1080 -burn.embedded BurnPipe.{10FD715B-5B8D-4949-9167-A87BF9AF5238} {35BAD8A1-4AD8-43E6-AD47-03062D6E22D2} 3624
                      7⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5252
                      • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{D558D556-12F9-49BC-933A-5325D0294112} {AE7F4E72-38E7-485A-A632-85F68A492589} 5252
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:5700
            • C:\ProgramData\Package Cache\8E449A1C19402A7F82199ADEF308E96C02F93FFCD8E726E0D22DA1E113753210\windowsdesktop-runtime-9.0.12-win-x64.exe
              "C:\ProgramData\Package Cache\8E449A1C19402A7F82199ADEF308E96C02F93FFCD8E726E0D22DA1E113753210\windowsdesktop-runtime-9.0.12-win-x64.exe" /norestart /q
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1136
              • C:\Windows\Temp\{739CA27A-1F41-4EFF-95FC-A82C5A626454}\.cr\windowsdesktop-runtime-9.0.12-win-x64.exe
                "C:\Windows\Temp\{739CA27A-1F41-4EFF-95FC-A82C5A626454}\.cr\windowsdesktop-runtime-9.0.12-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\8E449A1C19402A7F82199ADEF308E96C02F93FFCD8E726E0D22DA1E113753210\windowsdesktop-runtime-9.0.12-win-x64.exe" -burn.filehandle.attached=696 -burn.filehandle.self=704 /norestart /q
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4248
                • C:\Windows\Temp\{32A8F067-B27A-4104-A198-3B0A95D33040}\.be\windowsdesktop-runtime-9.0.12-win-x64.exe
                  "C:\Windows\Temp\{32A8F067-B27A-4104-A198-3B0A95D33040}\.be\windowsdesktop-runtime-9.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{775DA73C-B649-43D1-8D2C-C6314907EB82} {91998510-6FF3-4104-93BF-98501F963B88} 4248
                  5⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4472
            • C:\ProgramData\Package Cache\10662485BEB4F1BFB01B2A53675A86C501A11305DA83B0CE80DD8427BCE5531C\DokanSetup.2.3.1.1000.exe
              "C:\ProgramData\Package Cache\10662485BEB4F1BFB01B2A53675A86C501A11305DA83B0CE80DD8427BCE5531C\DokanSetup.2.3.1.1000.exe" -log "C:\Users\Admin\AppData\Local\Temp\Disk_Drill_6.3.1398.0_20261024151316_003_DokanSetup.exe.log" -burn.embedded BurnPipe.{205341DF-98B4-4ED3-AD46-A52E95508A15} {E555F808-4718-410B-854A-718337B15196} 3256 /norestart /quiet /install
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2684
              • C:\Windows\TEMP\{91EBF5A6-4552-4BF2-BA28-18844DCFF94F}\.ba\wixstdba.exe
                "C:\Windows\TEMP\{91EBF5A6-4552-4BF2-BA28-18844DCFF94F}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{1CFA2979-98A7-49EF-B748-3108A6445DC1} {85CA0B34-90C0-4545-BDBD-DE5466C5EA03}
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2528
              • C:\Windows\TEMP\{91EBF5A6-4552-4BF2-BA28-18844DCFF94F}\.be\DokanSetup.exe
                "C:\Windows\TEMP\{91EBF5A6-4552-4BF2-BA28-18844DCFF94F}\.be\DokanSetup.exe" -q -burn.elevated BurnPipe.{EB8953E3-C899-4C36-B150-E782D0B329E7} {FD530FD8-BE9A-46B9-AC61-871513FC427C} 2684
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:3456
        • C:\ProgramData\Package Cache\{E6E5DD13-939D-4CB1-8E74-ACBF3501726B}\DiskDrillSetup.6.3.1398.0.exe
          "C:\ProgramData\Package Cache\{E6E5DD13-939D-4CB1-8E74-ACBF3501726B}\DiskDrillSetup.6.3.1398.0.exe" /burn.runonce
          1⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1792
          • C:\ProgramData\Package Cache\{E6E5DD13-939D-4CB1-8E74-ACBF3501726B}\DiskDrillSetup.6.3.1398.0.exe
            "C:\ProgramData\Package Cache\{E6E5DD13-939D-4CB1-8E74-ACBF3501726B}\DiskDrillSetup.6.3.1398.0.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Disk_Drill_6.3.1398.0_20261024151316.log"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:3668
            • C:\Windows\TEMP\{16018CB2-2686-48C8-AA2D-866872B4538A}\.ba\wixstdba.exe
              "C:\Windows\TEMP\{16018CB2-2686-48C8-AA2D-866872B4538A}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{E2A693A6-6E44-4BB7-9350-1DD476C7CDAA} {B6EDDE40-2089-49F6-BCAA-00366EA5B1C1}
              3⤵
              • Executes dropped EXE
              • Suspicious use of FindShellTrayWindow
              PID:5536
            • C:\Windows\TEMP\{16018CB2-2686-48C8-AA2D-866872B4538A}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe
              "C:\Windows\TEMP\{16018CB2-2686-48C8-AA2D-866872B4538A}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe" runtime 9 Microsoft.WindowsDesktop.App
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Time Discovery
              PID:1484
            • C:\ProgramData\Package Cache\{E6E5DD13-939D-4CB1-8E74-ACBF3501726B}\DiskDrillSetup.6.3.1398.0.exe
              "C:\ProgramData\Package Cache\{E6E5DD13-939D-4CB1-8E74-ACBF3501726B}\DiskDrillSetup.6.3.1398.0.exe" -q -burn.elevated BurnPipe.{F1F5EDFB-78AB-4635-ADE5-AF21B48DA55E} {438C70B4-563E-4DB8-B422-AB2FAA11D6EE} 3668
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:5688
              • C:\ProgramData\Package Cache\B618F601A1989A696C8EFA0208EFD977A3BFE9A8DF8ACE8FAE9EEF20262240E7\vc_redist.14.50.35719.x64.exe
                "C:\ProgramData\Package Cache\B618F601A1989A696C8EFA0208EFD977A3BFE9A8DF8ACE8FAE9EEF20262240E7\vc_redist.14.50.35719.x64.exe" -log "" -burn.embedded BurnPipe.{9EC8E054-375D-44F4-B827-419342690B5E} {1CF646B0-4B55-4C9B-9CBD-34AF94871C4F} 5688 /install /quiet /norestart
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4352
                • C:\Windows\Temp\{487B0C0C-BA0B-4BD7-A3FD-A34E19A0686B}\.cr\vc_redist.14.50.35719.x64.exe
                  "C:\Windows\Temp\{487B0C0C-BA0B-4BD7-A3FD-A34E19A0686B}\.cr\vc_redist.14.50.35719.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\B618F601A1989A696C8EFA0208EFD977A3BFE9A8DF8ACE8FAE9EEF20262240E7\vc_redist.14.50.35719.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 -log "" -burn.embedded BurnPipe.{9EC8E054-375D-44F4-B827-419342690B5E} {1CF646B0-4B55-4C9B-9CBD-34AF94871C4F} 5688 /install /quiet /norestart
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5264
                  • C:\Windows\Temp\{D3048009-78F3-4C8D-8393-7E10A029B66F}\.be\VC_redist.x64.exe
                    "C:\Windows\Temp\{D3048009-78F3-4C8D-8393-7E10A029B66F}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C4DCC5DB-8074-48C1-A4AD-297693A2FC72} {C8A52A45-EB76-4E99-AD9B-F36CB2CAB8B7} 5264
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:4524
                    • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=856 -burn.embedded BurnPipe.{68CA0FDC-592F-42E6-902B-3B0EFB46CD36} {AFC44E22-6A8F-41BB-A42D-7B35E0D18EB3} 4524
                      7⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2920
                      • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=856 -burn.embedded BurnPipe.{68CA0FDC-592F-42E6-902B-3B0EFB46CD36} {AFC44E22-6A8F-41BB-A42D-7B35E0D18EB3} 4524
                        8⤵
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5060
                        • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                          "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{F4C7F137-D1E1-4288-A5C9-3E2515EB7D1E} {505D5109-E574-4A5B-A88D-5B05CE7C5EB7} 5060
                          9⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          PID:4656
              • C:\ProgramData\Package Cache\A6687EF328597C90093A4278A12A0059496711801D84A40DC730511BADDE3D94\vc_redist.14.50.35719.x86.exe
                "C:\ProgramData\Package Cache\A6687EF328597C90093A4278A12A0059496711801D84A40DC730511BADDE3D94\vc_redist.14.50.35719.x86.exe" -log "" -burn.embedded BurnPipe.{62B58499-7DBF-407D-A55F-AB2D5B9D8527} {B2CA37FF-9317-4A21-8741-1B16CE976415} 5688 /install /quiet /norestart
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5652
                • C:\Windows\Temp\{830C2AB3-34DB-4AFF-9A1B-102DF073C7CB}\.cr\vc_redist.14.50.35719.x86.exe
                  "C:\Windows\Temp\{830C2AB3-34DB-4AFF-9A1B-102DF073C7CB}\.cr\vc_redist.14.50.35719.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\A6687EF328597C90093A4278A12A0059496711801D84A40DC730511BADDE3D94\vc_redist.14.50.35719.x86.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 -log "" -burn.embedded BurnPipe.{62B58499-7DBF-407D-A55F-AB2D5B9D8527} {B2CA37FF-9317-4A21-8741-1B16CE976415} 5688 /install /quiet /norestart
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2312
                  • C:\Windows\Temp\{AB14BFAB-140D-424B-B77F-480FD3CB34C5}\.be\VC_redist.x86.exe
                    "C:\Windows\Temp\{AB14BFAB-140D-424B-B77F-480FD3CB34C5}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{07B804D5-19D7-4A01-97ED-9F8B79563554} {B8797072-5361-4797-925A-1DC9EBF995D2} 2312
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:3748
              • C:\ProgramData\Package Cache\8E449A1C19402A7F82199ADEF308E96C02F93FFCD8E726E0D22DA1E113753210\windowsdesktop-runtime-9.0.12-win-x64.exe
                "C:\ProgramData\Package Cache\8E449A1C19402A7F82199ADEF308E96C02F93FFCD8E726E0D22DA1E113753210\windowsdesktop-runtime-9.0.12-win-x64.exe" /norestart /q
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4632
                • C:\Windows\Temp\{360AE97B-884D-448A-9063-FD79618019D9}\.cr\windowsdesktop-runtime-9.0.12-win-x64.exe
                  "C:\Windows\Temp\{360AE97B-884D-448A-9063-FD79618019D9}\.cr\windowsdesktop-runtime-9.0.12-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\8E449A1C19402A7F82199ADEF308E96C02F93FFCD8E726E0D22DA1E113753210\windowsdesktop-runtime-9.0.12-win-x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /norestart /q
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5732
                  • C:\Windows\Temp\{17BC54D4-C5A9-4208-9908-89CD77FA4E22}\.be\windowsdesktop-runtime-9.0.12-win-x64.exe
                    "C:\Windows\Temp\{17BC54D4-C5A9-4208-9908-89CD77FA4E22}\.be\windowsdesktop-runtime-9.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{0A379FFE-96E7-4143-B307-2BCF26831E33} {8D1711F1-6DDC-4C9F-B7EF-9042750EF740} 5732
                    6⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:3968
              • C:\ProgramData\Package Cache\10662485BEB4F1BFB01B2A53675A86C501A11305DA83B0CE80DD8427BCE5531C\DokanSetup.2.3.1.1000.exe
                "C:\ProgramData\Package Cache\10662485BEB4F1BFB01B2A53675A86C501A11305DA83B0CE80DD8427BCE5531C\DokanSetup.2.3.1.1000.exe" -log "" -burn.embedded BurnPipe.{989516C8-12ED-4FA5-88BA-9F12830432D3} {039CFC69-35EA-498D-AA54-E7DF42658EC7} 5688 /norestart /quiet /install
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3708
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2876
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding AC3CC216E4A189978D49D9D21DD6EEC9
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5084
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 030971B3D8398B2875F9506CC5BC2642
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4492
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding BDF6645A1761E8F82F5265615621965B
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5108
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding F20EB56CB85B2A13111A78A5DD5B10F3
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5804
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding D6DD1E730B2F1241D08C9D3DFC4638AE
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:3416
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding B2DD2DE70AC520331F1D0B3EAE047B13
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1724
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding A2E98FB863DCCBA376A00E03E337E920
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2012
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding F5511C07359967C234F502506847F7E1
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4780
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 7009BBF7A0D8AF02EEFC3957AD2B554D
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2004
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 82F0C5EF642FC110C0FBB7C14B11B360
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5004
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 384EC49FFB46AB5BE529E7C0064D081E
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2836
          • C:\Windows\System32\MsiExec.exe
            C:\Windows\System32\MsiExec.exe -Embedding AE0DE8A5E5C7B88B011F21C0F27D91CB
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:832
            • C:\Windows\system32\rundll32.exe
              rundll32.exe "C:\Windows\Installer\MSIDDB1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240967218 67 msiGaCustomActionV4!msiGaCustomActionV4.CustomActions.gaCheckInstallPathCustomAction
              3⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:2524
            • C:\Windows\system32\rundll32.exe
              rundll32.exe "C:\Windows\Installer\MSIE0FF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240968015 77 msiGaCustomActionV4!msiGaCustomActionV4.CustomActions.gaCheckInstallConditionCustomAction
              3⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:1912
            • C:\Windows\system32\rundll32.exe
              rundll32.exe "C:\Windows\Installer\MSIEF6A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240971656 99 msiGaCustomActionV4!msiGaCustomActionV4.CustomActions.gaSuccessCustomAction
              3⤵
              • Badlisted process makes network request
              • Loads dropped DLL
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              PID:5068
          • C:\Windows\System32\MsiExec.exe
            C:\Windows\System32\MsiExec.exe -Embedding 4DBCBEE8F71C9368D0CABF23501D6ECB E Global\MSI0000
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:780
            • C:\Windows\System32\taskkill.exe
              "C:\Windows\\System32\taskkill.exe" /F /IM DD.exe
              3⤵
              • Kills process with taskkill
              PID:816
          • C:\Program Files\CleverFiles\Disk Drill\cfbackd.w32.exe
            "C:\Program Files\CleverFiles\Disk Drill\cfbackd.w32.exe" -i
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:364
          • C:\Windows\System32\MsiExec.exe
            C:\Windows\System32\MsiExec.exe -Embedding DAFC912C70C3F0B6569D2B902F1F12D3
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2744
            • C:\Windows\system32\rundll32.exe
              rundll32.exe "C:\Windows\Installer\MSID34.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240979312 108 msiGaCustomActionV4!msiGaCustomActionV4.CustomActions.gaCheckInstallPathCustomAction
              3⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:4436
            • C:\Windows\system32\rundll32.exe
              rundll32.exe "C:\Windows\Installer\MSI1014.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240980000 119 msiGaCustomActionV4!msiGaCustomActionV4.CustomActions.gaCheckInstallConditionCustomAction
              3⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:2760
            • C:\Windows\system32\rundll32.exe
              rundll32.exe "C:\Windows\Installer\MSI146C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240981109 141 msiGaCustomActionV4!msiGaCustomActionV4.CustomActions.gaSuccessCustomAction
              3⤵
              • Badlisted process makes network request
              • Loads dropped DLL
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              PID:4572
          • C:\Windows\System32\MsiExec.exe
            C:\Windows\System32\MsiExec.exe -Embedding E59C4622C959C9C727EF383A3F1F2BAF E Global\MSI0000
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3536
            • C:\Windows\System32\taskkill.exe
              "C:\Windows\\System32\taskkill.exe" /F /IM DD.exe
              3⤵
              • Kills process with taskkill
              PID:5780
          • C:\Program Files\CleverFiles\Disk Drill\cfbackd.w32.exe
            "C:\Program Files\CleverFiles\Disk Drill\cfbackd.w32.exe" -i
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4220
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              3⤵
                PID:2004
          • C:\ProgramData\Package Cache\{8a3524df-7973-474d-bf63-3c2d1d8fa368}\windowsdesktop-runtime-9.0.12-win-x64.exe
            "C:\ProgramData\Package Cache\{8a3524df-7973-474d-bf63-3c2d1d8fa368}\windowsdesktop-runtime-9.0.12-win-x64.exe" /burn.runonce
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1100
            • C:\ProgramData\Package Cache\{8a3524df-7973-474d-bf63-3c2d1d8fa368}\windowsdesktop-runtime-9.0.12-win-x64.exe
              "C:\ProgramData\Package Cache\{8a3524df-7973-474d-bf63-3c2d1d8fa368}\windowsdesktop-runtime-9.0.12-win-x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.12_(x64)_20261024151410.log"
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5500
              • C:\ProgramData\Package Cache\{8a3524df-7973-474d-bf63-3c2d1d8fa368}\windowsdesktop-runtime-9.0.12-win-x64.exe
                "C:\ProgramData\Package Cache\{8a3524df-7973-474d-bf63-3c2d1d8fa368}\windowsdesktop-runtime-9.0.12-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8a3524df-7973-474d-bf63-3c2d1d8fa368}\windowsdesktop-runtime-9.0.12-win-x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.12_(x64)_20261024151410.log"
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4712
                • C:\ProgramData\Package Cache\{8a3524df-7973-474d-bf63-3c2d1d8fa368}\windowsdesktop-runtime-9.0.12-win-x64.exe
                  "C:\ProgramData\Package Cache\{8a3524df-7973-474d-bf63-3c2d1d8fa368}\windowsdesktop-runtime-9.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{FA86E49A-CA56-4208-B2C5-C9F5B49257B2} {E86F5F6D-D84D-4DA3-A7FC-CFB0D90E4BFF} 4712
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4444
          • C:\Program Files\CleverFiles\Disk Drill\cfbackd.w32.exe
            "C:\Program Files\CleverFiles\Disk Drill\cfbackd.w32.exe"
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2388
          • C:\Users\Admin\Documents\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\Crack UZ1\DD.exe
            "C:\Users\Admin\Documents\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\Crack UZ1\DD.exe"
            1⤵
              PID:5356
            • C:\Program Files\CleverFiles\Disk Drill\cfbackd.w32.exe
              "C:\Program Files\CleverFiles\Disk Drill\cfbackd.w32.exe"
              1⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4676
            • C:\Users\Admin\Documents\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\Crack UZ1\DD.exe
              "C:\Users\Admin\Documents\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\Crack UZ1\DD.exe"
              1⤵
                PID:4240
              • C:\Windows\system32\OpenWith.exe
                C:\Windows\system32\OpenWith.exe -Embedding
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:4148
              • C:\Users\Admin\Documents\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\Crack UZ1\DD.exe
                "C:\Users\Admin\Documents\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\SaNet.st.Disk.Drill.Enterprise.6.3.1398.0\Crack UZ1\DD.exe"
                1⤵
                  PID:2376
                • C:\Program Files\CleverFiles\Disk Drill\DD.exe
                  "C:\Program Files\CleverFiles\Disk Drill\DD.exe"
                  1⤵
                  • Checks BIOS information in registry
                  • Enumerates connected drives
                  • Writes to the Master Boot Record (MBR)
                  • Checks SCSI registry key(s)
                  • Checks processor information in registry
                  • NTFS ADS
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:3144

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Pre-OS Boot

                      1
                      T1542

                      Bootkit

                      1
                      T1542.003

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Defense Evasion

                      Direct Volume Access

                      1
                      T1006

                      Modify Registry

                      3
                      T1112

                      Pre-OS Boot

                      1
                      T1542

                      Bootkit

                      1
                      T1542.003

                      Subvert Trust Controls

                      1
                      T1553

                      Install Root Certificate

                      1
                      T1553.004

                      Credential Access

                      Discovery

                      Network Share Discovery

                      1
                      T1135

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      5
                      T1012

                      System Information Discovery

                      5
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      1
                      T1016

                      System Time Discovery

                      1
                      T1124

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      e5c0135.rbs
                      • Path C:\Config.Msi\e5c0135.rbs
                      • Size 19KB
                      • SHA256 33628504a00bfd6b607cfe5061428a930a8fcb078973364c54d309c79125eaf9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5c0141.rbs
                      • Path C:\Config.Msi\e5c0141.rbs
                      • Size 19KB
                      • SHA256 f097c8ef4f44eb691d58aec8bf40151d3377497680bf0d9fcec6c8693d960bd5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5c0148.rbs
                      • Path C:\Config.Msi\e5c0148.rbs
                      • Size 21KB
                      • SHA256 34f99d5603e9d7982a5666260170471f1c1ce017ae56c99e5b52df7919f20e6c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5c0157.rbs
                      • Path C:\Config.Msi\e5c0157.rbs
                      • Size 21KB
                      • SHA256 286a503c0805ee42109109c2f1d4171be9fc461a054f6734018e6e2df774e328
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5c015e.rbs
                      • Path C:\Config.Msi\e5c015e.rbs
                      • Size 16KB
                      • SHA256 d31184c54f57aa48d34611e6ff5f776b65b79a44e5345bb39f0dff8b74bb000d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5c0163.rbs
                      • Path C:\Config.Msi\e5c0163.rbs
                      • Size 18KB
                      • SHA256 1af792998797080b8972a02a7fceccd6a47b7f5e4dcb075bc29cd30136664bf6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5c0170.rbs
                      • Path C:\Config.Msi\e5c0170.rbs
                      • Size 20KB
                      • SHA256 4d1aec7780fca1cf54b0e682fd13255b9b62c4bb6be91a0840796e39b7178fe0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5c017f.rbs
                      • Path C:\Config.Msi\e5c017f.rbs
                      • Size 19KB
                      • SHA256 747feec8303a6a4b05f2ea9466d505721cd5ffd9950a49d577f969e830d920a8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5c0183.rbs
                      • Path C:\Config.Msi\e5c0183.rbs
                      • Size 3KB
                      • SHA256 fee9ac094c6ac2c30fc4e04f0cb1537d4004b0c9c5363c9f0bb23147c23a9edc
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      e5c0186.rbs
                      • Path C:\Config.Msi\e5c0186.rbs
                      • Size 3KB
                      • SHA256 7621d2374edcec929ab3aee6c61edecc9883332e969e08b29241e39ff9dcbb82
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      e5c018a.rbs
                      • Path C:\Config.Msi\e5c018a.rbs
                      • Size 48KB
                      • SHA256 3748ba6d19ec18a7d3b2dc2c549f521b99bbe79550f18e922e498587f4c460cb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5c018e.rbs
                      • Path C:\Config.Msi\e5c018e.rbs
                      • Size 3KB
                      • SHA256 eda68a9e42071303b0caa1cda5d75799985bda669498cba5a74e1d9dcd40ab77
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      e5c0192.rbs
                      • Path C:\Config.Msi\e5c0192.rbs
                      • Size 9KB
                      • SHA256 903aeb82363f3c5f8a85a61d12dc1c0f6e95bf38e773cf889827759ff2259359
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5c0196.rbs
                      • Path C:\Config.Msi\e5c0196.rbs
                      • Size 3KB
                      • SHA256 9f72f3ee53b42beb3e214b7be3593ffe63e27b47d2a38513d014568200e154a4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      e5c019d.rbs
                      • Path C:\Config.Msi\e5c019d.rbs
                      • Size 10KB
                      • SHA256 cf8f4cb854649582951cca138e1c05e11d32201283d308f6c6a70d72bb4bb02d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5c01a3.rbs
                      • Path C:\Config.Msi\e5c01a3.rbs
                      • Size 3KB
                      • SHA256 62f62dc45a36e8af1bee811c21670eeb9a121f694045a20807a43bbfadf8eb6e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      e5c01aa.rbs
                      • Path C:\Config.Msi\e5c01aa.rbs
                      • Size 88KB
                      • SHA256 95af35f2c76c9a1a62e43e556b40abd0a2fe7dbb77f846bbb016be4a26f1107e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5c01ae.rbs
                      • Path C:\Config.Msi\e5c01ae.rbs
                      • Size 3KB
                      • SHA256 f8f1896defd616ab5c19bdda42fca456af102f6ffb47755f28993a564582c0fb
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      e5c01b3.rbs
                      • Path C:\Config.Msi\e5c01b3.rbs
                      • Size 29KB
                      • SHA256 81fe3da7ac9e6f9beb8b8e417b937683b299edf0649ba10ef8e30eaf9e6d00fb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5c01b5.rbs
                      • Path C:\Config.Msi\e5c01b5.rbs
                      • Size 3KB
                      • SHA256 e05f34c36ef769fa48b6e15f3cbe46f308d121acd35df307df8c22c20957ab05
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      DDLauncher.exe
                      • Path C:\Program Files\CleverFiles\Disk Drill\DDLauncher.exe
                      • Size 386KB
                      • SHA256 8bd046be7be46447221a9dd7694ba6c1e335aaf2d50cdd2dc74d5979f954e509
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ThirdPartyNotices.txt
                      • Path C:\Program Files\dotnet\ThirdPartyNotices.txt
                      • Size 77KB
                      • SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dotnet.exe
                      • Path C:\Program Files\dotnet\dotnet.exe
                      • Size 158KB
                      • SHA256 a399333d6f2e8c9a702542d478e60853a009b32d936e95b0ca0306f0ae97ccf3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      state.rsm
                      • Path C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\state.rsm
                      • Size 1KB
                      • SHA256 5dbb8c251e72bd19bbf328a987f44ed7dc65fc37887e88b6d3bdb67fbb0b9adf
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      state.rsm
                      • Path C:\ProgramData\Package Cache\{8a3524df-7973-474d-bf63-3c2d1d8fa368}\state.rsm
                      • Size 1KB
                      • SHA256 b6d6c7e4c2865ad7562d3a5af739f116792a51eafe47118ca230ca75b2f77233
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      state.rsm
                      • Path C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\state.rsm
                      • Size 1KB
                      • SHA256 aa8265324c6b3f7c0256a7c26a8faa60b8346247b500686ebd67682926e5207d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      state.rsm
                      • Path C:\ProgramData\Package Cache\{E6E5DD13-939D-4CB1-8E74-ACBF3501726B}\state.rsm
                      • Size 1KB
                      • SHA256 6bb01115485eba28f476bdbe3d8a1b611b32cec91b6e37e3e4d8df20971d450c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      windowsdesktop-runtime-9.0.12-win-x64.msi
                      • Path C:\ProgramData\Package Cache\{FE52B4ED-13FE-4577-AF57-150ED5995731}v72.48.45460\windowsdesktop-runtime-9.0.12-win-x64.msi
                      • Size 29.8MB
                      • SHA256 0cd2d06af2e302302bef8dba2646dfd41a99c2c0281a49cd409a1504c42d9e8a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DDInstall.cpccLog.txt
                      • Path C:\Users\Admin\AppData\Local\Temp\DDInstall.cpccLog.txt
                      • Size 312B
                      • SHA256 53c4f355536691c287788234ef94ec1619efd86058fb85daa5bbc34492db5435
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      DDInstall.cpccLog.txt
                      • Path C:\Users\Admin\AppData\Local\Temp\DDInstall.cpccLog.txt
                      • Size 1KB
                      • SHA256 ea0f8eb231150ef89f7a1600cd1f5f225d121d749bf60283741f0833ce2d3647
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Disk_Drill_6.3.1398.0_20261024151316_000_vcredist_2019_x64.exe_000_vcRuntimeMinimum_x64.log
                      • Path C:\Users\Admin\AppData\Local\Temp\Disk_Drill_6.3.1398.0_20261024151316_000_vcredist_2019_x64.exe_000_vcRuntimeMinimum_x64.log
                      • Size 2KB
                      • SHA256 41f942780bc68461b6c9d141aa88dda0f815dcf85db3f06bff668483923621c9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Disk_Drill_6.3.1398.0_20261024151316_000_vcredist_2019_x64.exe_001_vcRuntimeAdditional_x64.log
                      • Path C:\Users\Admin\AppData\Local\Temp\Disk_Drill_6.3.1398.0_20261024151316_000_vcredist_2019_x64.exe_001_vcRuntimeAdditional_x64.log
                      • Size 2KB
                      • SHA256 5e2938ab5a40b0e51ff1519acc3b05d53dd9fb550c0bc847fef7bf976281c5e2
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Disk_Drill_6.3.1398.0_20261024151316_003_DokanSetup.exe_000_Dokan_x64.msi.log
                      • Path C:\Users\Admin\AppData\Local\Temp\Disk_Drill_6.3.1398.0_20261024151316_003_DokanSetup.exe_000_Dokan_x64.msi.log
                      • Size 11KB
                      • SHA256 4364580b4db4cefa726b9c7eed97ae630b62a91a36983ea5ac99c7a2cd489b05
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      u2dcsnq5.z0c
                      • Path C:\Users\Admin\AppData\Local\Temp\WPF\u2dcsnq5.z0c
                      • Size 326B
                      • SHA256 2e3a2c34cc9728cb3c1915e1c778fd0d63d46ac8e238c90726c96e4a31042357
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      DD.Setup.x64.msi
                      • Path C:\Users\Admin\AppData\Local\Temp\{D75B3132-4B70-4A47-9179-7B78F00158F2}\DD.Setup.x64.msi
                      • Size 27.0MB
                      • SHA256 5f2d7dd8b6350fa0e6592db225dbecda3373e87615ede8e2cb84aa4d9dc5b6fb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DokanSetup.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\{D75B3132-4B70-4A47-9179-7B78F00158F2}\DokanSetup.exe
                      • Size 18.3MB
                      • SHA256 bf602263a594f595b4fdd8c4e822172b103de93f07fd6a51a8ff69569bfd1460
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vcredist_2019_x64.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\{D75B3132-4B70-4A47-9179-7B78F00158F2}\vcredist_2019_x64.exe
                      • Size 17.7MB
                      • SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vcredist_2019_x86.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\{D75B3132-4B70-4A47-9179-7B78F00158F2}\vcredist_2019_x86.exe
                      • Size 6.6MB
                      • SHA256 e7267c1bdf9237c0b4a28cf027c382b97aa909934f84f1c92d3fb9f04173b33e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSI71C9.tmp
                      • Path C:\Windows\Installer\MSI71C9.tmp
                      • Size 219KB
                      • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSI7F80.tmp
                      • Path C:\Windows\Installer\MSI7F80.tmp
                      • Size 734B
                      • SHA256 4a24e46aff62e1c66d0535a3e913e4a7ba4b870bac95911b21627d01cb12d807
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      MSI8A27.tmp
                      • Path C:\Windows\Installer\MSI8A27.tmp
                      • Size 707B
                      • SHA256 f2a0716052692b5d573dfcfd6306a9458ab2d24aeadf5c39a18297db18912814
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      MSIA99F.tmp
                      • Path C:\Windows\Installer\MSIA99F.tmp
                      • Size 746B
                      • SHA256 bbb3547a2296d984c941919d4d94a73592bbc1cbf4bfbdee9110f09fd31ef0a1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      MSIE0FF.tmp
                      • Path C:\Windows\Installer\MSIE0FF.tmp
                      • Size 2.0MB
                      • SHA256 cf9c51be865aef8810da44ea70bdcb21be94a2779c043a6f2c3556fb22386e0b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSIE547.tmp
                      • Path C:\Windows\Installer\MSIE547.tmp
                      • Size 390KB
                      • SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mscorlib.dll
                      • Path C:\Windows\Installer\SFXCA2A7F80217C4630EB9D8B70FD87E78E76\mscorlib.dll
                      • Size 4.4MB
                      • SHA256 10e1308c983a519b894c4c48e22f9d6bab691f7af5d150bcbee21820dfc15190
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mscorlib.resources.dll
                      • Path C:\Windows\Installer\SFXCA2A7F80217C4630EB9D8B70FD87E78E76\mscorlib.resources.dll
                      • Size 397KB
                      • SHA256 645fd24697a574bdedeadc8ca2293b5c78c677324342dd50b1cdd925e85226b6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      libSoftMeter.dll
                      • Path C:\Windows\Installer\SFXCA80F0BDF47649B8E9664626AF62BEE9E1\libSoftMeter.dll
                      • Size 931KB
                      • SHA256 735006e0e39a3d38f42be4ee96434a239d2ba827ce7bc3e95d74c7cc8ce800da
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CustomAction.config
                      • Path C:\Windows\Installer\SFXCA9CE17E3E6E4466297C1DB013DDDF9969\CustomAction.config
                      • Size 970B
                      • SHA256 4d3968b5ed76aceb10b0d9ce6a4bb809e98d0694c227f5254c17d4914506142d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      WixToolset.Dtf.WindowsInstaller.dll
                      • Path C:\Windows\Installer\SFXCA9CE17E3E6E4466297C1DB013DDDF9969\WixToolset.Dtf.WindowsInstaller.dll
                      • Size 193KB
                      • SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      msiGaCustomActionV4.dll
                      • Path C:\Windows\Installer\SFXCA9CE17E3E6E4466297C1DB013DDDF9969\msiGaCustomActionV4.dll
                      • Size 28KB
                      • SHA256 04a7010921efd9d959755bd4d97a2383850c4552017fedefb5bc15ecb9e3450d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\TEMP\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.ba\1033\thm.wxl
                      • Size 5KB
                      • SHA256 5e371262d9020a6b5a068c26d322543163148473e58342f13d77f0b18fdaefed
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      BootstrapperApplicationData.xml
                      • Path C:\Windows\TEMP\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.ba\BootstrapperApplicationData.xml
                      • Size 16KB
                      • SHA256 060f88080c0d8ef9d56709402e1004c40ae88d6647b4ed5f9da16703851080c4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DD.ico
                      • Path C:\Windows\TEMP\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.ba\DD.ico
                      • Size 220KB
                      • SHA256 5c45a051dd6cd7ca010a30898eb36b72452517924cc769dd4535dd5839be8c6a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      hostfxr.dll
                      • Path C:\Windows\TEMP\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\hostfxr.dll
                      • Size 366KB
                      • SHA256 cbde5e0bb9260e4ceeb0c7d774cb3aba0f885f150c9c8fe3922da4c71125f628
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      logo-200pct.png
                      • Path C:\Windows\TEMP\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.ba\logo-200pct.png
                      • Size 231KB
                      • SHA256 7fa4ca56fdde25236d18f0dfa5d94dffc918358fe7cea58e1c23dbe3af7cc073
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      logo.png
                      • Path C:\Windows\TEMP\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.ba\logo.png
                      • Size 80KB
                      • SHA256 bcc352480c5bb9be1021442b5f1c948a33504d75b9c76f899eb3244e0b40c786
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      thm.xml
                      • Path C:\Windows\TEMP\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.ba\thm.xml
                      • Size 9KB
                      • SHA256 f4c0b1b149aaa5655c21beccac78914b3359562ea9edcd99ad026c0612fdee2a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{0C299B2D-EC52-479E-8F1E-659FAC83F1B1}\.ba\1028\thm.wxl
                      • Size 3KB
                      • SHA256 c1fe572ca3dd4387e473272bc9f2a2da5dbee58fa8ad6010eb308e119c903da0
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{0C299B2D-EC52-479E-8F1E-659FAC83F1B1}\.ba\1029\thm.wxl
                      • Size 3KB
                      • SHA256 1aa579e8e2cb828c9bbbd598e837d6923262fc4c8fbc1ee30b166cfcb10a849c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{0C299B2D-EC52-479E-8F1E-659FAC83F1B1}\.ba\1031\thm.wxl
                      • Size 3KB
                      • SHA256 4f3601c2c80999ca9a2ab7c42c1170220f1ff4d958d210d12e50168631c303ab
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{0C299B2D-EC52-479E-8F1E-659FAC83F1B1}\.ba\1036\thm.wxl
                      • Size 3KB
                      • SHA256 4127145ea3ccc42f9364fefa3eaf7f50e3229eb6ab2ebcdca33a0609003a69a5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{0C299B2D-EC52-479E-8F1E-659FAC83F1B1}\.ba\1040\thm.wxl
                      • Size 3KB
                      • SHA256 5d3c97e5ac0b8bac06f6a0c6e3edd92ab5c2c8978543c770b826139edf624c24
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{0C299B2D-EC52-479E-8F1E-659FAC83F1B1}\.ba\1041\thm.wxl
                      • Size 4KB
                      • SHA256 04ce070c6f65c85958cd1d5518327bcd615469910f02254dcbbd5f95eebb2212
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{0C299B2D-EC52-479E-8F1E-659FAC83F1B1}\.ba\1042\thm.wxl
                      • Size 3KB
                      • SHA256 cd825881d63ea021d6002eb8375d51a508fcb784fb90753e6323776a3e651aaa
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{0C299B2D-EC52-479E-8F1E-659FAC83F1B1}\.ba\1045\thm.wxl
                      • Size 3KB
                      • SHA256 49323aaa73e4dfa7dff2dfce004d89cc1d2d4f7d7d530f4cae0b67cf9f91c789
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{0C299B2D-EC52-479E-8F1E-659FAC83F1B1}\.ba\1046\thm.wxl
                      • Size 3KB
                      • SHA256 cc146b6e1788bff1d0363ca894229b13632b8546a76a55ea1a4cc2dbb4470aba
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{0C299B2D-EC52-479E-8F1E-659FAC83F1B1}\.ba\1049\thm.wxl
                      • Size 4KB
                      • SHA256 8fa0e3b51a00c5559d1120b1c66b2a00c7693147257b2911fe038a7bf7b8fd94
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{0C299B2D-EC52-479E-8F1E-659FAC83F1B1}\.ba\1055\thm.wxl
                      • Size 3KB
                      • SHA256 90085069fdf4dcd699579209dbfd62a6719fe1a6e07168b938b92913da3287a3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{0C299B2D-EC52-479E-8F1E-659FAC83F1B1}\.ba\2052\thm.wxl
                      • Size 3KB
                      • SHA256 62bdb8fa52dcf8b5298da5fc7a745aa9481eadb3f32862f2996d070c29f21d2c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{16018CB2-2686-48C8-AA2D-866872B4538A}\.ba\2073\thm.wxl
                      • Size 6KB
                      • SHA256 5ff75dec8248e4132470b515b02ef240c5c733a4c0106c58859d779765f1c2b8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      BootstrapperExtensionData.xml
                      • Path C:\Windows\Temp\{16018CB2-2686-48C8-AA2D-866872B4538A}\.ba\BootstrapperExtensionData.xml
                      • Size 1KB
                      • SHA256 661989126d885184910d85406986ad0f93bb7ad9576cf5075c23da71fcd36fe8
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{17BC54D4-C5A9-4208-9908-89CD77FA4E22}\.ba\1033\thm.wxl
                      • Size 5KB
                      • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      BootstrapperApplicationData.xml
                      • Path C:\Windows\Temp\{17BC54D4-C5A9-4208-9908-89CD77FA4E22}\.ba\BootstrapperApplicationData.xml
                      • Size 7KB
                      • SHA256 af0eccff7e87ece54d424438fedbe376f2e97fdfea98c0986ffeabbbffb57dad
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      thm.xml
                      • Path C:\Windows\Temp\{17BC54D4-C5A9-4208-9908-89CD77FA4E22}\.ba\thm.xml
                      • Size 11KB
                      • SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dotnet_host_9.0.12_win_x64.msi
                      • Path C:\Windows\Temp\{17BC54D4-C5A9-4208-9908-89CD77FA4E22}\dotnet_host_9.0.12_win_x64.msi
                      • Size 708KB
                      • SHA256 f327697de18a0ceda0f568d13d5ea1f570a16891b43d15830aabffc8906e42ba
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      logo.png
                      • Path C:\Windows\Temp\{253298E5-1157-48F7-B22D-A31965AABBBE}\.ba\logo.png
                      • Size 1KB
                      • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      wixstdba.dll
                      • Path C:\Windows\Temp\{253298E5-1157-48F7-B22D-A31965AABBBE}\.ba\wixstdba.dll
                      • Size 215KB
                      • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cab2C04DDC374BD96EB5C8EB8208F2C7C92
                      • Path C:\Windows\Temp\{253298E5-1157-48F7-B22D-A31965AABBBE}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                      • Size 5.4MB
                      • SHA256 62a859b0db8bca416c7b6ad2ad5d2c84a4890a39e5d45cbec75f90a2fd328749
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cab5046A8AB272BF37297BB7928664C9503
                      • Path C:\Windows\Temp\{253298E5-1157-48F7-B22D-A31965AABBBE}\cab5046A8AB272BF37297BB7928664C9503
                      • Size 967KB
                      • SHA256 c346d91193246b18301cce532f2ae784fb377cb068d77bd22edec238e5746aa7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vcRuntimeAdditional_x64
                      • Path C:\Windows\Temp\{253298E5-1157-48F7-B22D-A31965AABBBE}\vcRuntimeAdditional_x64
                      • Size 208KB
                      • SHA256 275d770dc4332bf6f3eae9ebc544ed07e3b169de791ba3d20ad50f04d9d222df
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vcRuntimeMinimum_x64
                      • Path C:\Windows\Temp\{253298E5-1157-48F7-B22D-A31965AABBBE}\vcRuntimeMinimum_x64
                      • Size 208KB
                      • SHA256 57d65221ca418dabfcc6320215b2c05eec907690aa4f93384f2007eb9e1394b0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      bg.png
                      • Path C:\Windows\Temp\{32A8F067-B27A-4104-A198-3B0A95D33040}\.ba\bg.png
                      • Size 4KB
                      • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wixstdba.dll
                      • Path C:\Windows\Temp\{32A8F067-B27A-4104-A198-3B0A95D33040}\.ba\wixstdba.dll
                      • Size 190KB
                      • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dotnet_runtime_9.0.12_win_x64.msi
                      • Path C:\Windows\Temp\{32A8F067-B27A-4104-A198-3B0A95D33040}\dotnet_runtime_9.0.12_win_x64.msi
                      • Size 27.6MB
                      • SHA256 a3e06c54b892bfa26fe11e6d85ff74c9ad4973293cf92db077b5c804088746e6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      windowsdesktop-runtime-9.0.12-win-x64.exe
                      • Path C:\Windows\Temp\{360AE97B-884D-448A-9063-FD79618019D9}\.cr\windowsdesktop-runtime-9.0.12-win-x64.exe
                      • Size 608KB
                      • SHA256 1bdaacb8ab7fccbe23e67b0ece94131e9027fd78a5b2dfd3e5dbcdec2eeddbd9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{3D187754-4899-4DCC-87DB-6080D71817B8}\.ba\thm.wxl
                      • Size 4KB
                      • SHA256 d93e58d913928e52e7afb798530d56fce6eac07a3523f9e5216434de4230d559
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wixstdba.exe
                      • Path C:\Windows\Temp\{3D187754-4899-4DCC-87DB-6080D71817B8}\.ba\wixstdba.exe
                      • Size 426KB
                      • SHA256 b8674fed5476b36dd1644930a0daf0acaeefcb9d85cb65e226de230d0f800509
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wixstdba.dll
                      • Path C:\Windows\Temp\{4B915BC3-98C7-4E4C-890B-17045F88C0C6}\.ba\wixstdba.dll
                      • Size 191KB
                      • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vc_redist.14.50.35719.x64.exe
                      • Path C:\Windows\Temp\{794207B1-EF39-469F-9114-9CB1564F085A}\.cr\vc_redist.14.50.35719.x64.exe
                      • Size 615KB
                      • SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DokanSetup.exe
                      • Path C:\Windows\Temp\{91EBF5A6-4552-4BF2-BA28-18844DCFF94F}\.be\DokanSetup.exe
                      • Size 1.1MB
                      • SHA256 1362502c3622b5fc492cd92c7f4cb08a7cee6e7ba2d210409a6f03bd1573b680
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{AB14BFAB-140D-424B-B77F-480FD3CB34C5}\.ba\3082\thm.wxl
                      • Size 3KB
                      • SHA256 2c6f29f040da15f2b6a63cfbf47e07f569afdb778f178feec9e0079199644aca
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      BootstrapperApplicationData.xml
                      • Path C:\Windows\Temp\{AB14BFAB-140D-424B-B77F-480FD3CB34C5}\.ba\BootstrapperApplicationData.xml
                      • Size 5KB
                      • SHA256 6eb6c71de94b32df79fd63ca06ab2d27bdd221fe937fd2988edfbe16dca89473
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cab54A5CABBE7274D8A22EB58060AAB7623
                      • Path C:\Windows\Temp\{AB14BFAB-140D-424B-B77F-480FD3CB34C5}\cab54A5CABBE7274D8A22EB58060AAB7623
                      • Size 840KB
                      • SHA256 8b177ce7ea07fcf055dee844c567d3feeee40abc15cc5aa21acbf9e97a9dbfae
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cabB3E1576D1FEFBB979E13B1A5379E0B16
                      • Path C:\Windows\Temp\{AB14BFAB-140D-424B-B77F-480FD3CB34C5}\cabB3E1576D1FEFBB979E13B1A5379E0B16
                      • Size 4.9MB
                      • SHA256 951657e869eb42149ccaa66d4c3f4465ebd29c490285f24c51c8492993861c25
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      license.rtf
                      • Path C:\Windows\Temp\{B7A3F06D-02E6-4F39-85DE-562548401415}\.ba\license.rtf
                      • Size 9KB
                      • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{B7A3F06D-02E6-4F39-85DE-562548401415}\.ba\thm.wxl
                      • Size 2KB
                      • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      thm.xml
                      • Path C:\Windows\Temp\{B7A3F06D-02E6-4F39-85DE-562548401415}\.ba\thm.xml
                      • Size 8KB
                      • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      BootstrapperApplicationData.xml
                      • Path C:\Windows\Temp\{D3048009-78F3-4C8D-8393-7E10A029B66F}\.ba\BootstrapperApplicationData.xml
                      • Size 7KB
                      • SHA256 1ce95b466c776490014e99096c7f96785147d99f5488fa8e297ad9bf60730493
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{D3048009-78F3-4C8D-8393-7E10A029B66F}\.ba\thm.wxl
                      • Size 3KB
                      • SHA256 21a76eb702fe727ca06de6632be2294ed1caa9e1d3798d01ed1428e0f40e19ea
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      thm.xml
                      • Path C:\Windows\Temp\{D3048009-78F3-4C8D-8393-7E10A029B66F}\.ba\thm.xml
                      • Size 8KB
                      • SHA256 8d67851408a62b0f04dbaaddc588cd98499cf3630ec5df9f7c0699f0d367f79c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      netfxbe.dll
                      • Path C:\Windows\Temp\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.ba\Wix4NetfxBootstrapperExtension_X64\netfxbe.dll
                      • Size 185KB
                      • SHA256 116be6ab9bf4f967a045ace9f7646d788710c7f1652bb2df94d7f626d3de18fb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      netcoresearch.exe
                      • Path C:\Windows\Temp\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.ba\Wix4NetfxBootstrapperExtension_X64\x64\netcoresearch.exe
                      • Size 158KB
                      • SHA256 e8abfbe092b6284f951b320163551253027d2ba5e31908237639c4d120cf0ec3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wixstdba.exe
                      • Path C:\Windows\Temp\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.ba\wixstdba.exe
                      • Size 489KB
                      • SHA256 e05dda0c23421cfc7a2a39b91074928605e1e69ad5f0a2a4e230ed5996fe2ff9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DiskDrillSetup.6.3.1398.0.exe
                      • Path C:\Windows\Temp\{D75B3132-4B70-4A47-9179-7B78F00158F2}\.be\DiskDrillSetup.6.3.1398.0.exe
                      • Size 2.4MB
                      • SHA256 19190e51d3bc60bac0933f583f670ce1c06c72d379ea4a36808a4481d3a53679
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vc_redist.14.50.35719.x86.exe
                      • Path C:\Windows\Temp\{E3E9F3ED-34FE-40A7-90E9-092F4B45C5F3}\.cr\vc_redist.14.50.35719.x86.exe
                      • Size 614KB
                      • SHA256 3d37aa9541cbdab5361c4776304ded5a497a45b486277db14bbfd26cd436f997
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/2524-1620-0x000002BA0A640000-0x000002BA0A64C000-memory.dmp
                      Download

                      memory/2524-1618-0x000002BA0BEB0000-0x000002BA0BEE4000-memory.dmp
                      Download

                      memory/2920-405-0x0000000000A00000-0x0000000000A77000-memory.dmp
                      Download

                      memory/3256-1918-0x00007FF68B110000-0x00007FF68B225000-memory.dmp
                      Download

                      memory/3456-1819-0x0000000000A90000-0x0000000000B72000-memory.dmp
                      Download

                      memory/3876-666-0x0000000000C60000-0x0000000000CD7000-memory.dmp
                      Download

                      memory/4656-401-0x0000000000A00000-0x0000000000A77000-memory.dmp
                      Download

                      memory/5060-403-0x0000000000A00000-0x0000000000A77000-memory.dmp
                      Download

                      memory/5252-664-0x0000000000C60000-0x0000000000CD7000-memory.dmp
                      Download

                      memory/5700-662-0x0000000000C60000-0x0000000000CD7000-memory.dmp
                      Download