2efbf96a0e2748ee7a3c2e75a2e5a7421fd190e0c5673b913c8669d28ff7011b

Analysis

max time kernel
226s
max time network
299s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MSCO Launcher Installer.exe
Size

2.5MB
MD5

6779f7fcb9eda1f8a3c15407b4ca6e11
SHA1

65b2563a63abc2116abd8a1e25f1efcfa8598b63
SHA256

89181675ee248c11cc0d6c2d584aa3eef2a7a0b4b3508d8ba46a645d48a16171
SHA512

a4e80391a6850424f149db4612b85d0131eddae0b43a7436c7e811771c2018cd46e30672b4b523327f478382d08a8127366f6fb85d39979a267b1ca4a1617e14
SSDEEP

49152:tBuZrEUSZlXS00uRMPex1YQ5tEk55DdN7POGji:7kLSZlXSjQX1YQ/Ek55lji

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 9 IoCs

Processes:

MSCO Launcher Installer.tmpnetcorecheck_x64.exedotnet50desktop_x64.exedotnet50desktop_x64.exewindowsdesktop-runtime-5.0.17-win-x64.exeMSCO Launcher.exeMSCO Launcher.exeMSCO Launcher.exeMSCO Launcher.exe

pid	process
2368	MSCO Launcher Installer.tmp
2284	netcorecheck_x64.exe
2844	dotnet50desktop_x64.exe
2928	dotnet50desktop_x64.exe
2888	windowsdesktop-runtime-5.0.17-win-x64.exe
3008	MSCO Launcher.exe
2528	MSCO Launcher.exe
2392	MSCO Launcher.exe
1836	MSCO Launcher.exe

Loads dropped DLL 64 IoCs

Processes:

MSCO Launcher Installer.exeMSCO Launcher Installer.tmpdotnet50desktop_x64.exedotnet50desktop_x64.exeMsiExec.exeMsiExec.exemsiexec.exeMsiExec.exeMsiExec.exeMSCO Launcher.exe

pid	process
2140	MSCO Launcher Installer.exe
2368	MSCO Launcher Installer.tmp
2368	MSCO Launcher Installer.tmp
2680
2368	MSCO Launcher Installer.tmp
2844	dotnet50desktop_x64.exe
2928	dotnet50desktop_x64.exe
2928	dotnet50desktop_x64.exe
2856	MsiExec.exe
560	MsiExec.exe
1996	msiexec.exe
1996	msiexec.exe
2756	MsiExec.exe
2292	MsiExec.exe
2368	MSCO Launcher Installer.tmp
2368	MSCO Launcher Installer.tmp
2368	MSCO Launcher Installer.tmp
1200
1200
1200
1200
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe
3008	MSCO Launcher.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

windowsdesktop-runtime-5.0.17-win-x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{20d5df4e-006c-4d6d-a0dc-490d009b9786} = "\"C:\\ProgramData\\Package Cache\\{20d5df4e-006c-4d6d-a0dc-490d009b9786}\\windowsdesktop-runtime-5.0.17-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-5.0.17-win-x64.exe

Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

5 1996 msiexec.exe
7 1996 msiexec.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

flow	pid	process
5	1996	msiexec.exe
7	1996	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\PresentationFramework.Classic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Text.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\pl\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\System.Xaml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\it\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\ru\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\ru\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\api-ms-win-core-interlocked-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\ucrtbase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\es\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\zh-Hant\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\tr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\api-ms-win-core-errorhandling-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\api-ms-win-core-sysinfo-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\pl\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\UIAutomationProvider.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\UIAutomationClientSideProviders.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\api-ms-win-core-synch-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.IO.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\zh-Hant\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\api-ms-win-core-processenvironment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\de\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\pt-BR\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\api-ms-win-crt-process-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\PenImc_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\pt-BR\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Reflection.Emit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\pl\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\Microsoft.VisualBasic.Forms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\fr\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\cs\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\ru\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Drawing.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\zh-Hans\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\pl\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\hostpolicy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\tr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\pl\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\de\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\pt-BR\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\ko\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\ja\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\de\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\fr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Security.Cryptography.X509Certificates.dll	msiexec.exe

Drops file in Windows directory 30 IoCs

Processes:

msiexec.exewindowsdesktop-runtime-5.0.17-win-x64.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f768dc8.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA127.tmp	msiexec.exe
File created	C:\Windows\Installer\f768dc8.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D3B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f768dce.ipi	msiexec.exe
File created	C:\Windows\Installer\f768dbf.msi	msiexec.exe
File created	C:\Windows\Installer\f768dd0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI997D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f768dc2.ipi	msiexec.exe
File created	C:\Windows\Installer\f768dcb.msi	msiexec.exe
File created	C:\Windows\Installer\f768dce.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA57E.tmp	msiexec.exe
File created	C:\Windows\Installer\f768dc4.msi	msiexec.exe
File created	C:\Windows\Installer\f768dc5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E37.tmp	msiexec.exe
File created	C:\Windows\Installer\f768dd1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f768dd1.msi	msiexec.exe
File created	C:\Windows\Installer\f768dd6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI919A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f768dd4.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9709.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f768dbf.msi	msiexec.exe
File created	C:\Windows\Installer\f768dc2.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f768dc5.msi	msiexec.exe
File created	C:\Windows\Installer\f768dca.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f768dcb.msi	msiexec.exe
File created	C:\Windows\Installer\f768dd4.ipi	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	windowsdesktop-runtime-5.0.17-win-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exewindowsdesktop-runtime-5.0.17-win-x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_40.68.31219_x64\Version = "40.68.31219"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{3C31CBA1-A0D9-4B95-A807-AD2313D12F47}v40.68.31219\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0A926AAB63A535752509758D6623910B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\895E66A5DB73A8C47ABC7AC123BADC87\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E1DE366EC9988E04190DD8739BE5C396\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_40.68.31213_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\Version = "675576301"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_40.48.30622_x64\ = "{E663ED1E-899C-40E8-91D0-8D37B95E3C69}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1ABC13C39D0A59B48A70DA32311DF274\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_40.68.31219_x64	windowsdesktop-runtime-5.0.17-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_40.68.31219_x64\Dependents	windowsdesktop-runtime-5.0.17-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\PackageCode = "1224A3EEC4F4DED46963D1FFCE3281AA"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_40.48.30622_x64\DisplayName = "Microsoft .NET Host - 5.0.17 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_40.68.31213_x64	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{5A66E598-37BD-4C8A-A7CB-A71C32ABCD78}v40.68.31213\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_40.68.31213_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_40.48.30622_x64\Version = "40.68.31213"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\SourceList\PackageName = "dotnet-host-5.0.17-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_40.48.30622_x64\Dependents\{20d5df4e-006c-4d6d-a0dc-490d009b9786}	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{20d5df4e-006c-4d6d-a0dc-490d009b9786}\DisplayName = "Microsoft Windows Desktop Runtime - 5.0.17 (x64)"	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_40.68.31213_x64\ = "{8BA25391-0BE6-443A-8EBF-86A29BAFC479}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_40.48.30622_x64\Dependents	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_40.68.31219_x64\ = "{3C31CBA1-A0D9-4B95-A807-AD2313D12F47}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0D04DDDE7A95C1966AE94F44FFD1C1FB\1ABC13C39D0A59B48A70DA32311DF274	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{20d5df4e-006c-4d6d-a0dc-490d009b9786}\ = "{20d5df4e-006c-4d6d-a0dc-490d009b9786}"	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\ProductName = "Microsoft .NET Runtime - 5.0.17 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\PackageCode = "73707531598CDF549AF6A6BF9F733FD6"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_40.48.30622_x64	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{20d5df4e-006c-4d6d-a0dc-490d009b9786}\Version = "5.0.17.31219"	windowsdesktop-runtime-5.0.17-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_40.68.31213_x64\Dependents\{20d5df4e-006c-4d6d-a0dc-490d009b9786}	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\PackageCode = "2488A08F453B374468F9F22CD1BA27DA"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\Version = "675576307"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{3C31CBA1-A0D9-4B95-A807-AD2313D12F47}v40.68.31219\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8BA25391-0BE6-443A-8EBF-86A29BAFC479}v40.68.31213\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_40.68.31213_x64\ = "{5A66E598-37BD-4C8A-A7CB-A71C32ABCD78}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\SourceList\PackageName = "dotnet-runtime-5.0.17-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\PackageCode = "BECC4CF9E693A52418DECCD1F47C8CF2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8BA25391-0BE6-443A-8EBF-86A29BAFC479}v40.68.31213\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{E663ED1E-899C-40E8-91D0-8D37B95E3C69}v40.68.31213\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_40.68.31219_x64\Dependents\{20d5df4e-006c-4d6d-a0dc-490d009b9786}	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9DFC28D7BA65B6276699610B0500102E\895E66A5DB73A8C47ABC7AC123BADC87	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9DFC28D7BA65B6276699610B0500102E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_40.68.31213_x64\Dependents	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1ABC13C39D0A59B48A70DA32311DF274\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\Language = "1033"	msiexec.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

MSCO Launcher Installer.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	MSCO Launcher Installer.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	MSCO Launcher Installer.tmp

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

msiexec.exeMSCO Launcher Installer.tmpMSCO Launcher.exeMSCO Launcher.exeMSCO Launcher.exeMSCO Launcher.exechrome.exe

pid	process
1996	msiexec.exe
1996	msiexec.exe
1996	msiexec.exe
1996	msiexec.exe
1996	msiexec.exe
1996	msiexec.exe
1996	msiexec.exe
1996	msiexec.exe
2368	MSCO Launcher Installer.tmp
2368	MSCO Launcher Installer.tmp
3008	MSCO Launcher.exe
2528	MSCO Launcher.exe
2392	MSCO Launcher.exe
1836	MSCO Launcher.exe
2996	chrome.exe
2996	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

windowsdesktop-runtime-5.0.17-win-x64.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeSecurityPrivilege	1996	msiexec.exe
Token: SeCreateTokenPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeLockMemoryPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeMachineAccountPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeTcbPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeSecurityPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeTakeOwnershipPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeLoadDriverPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeSystemProfilePrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeSystemtimePrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeProfSingleProcessPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeIncBasePriorityPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeCreatePagefilePrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeCreatePermanentPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeBackupPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeRestorePrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeShutdownPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeDebugPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeAuditPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeSystemEnvironmentPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeChangeNotifyPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeRemoteShutdownPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeUndockPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeSyncAgentPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeEnableDelegationPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeManageVolumePrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeImpersonatePrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeCreateGlobalPrivilege	2888	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe
Token: SeRestorePrivilege	1996	msiexec.exe
Token: SeTakeOwnershipPrivilege	1996	msiexec.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

MSCO Launcher Installer.tmpdotnet50desktop_x64.exechrome.exe

pid	process
2368	MSCO Launcher Installer.tmp
2928	dotnet50desktop_x64.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe
2996	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

MSCO Launcher Installer.exeMSCO Launcher Installer.tmpdotnet50desktop_x64.exedotnet50desktop_x64.exemsiexec.exechrome.exe

description	pid	process	target process
PID 2140 wrote to memory of 2368	2140	MSCO Launcher Installer.exe	MSCO Launcher Installer.tmp
PID 2140 wrote to memory of 2368	2140	MSCO Launcher Installer.exe	MSCO Launcher Installer.tmp
PID 2140 wrote to memory of 2368	2140	MSCO Launcher Installer.exe	MSCO Launcher Installer.tmp
PID 2140 wrote to memory of 2368	2140	MSCO Launcher Installer.exe	MSCO Launcher Installer.tmp
PID 2140 wrote to memory of 2368	2140	MSCO Launcher Installer.exe	MSCO Launcher Installer.tmp
PID 2140 wrote to memory of 2368	2140	MSCO Launcher Installer.exe	MSCO Launcher Installer.tmp
PID 2140 wrote to memory of 2368	2140	MSCO Launcher Installer.exe	MSCO Launcher Installer.tmp
PID 2368 wrote to memory of 2284	2368	MSCO Launcher Installer.tmp	netcorecheck_x64.exe
PID 2368 wrote to memory of 2284	2368	MSCO Launcher Installer.tmp	netcorecheck_x64.exe
PID 2368 wrote to memory of 2284	2368	MSCO Launcher Installer.tmp	netcorecheck_x64.exe
PID 2368 wrote to memory of 2284	2368	MSCO Launcher Installer.tmp	netcorecheck_x64.exe
PID 2368 wrote to memory of 2844	2368	MSCO Launcher Installer.tmp	dotnet50desktop_x64.exe
PID 2368 wrote to memory of 2844	2368	MSCO Launcher Installer.tmp	dotnet50desktop_x64.exe
PID 2368 wrote to memory of 2844	2368	MSCO Launcher Installer.tmp	dotnet50desktop_x64.exe
PID 2368 wrote to memory of 2844	2368	MSCO Launcher Installer.tmp	dotnet50desktop_x64.exe
PID 2368 wrote to memory of 2844	2368	MSCO Launcher Installer.tmp	dotnet50desktop_x64.exe
PID 2368 wrote to memory of 2844	2368	MSCO Launcher Installer.tmp	dotnet50desktop_x64.exe
PID 2368 wrote to memory of 2844	2368	MSCO Launcher Installer.tmp	dotnet50desktop_x64.exe
PID 2844 wrote to memory of 2928	2844	dotnet50desktop_x64.exe	dotnet50desktop_x64.exe
PID 2844 wrote to memory of 2928	2844	dotnet50desktop_x64.exe	dotnet50desktop_x64.exe
PID 2844 wrote to memory of 2928	2844	dotnet50desktop_x64.exe	dotnet50desktop_x64.exe
PID 2844 wrote to memory of 2928	2844	dotnet50desktop_x64.exe	dotnet50desktop_x64.exe
PID 2844 wrote to memory of 2928	2844	dotnet50desktop_x64.exe	dotnet50desktop_x64.exe
PID 2844 wrote to memory of 2928	2844	dotnet50desktop_x64.exe	dotnet50desktop_x64.exe
PID 2844 wrote to memory of 2928	2844	dotnet50desktop_x64.exe	dotnet50desktop_x64.exe
PID 2928 wrote to memory of 2888	2928	dotnet50desktop_x64.exe	windowsdesktop-runtime-5.0.17-win-x64.exe
PID 2928 wrote to memory of 2888	2928	dotnet50desktop_x64.exe	windowsdesktop-runtime-5.0.17-win-x64.exe
PID 2928 wrote to memory of 2888	2928	dotnet50desktop_x64.exe	windowsdesktop-runtime-5.0.17-win-x64.exe
PID 2928 wrote to memory of 2888	2928	dotnet50desktop_x64.exe	windowsdesktop-runtime-5.0.17-win-x64.exe
PID 2928 wrote to memory of 2888	2928	dotnet50desktop_x64.exe	windowsdesktop-runtime-5.0.17-win-x64.exe
PID 2928 wrote to memory of 2888	2928	dotnet50desktop_x64.exe	windowsdesktop-runtime-5.0.17-win-x64.exe
PID 2928 wrote to memory of 2888	2928	dotnet50desktop_x64.exe	windowsdesktop-runtime-5.0.17-win-x64.exe
PID 1996 wrote to memory of 2856	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2856	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2856	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2856	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2856	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2856	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2856	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 560	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 560	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 560	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 560	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 560	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 560	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 560	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2756	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2756	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2756	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2756	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2756	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2756	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2756	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2292	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2292	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2292	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2292	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2292	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2292	1996	msiexec.exe	MsiExec.exe
PID 1996 wrote to memory of 2292	1996	msiexec.exe	MsiExec.exe
PID 2996 wrote to memory of 1576	2996	chrome.exe	chrome.exe
PID 2996 wrote to memory of 1576	2996	chrome.exe	chrome.exe
PID 2996 wrote to memory of 1576	2996	chrome.exe	chrome.exe
PID 2996 wrote to memory of 2352	2996	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\MSCO Launcher Installer.exe
"C:\Users\Admin\AppData\Local\Temp\MSCO Launcher Installer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140

C:\Users\Admin\AppData\Local\Temp\is-GAN8B.tmp\MSCO Launcher Installer.tmp
"C:\Users\Admin\AppData\Local\Temp\is-GAN8B.tmp\MSCO Launcher Installer.tmp" /SL5="$40128,1719578,832512,C:\Users\Admin\AppData\Local\Temp\MSCO Launcher Installer.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2368

C:\Users\Admin\AppData\Local\Temp\is-QHNI8.tmp\netcorecheck_x64.exe
"C:\Users\Admin\AppData\Local\Temp\is-QHNI8.tmp\netcorecheck_x64.exe" Microsoft.WindowsDesktop.App 5.0.17
3⤵
- Executes dropped EXE
PID:2284

C:\Users\Admin\AppData\Local\Temp\is-QHNI8.tmp\dotnet50desktop_x64.exe
"C:\Users\Admin\AppData\Local\Temp\is-QHNI8.tmp\dotnet50desktop_x64.exe" /lcid 1033 /passive /norestart
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844

C:\Windows\Temp\{E1E260EE-F10A-4134-B3BF-F9EC2C54F240}\.cr\dotnet50desktop_x64.exe
"C:\Windows\Temp\{E1E260EE-F10A-4134-B3BF-F9EC2C54F240}\.cr\dotnet50desktop_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-QHNI8.tmp\dotnet50desktop_x64.exe" -burn.filehandle.attached=224 -burn.filehandle.self=232 /lcid 1033 /passive /norestart
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2928

C:\Windows\Temp\{0981AB00-CA95-4571-A178-85CC933B7EC6}\.be\windowsdesktop-runtime-5.0.17-win-x64.exe
"C:\Windows\Temp\{0981AB00-CA95-4571-A178-85CC933B7EC6}\.be\windowsdesktop-runtime-5.0.17-win-x64.exe" -q -burn.elevated BurnPipe.{C2687238-DB57-40C3-9C61-FDC2145D916E} {A6ADE403-025C-49C8-86D3-6EE66F0A03C3} 2928
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 31241574C159C0FCD4A133A7B238DC51
2⤵
- Loads dropped DLL
PID:2856

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 15BA33F8D967D0C4DD327D170EB5523E
2⤵
- Loads dropped DLL
PID:560

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A753D9DF18CF96569086ADF1526EF354
2⤵
- Loads dropped DLL
PID:2756

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding EC0390455ED93C279C868EAD9EB70FA4
2⤵
- Loads dropped DLL
PID:2292

C:\Program Files\MSCO Launcher\MSCO Launcher.exe
"C:\Program Files\MSCO Launcher\MSCO Launcher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3008

C:\Program Files\MSCO Launcher\MSCO Launcher.exe
"C:\Program Files\MSCO Launcher\MSCO Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2528

C:\Program Files\MSCO Launcher\MSCO Launcher.exe
"C:\Program Files\MSCO Launcher\MSCO Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2392

C:\Program Files\MSCO Launcher\MSCO Launcher.exe
"C:\Program Files\MSCO Launcher\MSCO Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef68b9758,0x7fef68b9768,0x7fef68b9778
2⤵
PID:1576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1444 --field-trial-handle=1300,i,16244718328640886249,11747342165006799710,131072 /prefetch:8
2⤵
PID:1552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1300,i,16244718328640886249,11747342165006799710,131072 /prefetch:8
2⤵
PID:2836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 --field-trial-handle=1300,i,16244718328640886249,11747342165006799710,131072 /prefetch:2
2⤵
PID:2352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2272 --field-trial-handle=1300,i,16244718328640886249,11747342165006799710,131072 /prefetch:1
2⤵
PID:2648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2260 --field-trial-handle=1300,i,16244718328640886249,11747342165006799710,131072 /prefetch:1
2⤵
PID:2584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1392 --field-trial-handle=1300,i,16244718328640886249,11747342165006799710,131072 /prefetch:2
2⤵
PID:2332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2816 --field-trial-handle=1300,i,16244718328640886249,11747342165006799710,131072 /prefetch:2
2⤵
PID:2672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3212 --field-trial-handle=1300,i,16244718328640886249,11747342165006799710,131072 /prefetch:1
2⤵
PID:792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3780 --field-trial-handle=1300,i,16244718328640886249,11747342165006799710,131072 /prefetch:8
2⤵
PID:2276

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
2⤵
PID:1740

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f587688,0x13f587698,0x13f5876a8
3⤵
PID:560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3656 --field-trial-handle=1300,i,16244718328640886249,11747342165006799710,131072 /prefetch:1
2⤵
PID:1048

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f768dc3.rbs

Filesize
54KB

MD5
b1103a8ebbfea33e28fdceb2df45451a

SHA1
f9e5f1f714705a26a9590dfa6875556a40eab9ad

SHA256
11b708bd57e707a77ce5f923d6c344c43bf6a2b3099e93ba0007ba38cdba1332

SHA512
343a49e76b219e7226a135e7cc4d2677adf10afa1c09fb6d86b853e1c866ef4977b626916fe2334c23998855a10e064a2fc4d983f92984385b82ea0b306561dc

Download Submit
C:\Config.Msi\f768dc9.rbs

Filesize
8KB

MD5
c0e0bb843b5e85320190165b4afd379c

SHA1
7e66fcd33f559545379522f2f2b406228a04e7ea

SHA256
981d2ffcecf2cc90f671fc166bcbc20ab5f074f058017a8cf93f77aae7506ab9

SHA512
7755a20c8b836e2f0fb141cb1971700358f043300d2d77d1b8e3893288698d3fdbed056d1635b0b081fc22b8d5746af12ba2829c946a1f20d9f55cd92f177761

Download Submit
C:\Config.Msi\f768dcf.rbs

Filesize
9KB

MD5
ccf2a9ee58738beba54e6d3efdc72b12

SHA1
1ace367f7d673f9c15b54961a4282bb5d77b6b21

SHA256
c593e56c99ae0df54239bfc9f7e1cb6c7282d872b37b5baf5d50a8a91ecde141

SHA512
4de8aeb4258b941a6bcfbd4ff6756988c43ee97ee4e288d513172aa5d38fe150a9c04f2c809280d3ae28c693ebbddd075f137acf8ce0ebcf7ef00873b458af56

Download Submit
C:\Config.Msi\f768dd5.rbs

Filesize
86KB

MD5
02182c6a5339b7d68e3f3234930f0fcb

SHA1
71fb821a1b631ed09d9365348b78ea01f1721855

SHA256
9cfea3396f82fd0bff280ac7e8c658848e11fba21e478db31d9096a7c630b6be

SHA512
982d454fd0847e1e1c91d3eed8e28cb901f5b16497636ec030c2ff2007c6d90184679e5d2c2bf5b4908da23dc7781e652b27fe42f6515effa00b69e5c1e78c35

Download Submit
C:\Program Files\MSCO Launcher\MSCO Launcher.dll

Filesize
670KB

MD5
83f39b00ac738c31c57e2bcbf46e109b

SHA1
fefdc822f3cd55b53245bff97f94decbef84c7c5

SHA256
799690bfaf361f88476a143c3a495e1b137a8f129c2b3ce4d7e58d70a23a0788

SHA512
c0c4723d7ecb1068b171feb0b1b784369bc54b2cdbe76a46be8462c5f31d38bae8d7ce581d6b542614ba31d174fe015cefea4ea4f5789da59b9812c2c0161a6f

Download Submit
C:\Program Files\MSCO Launcher\MSCO Launcher.runtimeconfig.json

Filesize
260B

MD5
a28b6080e37ea4be040cb5c362b45efd

SHA1
1eac8198094403f302ac728e1d66be525a3d4520

SHA256
4c0cb85109ab4197bae60ba53d9a703f79b151540dbd5b1eec71aabc141fe4ca

SHA512
75dc814fc378998f5718bf79379ffc139f9078e35615071f83e9fc5fc69eaa3126ff598d631982e47beaa1f81c7187e5aa95a8e86afcd0627e517cfbf1388622

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
59KB

MD5
746bb224189a406a0245d5e4d44463ea

SHA1
5e2d5dfce5be03b47fe4b1debe21723f9415ede5

SHA256
99b430f2b4d6a2a27833df2a4b5005b63ed3d98ce5cadd5a429b8c6919e0219b

SHA512
9246810b285ef1c8f92de510a28acbe4ec9ce77a60d8346bc347cbd08d891470f822ff25fc3cd8fd992f8c978afc85aec530006d020c2c492364d4d14459ad86

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\Microsoft.NETCore.App.deps.json

Filesize
53KB

MD5
b3b58af2be7bf06efaf4ca3a21272b6e

SHA1
81345ede3d266837cb6c0530fffc78e2b449637f

SHA256
b22df4c584f3f3454183fedc39537cb019129e0b59ee53a0cfc8abf175a1f0c1

SHA512
b8aed389871e2dc65cbabe410076488f6c76cd3b68632d591052dda667ef0de18da20d1e806a67e0d76c1777b301f60deeaa9940c901151b0280f726d4ed1cee

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Private.CoreLib.dll

Filesize
1.1MB

MD5
4d011aadc6bf59760eb6df6671c4634c

SHA1
fcbf76e030dfb163f3b9338db617425026391f25

SHA256
630550ded343f1819a255e3fb0c7899fd3d916324a95141eb98b6ed5d81bec66

SHA512
4f8ec9c9786b99f0827fea3c090a1bf5879e29fb039db9af6c7dcd1c2393c993ee64ac3efa469716421025eaddc7543cbfa44ea962b48bb9e78ae0a4ff635f10

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\clrjit.dll

Filesize
1.1MB

MD5
a5e7be4d77347e824056e4f2bda1fbd9

SHA1
cc0782b2a2a0619344b43e1f227a59b122cc599d

SHA256
e4636c09ebf537a34b79a07894d1b87d6fc119ce1fcc96bc4d62c4a532975319

SHA512
8d8a7252e07f4d9fbb5faa3dd26129dd989931042cfbb4e2ef2718bdf9c99bcb4cfb2c1f7294600d77bcde673cabb811fd634277b439cbb2921d715587398faf

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\coreclr.dll

Filesize
1.2MB

MD5
b92bed0c3778cee9d75039481123fd34

SHA1
f0477ef522f4299a7fab80479b07baff98beb263

SHA256
04450aefd317eb4f889f5718c68f8a5637bb22c341b0bd7a80822901ca627ecf

SHA512
b4baaf3286c963e993aa475712780e0e37677f32c8310134b77dedd969a433c4d39b1342515d54ded0c908978f30b6432efef8933b48bad4cd61b323fc4d9262

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\Microsoft.WindowsDesktop.App.deps.json

Filesize
42KB

MD5
3c1ab99da19b8a3ac693601812b89ff6

SHA1
97276b66c4d04c83f6c5dcdf76ea84930d3a6b91

SHA256
f8549c430a0315852bf7410bf45e0531425a6ecb81b6cfb01879656409102c0f

SHA512
fda4818d6a9e868c30b108affc1180562501963ebad1ccd9ac4b6e34dd103805142650198e36acb7a5c0e5575a8ccbc0fd14e80e2ba89f579bf6c3c145a1870c

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\Microsoft.WindowsDesktop.App.runtimeconfig.json

Filesize
187B

MD5
34114f427e170b1fd21e54cf133d77ed

SHA1
4f5fbb41cbe1052a7c9141177e71f4c133f63b10

SHA256
d6ade8f7b5bf98b7a132eb710174f73175d25116f4f171ca7449c821c762df46

SHA512
e1f1f373b9698a75ca07b2b98bec5a8a0b40a90214634d04a96b7adb4fd81f61f57ec27a5301f973b0d6e7b71341bde4fd620374486694b6d238f3ec007bc7f8

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\PresentationFramework.dll

Filesize
1.0MB

MD5
2d7d4cbbd2612f382ca468d641cf1f99

SHA1
a4d079ba6ee558f624980238068981f7a6bbc280

SHA256
d7ea8d778e5d726c7f12ee2217b2f073ebe533f6b544a1bd5d6c82b4b6af1e1b

SHA512
b1b442bb3b6f83cb7adcc689dab36da3d749c2e3dd6ce30dc44176294cc27a3b4f22f3a5d37eb5c9d8f194a0df67274d00bd962b073ff32f6da621701f4c8e6c

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\WindowsBase.dll

Filesize
404KB

MD5
d9a2b753e4f51c602fbbf84572631458

SHA1
139b9ed21f15216e565dcba72b231e80743c67d3

SHA256
a55b923aaec2ffca750b88f970579869810ba0292120d8ffe30734dfea856d4d

SHA512
9d144093b3ec036044b59aa90bd487276fa886c5890e5cecd756b4d4b1bb507ff741b441b60e243729a1427b00604acfc1c1b647eba8f9b3520d7d5a12c44f9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45069d801685c83e0fd0cdd476286359

SHA1
607ebdf4f513ff150f6f2166bc3d0110d5595e93

SHA256
ee438e18ef5d9760a96daac4ceb7d240f511b8516977af73760180cabd63153e

SHA512
650bad9f3317109dbf3913a58fe6ba0f37eb4e4a24c60f1c511bbea7b98b1cc49422e0a077f9b22f0ee17939f83e33fd83c89520f17e84dfaa7f2f1e82b8a271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4650f9768ceb703d8a3b1896cb7e9742

SHA1
b4986832ae08da7fa236dead89a54514d03a97dd

SHA256
676400526fc3d75f18ec26dd4356607949900c363142907c798a1cc57ec1ac13

SHA512
1f18c669acf23ce03b6f9dd6c1bde4698a54fc1fc6c5d4d9990baca9d2dd157af791a4dd6c5b4bc1127a98994944e2237612eefa0de80a7c262017109bc9cd6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa00a3d12d15633fa04a5122663d2285

SHA1
5feb9b97462b97471c2b4e4a942a77956b659e14

SHA256
07d9aa5f703ee0655fc8c20fb9e25ef55f3fb0cedb3c807dd4c4cc5dd97b2522

SHA512
fb48150e5befc026c81589ab895b8badd8c85e513826d68f12565832de6fe2d0cbe80c096ac308b8a4ee7d17353ecdeadd31e359b5c9a2437d19400cf6dc4f7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
194KB

MD5
36104d04a9994182ba78be74c7ac3b0e

SHA1
0c049d44cd22468abb1d0711ec844e68297a7b3d

SHA256
ccde155056cdce86d7e51dfd4e8fb603e8d816224b1257adfcf9503139dd28f1

SHA512
8c115e3e5925fb01efd8dda889f4d5e890f6daaf40b10d5b8e3d9b19e15dadcb9dcf344f40c43f59a1f5428b3ee49e24e492cf0cb6826add1c03d21efdec52ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
3808d2b440435f391cc129e8e1276ed3

SHA1
a5434e7c1396082d286b99bef1ce5422b9d10a45

SHA256
2aa58716b5086fdf29af0d824857b2ff917b7a1b820858ebb51a3df6711208f1

SHA512
4f326fde3f365cbb82a7b9ed3790af2b832198cc32145bffeb6cffeb167d838a52ce52313620abcffb14c46ce17a305e2262125232066d089446f8f0dbba5098

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
c7286768072fa8bcd4f577502f409db9

SHA1
a7b1e83a9f3a1c7e9d681888c7652646026f1358

SHA256
02c40186eb639c3db08fbb9ab85e8bbdb192a19e8c368e342b8923201d618531

SHA512
847e58c3ff687b7990604434b27fa81d1d3c2446b99e4d48d843841cc31533f38d523b66cb43d9b1f27eebafb2a4e4c2fa217d047c40bffb95486aa4ad2bfe3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
fa1767c3879398ce30e4342f853fda85

SHA1
45c2191966e75ff17a2baad33a6297d49ac9f0c9

SHA256
73651bcc9c745069124264ff930434d954396402ea9d05f70d4c2a28528b16e8

SHA512
d2bd3db985da4d62e4ca06ad6eb4030a9b2251bd9f1649ac702c22d243caa4948cb55d7aeb1d314848e9596158e12e5c63fab672083cd6690efaf7c5c54ec407

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E6C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_5.0.17_(x64)_20240212180409_000_dotnet_runtime_5.0.17_win_x64.msi.log

Filesize
2KB

MD5
da798025d9a4763f67eb837db9e1d8b7

SHA1
9945e4bb9d87bac7435c26eba83fd076ef9c8b0d

SHA256
2a02c7f9abee2ccd7f4a91fd249b0b82a135cb558c757733907ee6f3abbd9dce

SHA512
3c22102944ea8ab42c08b89292f3e90a7691cecf1b778be52b2287d5326a5af51295e1d069bf7b78af81521e045c11e175416777262f046fa1fcd0e34d6bd069

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_5.0.17_(x64)_20240212180409_001_dotnet_hostfxr_5.0.17_win_x64.msi.log

Filesize
2KB

MD5
5ec10a4f95c6f2e47585275c6b96d214

SHA1
44c6035d8918e18af2ccaa8e924b62d453ee0b36

SHA256
534a22f11aa82c54641b3e27bf7cadd5118e4831d0e6e9efe0d63aec2c48fc49

SHA512
b87f2571249a79d01164ec4eaa8ab03feb0e17162e2dfe2746d362b037848790b3891efcc1e06be6909d5c9afe9acdffce45e629950b83b3e98ac806bdd62629

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_5.0.17_(x64)_20240212180409_002_dotnet_host_5.0.17_win_x64.msi.log

Filesize
2KB

MD5
741a5feef29262a04ecd233f60f93f17

SHA1
288e08f8db84527a7719c8f8d66ed9b932db2d53

SHA256
60aeec9a0f6c68ea19cc8b4c1bcdfec83c7ce060d29fcf442e9b4cc92f2544a3

SHA512
496954dbba9ffc5bb18865698840c7916eea64c17a5057d836b178628ab75a04c38c1bd2d2ad85b967cbe65602f31d6e3c8da938dddf1139f1e03f22ecbc3ebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_5.0.17_(x64)_20240212180409_003_windowsdesktop_runtime_5.0.17_win_x64.msi.log

Filesize
2KB

MD5
3f07621774385d0422fa39927b82b29c

SHA1
e4920895b2a6266b78741f1417a36e06578c8ef9

SHA256
1b1a96bcf0fe8446b2bcacc8f11a66a8437e660ee8204efb3c29d0f634599aa1

SHA512
0790b9da3f995982be183fdee4957e6f8ca583ab7531e9173fd8d85dedc2ce34537ce83b020986ba298fce3a0b27937b6b0d574edd3a40d26d1095e2a6e90518

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E7F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QHNI8.tmp\dotnet50desktop_x64.exe

Filesize
10.8MB

MD5
a07f24179e79f209c99e4b920b0a5383

SHA1
e7ace118f4cc2c6a90678d9148d5bbe19c47b715

SHA256
1d4f42cc50249d391216f99020b6d2e5dfa6ae2d967286ae64e6c3ad9d5c7c84

SHA512
972aa6f2e219985385fc8476ab7b9725f34f26a94a43e3b5d14e0b09a1c6788bddb956118b393ac20fdb405e7f42a144aab6c9c9c4b9b7e520c9a440df172ec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QHNI8.tmp\dotnet50desktop_x64.exe

Filesize
13.8MB

MD5
9ee56f57e0db02ea46766d8cf50211f0

SHA1
2671271d0cc564e393522e3bf7385acd04b02938

SHA256
e6acaad18d4fcadd6eedfad552f1e53dffee999e7513a21a52a2c07d0574e309

SHA512
f35724a15b74ac50d71c9ba7fa3156f95426e892c2b5d0e8284c1110f2bb882014b535a740789374cbe39fa284be6480709bbf2e148e773348fbd6f38db5c30e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QHNI8.tmp\dotnet50desktop_x64.exe

Filesize
14.9MB

MD5
b9c5f26c28bd3f42060607bd8f90fe55

SHA1
0b009130e966a457fdf7ff54c3c0df62b9721b4e

SHA256
dab34583849e9a1f1b3a6ac17cd151ea3899fedc206c919e4fdda13ae32c65bf

SHA512
090470028605adf1e21305ee315a3b17d25859ac1871d8a072f943b572b5f94e3fd9bc8dbafab9ee139cfbf705608f8858a05b98a8506de7118d31c2084d13f0

Download Submit
C:\Windows\Installer\MSI9709.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\f768dbf.msi

Filesize
24.4MB

MD5
7c25b67cd3b338a7fd39cd4ebf1e2c5f

SHA1
2b40b14ed2bbb6c6052ed1e403918a94ab4943b1

SHA256
b67067a27ed2e7e81b005575708dab7575a53c3b360c9f82ddd550247359829a

SHA512
7e5589428cdec772d3d2c80fb4ee6b2070b0b3a123405bd93d11103f85b9e8f6981e2ad3ba16d8df1e03b892c85b34ccf468df7764b7968c760a8e5ed411f972

Download Submit
C:\Windows\Temp\{0981AB00-CA95-4571-A178-85CC933B7EC6}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{0981AB00-CA95-4571-A178-85CC933B7EC6}\dotnet_host_5.0.17_win_x64.msi

Filesize
728KB

MD5
ac83425750ef4b500130152e541f6371

SHA1
b27b10116e795922491f542d6bd1ea2df160a36e

SHA256
2475a0fb01884b846347dbfcb1c85c37568f59ea7f41a6032a9dbf3a5ef08e4e

SHA512
f226018d4846a62be4a26baa32193a4747900a6924e50b818f88c820a6054b6144fc07e42420ac637ae1c92bd13cf58f2320926e4ac83862a58f5b17a14f96ba

Download Submit
C:\Windows\Temp\{0981AB00-CA95-4571-A178-85CC933B7EC6}\dotnet_hostfxr_5.0.17_win_x64.msi

Filesize
784KB

MD5
911b1d0ad5f89c5185c0e4fafea4d5de

SHA1
ff4e052462e361798627686873e4f0d07b74822a

SHA256
df407abab4d26eb421878d700e38574b7e628d30422e7d3937559eb7f3575eef

SHA512
46856e4f83b313fc8106a7c5b4a1ebf7c7f65b7c6efd7468dd5084eabb11791a4edef67f69594ef18c7f96045e38d3ff25f07f80c4f6f48bfae3df957318666b

Download Submit
C:\Windows\Temp\{0981AB00-CA95-4571-A178-85CC933B7EC6}\dotnet_runtime_5.0.17_win_x64.msi

Filesize
5.6MB

MD5
2020da647aa160b7c600d391788e7ee7

SHA1
de920d7a51c954011c78ec0a0bc3a6796ccea3bf

SHA256
7511aad8a6ea6408f221a5b4bd6fd99ea176c7087c20a32fea494b7b2dd41b80

SHA512
fc5b0ba15b9a0e0499dbe6cc37df249bf6122d03373e3945a4537bbdd3ba9b213d5a3c4f9122c04b7a5b986b96e9555b0131a1718619006bd580da087be7e2ba

Download Submit
C:\Windows\Temp\{0981AB00-CA95-4571-A178-85CC933B7EC6}\windowsdesktop_runtime_5.0.17_win_x64.msi

Filesize
4.7MB

MD5
5d116deab9366df43d11df10d7cb1ec9

SHA1
d71b8647d7bf97b22ff866e0b30feea087384b61

SHA256
77e527cdfbdae2b37f509898539be692c0ed6db3e760f586b048eb7f1b59eb6a

SHA512
56a662138f7e1045f5f5873eaff46a2cdec65d6c73348cacac748ae50d5d4c8bcb1faa0313d9c5947e71324c80c26c3dcacdb8ab6c57ef338e365f6b358956eb

Download Submit
\Program Files\MSCO Launcher\MSCO Launcher.exe

Filesize
253KB

MD5
61eed4273e0517e8ed9c15acdfbf9188

SHA1
27ee71187f71ea600573f4456d9ed2413b340286

SHA256
48552778456efbaff4137e7e216164b01fe2541fde3fe2f1ee2822827ca990ce

SHA512
39cedbb9ace7be3a8b3acde6db7e0315725a459b11d19b70ff0ec885a1e8e9b3b98d40337e404e6264e46deca9f13182c4693f5f8e288c8c9b26d8eb59c627a6

Download Submit
\Program Files\MSCO Launcher\unins000.exe

Filesize
3.1MB

MD5
bc7dfe325a94308fe8bb948fc8a5c936

SHA1
0a7b0b83b40b3eaa8d7adcd1f64e1f697f00fa8e

SHA256
8b7e22db9e61ee6b4143af090475426d4f2cdd9a7f750bc9c8e187f06e873f85

SHA512
9a8759c3a42b88e04a1b79338c4471a250bc2c48edb2cf6f5cb17fc3a3ca42408efcc830e99a99fe2c2280da93294aaee1e3693c60e046adef28a4930b938b00

Download Submit
\Program Files\dotnet\dotnet.exe

Filesize
117KB

MD5
84f7fce98810236064b1ab1cdf5344f1

SHA1
4b0c08d249e5a7df882d620a8b145848819fd622

SHA256
7b615d3725d63a45663df5f2e6c5d98389546988140b92dc155013c39a8667bd

SHA512
1d5f8f79ae938292f418f3295afb1c17b8c247b361320aa7c442e62ea1149d390c11b986243ac41fb4ad225a33fca19c90b6731c35675e4fe52a0f030eae7ab2

Download Submit
\Program Files\dotnet\host\fxr\5.0.17\hostfxr.dll

Filesize
307KB

MD5
f39f839a67397757183aa742f5697d0c

SHA1
c5086f6a70dc2fdb9b463d27ef6027752c5f3df3

SHA256
42fef4d83ecc9eb380013c1be763eb961cdb234879871d9c885dea62a28cf9d0

SHA512
e01ff4f1d2b109a1728e2d447ec9d521b565e4a63a26b64ff8bc7fbc0cc984c7379bb8ec1f3a5d8664903f476dd53dba35c3b1ede2fbfb82bd5ad240b13b4296

Download Submit
\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Private.CoreLib.dll

Filesize
640KB

MD5
77c7bf115d85ef667377fa571e5c0488

SHA1
c1d77ec94fda30f1154a771864f8527ac0882aa9

SHA256
c1c569cca6edec9a28e02224f2d098cc344773598c06c5e68aa208b74e5e5bff

SHA512
507f9f5b9ca688d872c784dd45052a4f2e9010be2e7ec2e99f7221064bbd6e0dcc0f504ba8730869063576e2456c4921659a51b4271913bde2cd04370eccf105

Download Submit
\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\api-ms-win-crt-utility-l1-1-0.dll

Filesize
20KB

MD5
fcd6b29932d6fb307964b2d3f94e6b48

SHA1
be560f8a63c8e36a7b3fa48ff384f99f69a5d4f7

SHA256
cfb2ee4e426bb00b76163c1a66cf8cfef8d7450cbf9bbce3bc9eb2053f51e0e5

SHA512
3edfcf559f1e21870277358e6d266a1a0cea68b163b11c73108f3b6a56006d20b51410a3b4ea39bf80906bf6c9d573e1072697cfcd6a3d37e3679ea54757c69f

Download Submit
\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\clrjit.dll

Filesize
768KB

MD5
7d3b2e5c2533be5bc5067f83ae33ea6c

SHA1
4ef308293e4799f7f0567926628ca5d13f546c1b

SHA256
539f6363f83abd1dbe06b3dbc4c9fa73ff7464d2bee599e35041dccd5a5da5c3

SHA512
34a2da96b62da78ac153e5e77f559117f89aabaeaa1f9b7cec135aa0d35c34f5bb1b7198582462e737fe1ed2999c33761411e9c816cdb695a6a2543b9ddd0d1f

Download Submit
\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\coreclr.dll

Filesize
1.8MB

MD5
ab7aefcd84544964d7ee54cd0e5b67a3

SHA1
dcd817cfc07f09be65f35a8a9b0445017fe2328a

SHA256
f998a26836cf6d912f849ca0ef8567ab291cbc581b3b2e785e6fe6c88452e302

SHA512
6097bdd6fb52b4cc3f2b672d4498a2bbffc2ad0515db8114239ff7604cb76837ba8b5e871378b50c1bbb3714deaaf32422e1a43ea99ac6d4d82a87253b78b2f9

Download Submit
\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\hostpolicy.dll

Filesize
314KB

MD5
fa7d2d48d1366a06174ec37d96b278eb

SHA1
9ab3f333564233bf6ae780cdd9ff5140a7bd4abc

SHA256
2f681fb34cd1ed9484a713e26df0a31219f29f28b9ea01afd9a97d1a7d130800

SHA512
3ddf7560f12c86ee477cb2824aa096dcb3df60241d516e8dd90167ef50b383aa83bc408385bb50f85f647f638c0cacdb09f226b6e6e3a42d4d7da185604654b8

Download Submit
\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\PresentationFramework.dll

Filesize
961KB

MD5
781d2089ad8fbbaca794bce11c99aade

SHA1
cc0381a090edf39d7166e2d9287e36736e224fbb

SHA256
062ccb700c07f23e519b99dda5498c60919f49b92597469bf27813c6e3f2f6ce

SHA512
c07080f08a0fb24956c0980a9dd48c7709279b2f260acad77ecab0aec326eeb0f166f135aaf6f9aa149b04192be8ea9a9a20fb7dd6965299a8327116d647bc9a

Download Submit
\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\WindowsBase.dll

Filesize
594KB

MD5
6f30da8f805803de5359192b1730a4e5

SHA1
822bbb5e58e032ae09292ab9f16cc69152a39705

SHA256
bacd4423b67eaadfe46d802f55543e5e08eaf4ccb4ec5273245ea22e7b433c16

SHA512
a6bbba5386e49387fcd300f44fb5c56121f6efb7c7ecf8800475724fb7fe36629880a416397d4e7879c871bebe2900e59c4cda0446e5b7f265096933f80f5354

Download Submit
\Users\Admin\AppData\Local\Temp\is-GAN8B.tmp\MSCO Launcher Installer.tmp

Filesize
3.0MB

MD5
2aaad2678afe7d91c0f696e845307741

SHA1
60463b3923797b109d470e9a33065d08b8ca3d8a

SHA256
a07d64c1946a2fdf09c65d99988802c4df03edcc3f1188b855534dff23507cfd

SHA512
5a4e72752f5a66ae9287970462d099ef97ee011ebf6d15aaadfc09e901a9fa4e58d5d476d9cb92ace356b0406ff257bc9eb00623f782079ad8282c9724d54968

Download Submit
\Users\Admin\AppData\Local\Temp\is-QHNI8.tmp\dotnet50desktop_x64.exe

Filesize
11.4MB

MD5
c2f70ba0b5a55add4177d440e8d1cf22

SHA1
33140ad39cdcd0a4f0723f10c4c1bbc893bd1d75

SHA256
792fddbe8a59622188d92530f0b2d8bf774e6c632c00d901e05efd7a8fefc114

SHA512
115bc646d0932a505fd43e03b059266bf9250b4929f43802a1822860870362ca307825b5a0ddf4bacd58e14c258b375ae9acbbc81fb32dbabbd2592fed95cc87

Download Submit
\Users\Admin\AppData\Local\Temp\is-QHNI8.tmp\netcorecheck_x64.exe

Filesize
140KB

MD5
de54c196cfe1bd90152460b6242f5ad3

SHA1
e1bc2721b1ba41b8157ce72bb6d56bf55b7b4785

SHA256
3b26fe9d187ce9e8275e970bd3884acaae4e0bbf7089759b3378ba44201a3b8b

SHA512
88a29b3788ad4da5f0581bc1e58dcd860060aaf1d3e3def3741d256652b8f257203e1e2b378dd7d38ae648f2efbd11268717a4107b4edb873babd8441b7f68d0

Download Submit
\Windows\Temp\{0981AB00-CA95-4571-A178-85CC933B7EC6}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
\Windows\Temp\{E1E260EE-F10A-4134-B3BF-F9EC2C54F240}\.cr\dotnet50desktop_x64.exe

Filesize
609KB

MD5
a1591a05972cc13cbcccb4ea66de7f75

SHA1
b8a951533f3609b415eb9de6f15604b12bea030e

SHA256
ec9d13712d5afc3d83ec6379d9f66db3486f85ba7401cd79c915ea62b8e71c8a

SHA512
a82c870947325ad849aa49fd05c18ecb14fbe838c97dc29379d20a5b852e3a54321358fae431df71c4aac9dde725bb1324f254a2c4b20e9ba10afb3a61e518f8

Download Submit
memory/1836-1167-0x000007FEF5190000-0x000007FEF569F000-memory.dmp

Filesize
5.1MB

Download
memory/1836-1168-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/1836-1169-0x000007FEF5190000-0x000007FEF569F000-memory.dmp

Filesize
5.1MB

Download
memory/2140-1-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2140-1133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2140-20-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2368-1132-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2368-21-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2368-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2368-103-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2368-171-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2392-1166-0x000007FEF56A0000-0x000007FEF5BAF000-memory.dmp

Filesize
5.1MB

Download
memory/2392-1165-0x0000000000440000-0x000000000044A000-memory.dmp

Filesize
40KB

Download
memory/2392-1164-0x000007FEF56A0000-0x000007FEF5BAF000-memory.dmp

Filesize
5.1MB

Download
memory/2528-1162-0x000007FEF5C90000-0x000007FEF619F000-memory.dmp

Filesize
5.1MB

Download
memory/2528-1161-0x00000000021F0000-0x00000000021FA000-memory.dmp

Filesize
40KB

Download
memory/2528-1160-0x000007FEF5C90000-0x000007FEF619F000-memory.dmp

Filesize
5.1MB

Download
memory/3008-1159-0x000007FEF5D90000-0x000007FEF629F000-memory.dmp

Filesize
5.1MB

Download
memory/3008-1157-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/3008-1158-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/3008-1156-0x000007FEF5D90000-0x000007FEF629F000-memory.dmp

Filesize
5.1MB

Download