2efbf96a0e2748ee7a3c2e75a2e5a7421fd190e0c5673b913c8669d28ff7011b

Analysis

max time kernel
294s
max time network
267s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MSCO Launcher Installer.exe
Size

2.5MB
MD5

6779f7fcb9eda1f8a3c15407b4ca6e11
SHA1

65b2563a63abc2116abd8a1e25f1efcfa8598b63
SHA256

89181675ee248c11cc0d6c2d584aa3eef2a7a0b4b3508d8ba46a645d48a16171
SHA512

a4e80391a6850424f149db4612b85d0131eddae0b43a7436c7e811771c2018cd46e30672b4b523327f478382d08a8127366f6fb85d39979a267b1ca4a1617e14
SSDEEP

49152:tBuZrEUSZlXS00uRMPex1YQ5tEk55DdN7POGji:7kLSZlXSjQX1YQ/Ek55lji

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MSCO Launcher Installer.tmpdotnet50desktop_x64.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	MSCO Launcher Installer.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	dotnet50desktop_x64.exe

Executes dropped EXE 5 IoCs

Processes:

MSCO Launcher Installer.tmpnetcorecheck_x64.exedotnet50desktop_x64.exedotnet50desktop_x64.exewindowsdesktop-runtime-5.0.17-win-x64.exe

pid	process
1840	MSCO Launcher Installer.tmp
1168	netcorecheck_x64.exe
3148	dotnet50desktop_x64.exe
4512	dotnet50desktop_x64.exe
2996	windowsdesktop-runtime-5.0.17-win-x64.exe

Loads dropped DLL 9 IoCs

Processes:

dotnet50desktop_x64.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exe

pid	process
4512	dotnet50desktop_x64.exe
2956	MsiExec.exe
2956	MsiExec.exe
1416	MsiExec.exe
1416	MsiExec.exe
4352	MsiExec.exe
4352	MsiExec.exe
408	MsiExec.exe
408	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

windowsdesktop-runtime-5.0.17-win-x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{20d5df4e-006c-4d6d-a0dc-490d009b9786} = "\"C:\\ProgramData\\Package Cache\\{20d5df4e-006c-4d6d-a0dc-490d009b9786}\\windowsdesktop-runtime-5.0.17-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-5.0.17-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exeMSCO Launcher Installer.tmp

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\es\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\it\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\es\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\ru\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\zh-Hans\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Runtime.Intrinsics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\api-ms-win-crt-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\ko\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\fr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\zh-Hant\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Reflection.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\ru\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Runtime.Serialization.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\tr\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\mscordbi.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\cs\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.AppContext.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Dynamic.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\api-ms-win-crt-utility-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.IO.FileSystem.Watcher.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Security.Cryptography.Cng.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\ko\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\ko\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\api-ms-win-crt-time-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Diagnostics.TextWriterTraceListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\MSCO Launcher\Saves\New Game\is-FVTVP.tmp	MSCO Launcher Installer.tmp
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\ko\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\ja\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\tr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\PresentationFramework-SystemData.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\System.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\System.Diagnostics.PerformanceCounter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\pt-BR\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\fr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\zh-Hans\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\pl\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\api-ms-win-crt-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\Microsoft.NETCore.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\PresentationFramework.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\cs\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\tr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\pl\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\tr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.17\api-ms-win-core-fibers-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5.0.17\zh-Hant\PresentationFramework.resources.dll	msiexec.exe

Drops file in Windows directory 35 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E1DE366EC9988E04190DD8739BE5C396\40.68.31213\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\e5944c0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e5944ba.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6511.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D31.tmp	msiexec.exe
File created	C:\Windows\Installer\e5944c4.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5944ba.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E663ED1E-899C-40E8-91D0-8D37B95E3C69}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E1DE366EC9988E04190DD8739BE5C396\40.68.31213	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3C31CBA1-A0D9-4B95-A807-AD2313D12F47}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8917.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5A66E598-37BD-4C8A-A7CB-A71C32ABCD78}	msiexec.exe
File created	C:\Windows\Installer\e5944b5.msi	msiexec.exe
File created	C:\Windows\Installer\e5944b9.msi	msiexec.exe
File created	C:\Windows\Installer\e5944c0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI49A2.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8BA25391-0BE6-443A-8EBF-86A29BAFC479}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A5D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5944b5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5E47.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6221.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI635B.tmp	msiexec.exe
File created	C:\Windows\Installer\e5944b0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5944b0.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\E1DE366EC9988E04190DD8739BE5C396\40.68.31213\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e5944bf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4DBA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5FFD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E1DE366EC9988E04190DD8739BE5C396	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI690A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5944b4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5D2D.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 9 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 64 IoCs

Processes:

windowsdesktop-runtime-5.0.17-win-x64.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_40.68.31213_x64\Dependents\{20d5df4e-006c-4d6d-a0dc-490d009b9786}	windowsdesktop-runtime-5.0.17-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{E663ED1E-899C-40E8-91D0-8D37B95E3C69}v40.68.31213\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\895E66A5DB73A8C47ABC7AC123BADC87	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\ProductName = "Microsoft Windows Desktop Runtime - 5.0.17 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\ProductName = "Microsoft .NET Host - 5.0.17 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\SourceList\PackageName = "dotnet-runtime-5.0.17-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_40.68.31213_x64\Dependents\{20d5df4e-006c-4d6d-a0dc-490d009b9786}	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\PackageCode = "1224A3EEC4F4DED46963D1FFCE3281AA"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8BA25391-0BE6-443A-8EBF-86A29BAFC479}v40.68.31213\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\19352AB86EB0A344E8FB682AB9FA4C97\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\SourceList\PackageName = "dotnet-hostfxr-5.0.17-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\PackageCode = "2488A08F453B374468F9F22CD1BA27DA"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_40.48.30622_x64\Dependents	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1ABC13C39D0A59B48A70DA32311DF274\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\Version = "675576301"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_40.48.30622_x64\DisplayName = "Microsoft .NET Host - 5.0.17 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1ABC13C39D0A59B48A70DA32311DF274	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\Version = "675576301"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_40.48.30622_x64\Dependents\{20d5df4e-006c-4d6d-a0dc-490d009b9786}	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_40.68.31219_x64\DisplayName = "Microsoft Windows Desktop Runtime - 5.0.17 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_40.68.31219_x64	windowsdesktop-runtime-5.0.17-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_40.68.31219_x64\Dependents\{20d5df4e-006c-4d6d-a0dc-490d009b9786}	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\895E66A5DB73A8C47ABC7AC123BADC87\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_40.68.31213_x64	windowsdesktop-runtime-5.0.17-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_40.68.31213_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_40.48.30622_x64\ = "{E663ED1E-899C-40E8-91D0-8D37B95E3C69}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_40.48.30622_x64\Version = "40.68.31213"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{20d5df4e-006c-4d6d-a0dc-490d009b9786}\Dependents	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\SourceList\PackageName = "dotnet-host-5.0.17-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\895E66A5DB73A8C47ABC7AC123BADC87\PackageCode = "73707531598CDF549AF6A6BF9F733FD6"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0A926AAB63A535752509758D6623910B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0A926AAB63A535752509758D6623910B\19352AB86EB0A344E8FB682AB9FA4C97	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1DE366EC9988E04190DD8739BE5C396\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_40.68.31219_x64\Version = "40.68.31219"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0D04DDDE7A95C1966AE94F44FFD1C1FB\1ABC13C39D0A59B48A70DA32311DF274	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ABC13C39D0A59B48A70DA32311DF274\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_40.68.31213_x64\Dependents	windowsdesktop-runtime-5.0.17-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\19352AB86EB0A344E8FB682AB9FA4C97\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{20d5df4e-006c-4d6d-a0dc-490d009b9786}\Dependents\{20d5df4e-006c-4d6d-a0dc-490d009b9786}	windowsdesktop-runtime-5.0.17-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_40.68.31213_x64\ = "{8BA25391-0BE6-443A-8EBF-86A29BAFC479}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_40.68.31213_x64\Dependents	windowsdesktop-runtime-5.0.17-win-x64.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msiexec.exeMSCO Launcher Installer.tmp

pid	process
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
1840	MSCO Launcher Installer.tmp
1840	MSCO Launcher Installer.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

windowsdesktop-runtime-5.0.17-win-x64.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeSecurityPrivilege	3420	msiexec.exe
Token: SeCreateTokenPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeLockMemoryPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeMachineAccountPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeTcbPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeSecurityPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeTakeOwnershipPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeLoadDriverPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeSystemProfilePrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeSystemtimePrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeProfSingleProcessPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeIncBasePriorityPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeCreatePagefilePrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeCreatePermanentPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeBackupPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeRestorePrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeShutdownPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeDebugPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeAuditPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeSystemEnvironmentPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeChangeNotifyPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeRemoteShutdownPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeUndockPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeSyncAgentPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeEnableDelegationPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeManageVolumePrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeImpersonatePrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeCreateGlobalPrivilege	2996	windowsdesktop-runtime-5.0.17-win-x64.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

MSCO Launcher Installer.tmpdotnet50desktop_x64.exe

pid process

1840 MSCO Launcher Installer.tmp
4512 dotnet50desktop_x64.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

MSCO Launcher Installer.exeMSCO Launcher Installer.tmpdotnet50desktop_x64.exedotnet50desktop_x64.exemsiexec.exe

description	pid	process	target process
PID 4236 wrote to memory of 1840	4236	MSCO Launcher Installer.exe	MSCO Launcher Installer.tmp
PID 4236 wrote to memory of 1840	4236	MSCO Launcher Installer.exe	MSCO Launcher Installer.tmp
PID 4236 wrote to memory of 1840	4236	MSCO Launcher Installer.exe	MSCO Launcher Installer.tmp
PID 1840 wrote to memory of 1168	1840	MSCO Launcher Installer.tmp	netcorecheck_x64.exe
PID 1840 wrote to memory of 1168	1840	MSCO Launcher Installer.tmp	netcorecheck_x64.exe
PID 1840 wrote to memory of 3148	1840	MSCO Launcher Installer.tmp	dotnet50desktop_x64.exe
PID 1840 wrote to memory of 3148	1840	MSCO Launcher Installer.tmp	dotnet50desktop_x64.exe
PID 1840 wrote to memory of 3148	1840	MSCO Launcher Installer.tmp	dotnet50desktop_x64.exe
PID 3148 wrote to memory of 4512	3148	dotnet50desktop_x64.exe	dotnet50desktop_x64.exe
PID 3148 wrote to memory of 4512	3148	dotnet50desktop_x64.exe	dotnet50desktop_x64.exe
PID 3148 wrote to memory of 4512	3148	dotnet50desktop_x64.exe	dotnet50desktop_x64.exe
PID 4512 wrote to memory of 2996	4512	dotnet50desktop_x64.exe	windowsdesktop-runtime-5.0.17-win-x64.exe
PID 4512 wrote to memory of 2996	4512	dotnet50desktop_x64.exe	windowsdesktop-runtime-5.0.17-win-x64.exe
PID 4512 wrote to memory of 2996	4512	dotnet50desktop_x64.exe	windowsdesktop-runtime-5.0.17-win-x64.exe
PID 3420 wrote to memory of 2956	3420	msiexec.exe	MsiExec.exe
PID 3420 wrote to memory of 2956	3420	msiexec.exe	MsiExec.exe
PID 3420 wrote to memory of 2956	3420	msiexec.exe	MsiExec.exe
PID 3420 wrote to memory of 1416	3420	msiexec.exe	MsiExec.exe
PID 3420 wrote to memory of 1416	3420	msiexec.exe	MsiExec.exe
PID 3420 wrote to memory of 1416	3420	msiexec.exe	MsiExec.exe
PID 3420 wrote to memory of 4352	3420	msiexec.exe	MsiExec.exe
PID 3420 wrote to memory of 4352	3420	msiexec.exe	MsiExec.exe
PID 3420 wrote to memory of 4352	3420	msiexec.exe	MsiExec.exe
PID 3420 wrote to memory of 408	3420	msiexec.exe	MsiExec.exe
PID 3420 wrote to memory of 408	3420	msiexec.exe	MsiExec.exe
PID 3420 wrote to memory of 408	3420	msiexec.exe	MsiExec.exe

C:\Users\Admin\AppData\Local\Temp\MSCO Launcher Installer.exe
"C:\Users\Admin\AppData\Local\Temp\MSCO Launcher Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4236

C:\Users\Admin\AppData\Local\Temp\is-IS5SL.tmp\MSCO Launcher Installer.tmp
"C:\Users\Admin\AppData\Local\Temp\is-IS5SL.tmp\MSCO Launcher Installer.tmp" /SL5="$40118,1719578,832512,C:\Users\Admin\AppData\Local\Temp\MSCO Launcher Installer.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1840

C:\Users\Admin\AppData\Local\Temp\is-0CI8G.tmp\netcorecheck_x64.exe
"C:\Users\Admin\AppData\Local\Temp\is-0CI8G.tmp\netcorecheck_x64.exe" Microsoft.WindowsDesktop.App 5.0.17
3⤵
- Executes dropped EXE
PID:1168

C:\Users\Admin\AppData\Local\Temp\is-0CI8G.tmp\dotnet50desktop_x64.exe
"C:\Users\Admin\AppData\Local\Temp\is-0CI8G.tmp\dotnet50desktop_x64.exe" /lcid 1033 /passive /norestart
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148

C:\Windows\Temp\{AD1A2D36-F601-4EB7-99B4-15061E0123A3}\.cr\dotnet50desktop_x64.exe
"C:\Windows\Temp\{AD1A2D36-F601-4EB7-99B4-15061E0123A3}\.cr\dotnet50desktop_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-0CI8G.tmp\dotnet50desktop_x64.exe" -burn.filehandle.attached=648 -burn.filehandle.self=668 /lcid 1033 /passive /norestart
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\Temp\{AA1EC6C2-E032-4259-99C3-746ECC5A8387}\.be\windowsdesktop-runtime-5.0.17-win-x64.exe
"C:\Windows\Temp\{AA1EC6C2-E032-4259-99C3-746ECC5A8387}\.be\windowsdesktop-runtime-5.0.17-win-x64.exe" -q -burn.elevated BurnPipe.{07957CC7-670F-483E-BA72-50C56ED84ADC} {A25B419B-D9AD-4896-8917-08A7435E622C} 4512
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2996

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 123758237D44BC530CD853CD523E2D43
2⤵
- Loads dropped DLL
PID:2956

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 607FC5C50D83E2C674939722FC441456
2⤵
- Loads dropped DLL
PID:1416

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 4A4FE4A6BC18B98CD564519DF28DEECA
2⤵
- Loads dropped DLL
PID:4352

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding AFB08F0C3B1A1EB1BF52EF6910E331D4
2⤵
- Loads dropped DLL
PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5944b3.rbs

Filesize
56KB

MD5
b1fcffda3eeafc13af773bbb8eeec492

SHA1
c7d562128d15aef17e58b5ee82a45f323d6343d5

SHA256
afe6c5af83c27570cee716d54d9a3d3e60c9aadc36c615e77cc0186daacf3f55

SHA512
1073cdc69add4c5261d48e3238f163aeb6c1323036c435bbffd790999e231c31c92de825551a3c695193cb7b690457bfb7a07973575c6828e886d87d33103db9

Download Submit
C:\Config.Msi\e5944b8.rbs

Filesize
9KB

MD5
85035072ef8ca6acafd0f83cca12872f

SHA1
533c475c6fd6ef071d217a701d50bd50f8a7111a

SHA256
c9f64d7e03ed9ba647d7cdec2881a2a6b3e5ca0eb9e3dd5bbfb0fd1d3ee43377

SHA512
ccdad8448c8fc0a6185fc228f3d365a9b17fd0bcfe48ec21622ce616777f35cd458fa112349fbddde7dd0be9be911a918a0778af1d954f0863c38cef238c94c0

Download Submit
C:\Config.Msi\e5944bd.rbs

Filesize
10KB

MD5
3d240b4904def35e1c4f897a06c2fb22

SHA1
67e38bd48bb27f77f87cbd26d56d9f6ea5d09c45

SHA256
2e4012a2bb1763ee1e8cfe2635c7e09e0e77856bd50045d4a86a85eee29e2208

SHA512
ed056f5c4aa63489c7cb6bca7dda61b1945355af21435d1486b1b6f09dc1cea655b1908e6a5866071713b39d72542dfd076969d81376d57e8dd20708d895bdc7

Download Submit
C:\Config.Msi\e5944c3.rbs

Filesize
87KB

MD5
da9765eb59f900c942890af5a651c983

SHA1
65ba9397fa393b5b7519a157dce34cf5e861dcf8

SHA256
05e9b7ab00b7a4fe0a997495175f90f6a8d953e08afb973e2156559265428942

SHA512
5189c1b02c7442f1f4288f1a7a3b6b8156ccc63c0b235cf2288d64c0c52e805703231268a2db39d5e5aef52a906f8c9cc4def3ef9f549204d09e31c723f34c30

Download Submit
C:\Program Files\MSCO Launcher\MSCO Launcher.exe

Filesize
253KB

MD5
61eed4273e0517e8ed9c15acdfbf9188

SHA1
27ee71187f71ea600573f4456d9ed2413b340286

SHA256
48552778456efbaff4137e7e216164b01fe2541fde3fe2f1ee2822827ca990ce

SHA512
39cedbb9ace7be3a8b3acde6db7e0315725a459b11d19b70ff0ec885a1e8e9b3b98d40337e404e6264e46deca9f13182c4693f5f8e288c8c9b26d8eb59c627a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
59KB

MD5
746bb224189a406a0245d5e4d44463ea

SHA1
5e2d5dfce5be03b47fe4b1debe21723f9415ede5

SHA256
99b430f2b4d6a2a27833df2a4b5005b63ed3d98ce5cadd5a429b8c6919e0219b

SHA512
9246810b285ef1c8f92de510a28acbe4ec9ce77a60d8346bc347cbd08d891470f822ff25fc3cd8fd992f8c978afc85aec530006d020c2c492364d4d14459ad86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_5.0.17_(x64)_20240212180531_000_dotnet_runtime_5.0.17_win_x64.msi.log

Filesize
2KB

MD5
f2ccbce3d1394b76f3aba1f80c65578a

SHA1
cc4dad9184908377a5de21f4c43d4836b0ee16cb

SHA256
40ec33d020b19572a593e4431be25f8067fc7ea3a0523b8f6d456c245726374d

SHA512
eb3290008fabd953eedf7c20c43a65e0117562394f84ccd9fd66c81b4f562e3df244f5d497b45e36a7b892871b555585348544d0d287d0699ef4a5c1acf1881e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_5.0.17_(x64)_20240212180531_001_dotnet_hostfxr_5.0.17_win_x64.msi.log

Filesize
2KB

MD5
4563432e47a63157aed9fa08f29fa88e

SHA1
91d538075374fe567dc9dc98b0eb5576632b3407

SHA256
1b33b2ff59dbd61a9afbe37b8cf34372b0ac9225b308d47b7b5183c157d933d8

SHA512
05cf398216666b3843dd599edc86ecd53b8a9a4146f0094f02f050f660b562fdabdb9abd8020103df3c337c665e150a2b51a6e364382433ca3469f87cda56575

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_5.0.17_(x64)_20240212180531_002_dotnet_host_5.0.17_win_x64.msi.log

Filesize
2KB

MD5
ba6db14c526038952faaf23aa53cadd7

SHA1
39d05283c6d47159990dfac118440c28eeb09506

SHA256
bf7d8638ee783cfd3d0628c19bd4088b27c175317c4f20e599844b2aaf068bd6

SHA512
ace976c20b83f0bf6993249ccfa915016c1612c57a6f981976aa04772166883314a745cce52117360d79f618241c883691fd81619f749e15170a7b2c71dcb098

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_5.0.17_(x64)_20240212180531_003_windowsdesktop_runtime_5.0.17_win_x64.msi.log

Filesize
2KB

MD5
614a06c0279862a9fb0fcf3d28886f31

SHA1
980e74702007d3f6d0c2c35e15849e48b4b3a4fa

SHA256
2d5bedf26b53acda3cfb1f7083878f3e4cde2541fb0655eebcb606089ff0e29d

SHA512
276ca6568844118084e9bbd1591c92dd94a3dd0a6e39f0c6fe4bec7be9e6a24bf121f83dc7bd32131ecb642069d850d0503e5869a1e21c6d41fe53d8939d13d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0CI8G.tmp\dotnet50desktop_x64.exe

Filesize
8.4MB

MD5
f2a8a20e2e8cf34fc50a45ff50654249

SHA1
2ee6b0d61227eb1438bea0cd9c24178884701db3

SHA256
a17ca59c77fab28d559cecaf16a1f3fc2475682eeae4a0018a83e619836f653a

SHA512
ff8ea26b74db328aeed22191e8dbaefda2eb8fed0cf9de8be8b259bb5d606bc6b0e024ce6b66730956cf7965140fe60273a1b610c080a95c56355471c07fbdc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0CI8G.tmp\dotnet50desktop_x64.exe

Filesize
1.3MB

MD5
fbf1103aef61ac90c31c03b5e76d4004

SHA1
b4dc513a22ccaacd9a3795cd276f4b732fd717bb

SHA256
7bd16b3b951aa7fe768aada982b6f4e9cc29e2e14a778e8cbaa3bf83c9e06809

SHA512
89586981298dac3661615824de4c475044b109ea42b92642c635e287c75c361f9405512884fb18fd8c00bb43e0fe7b32946c84a3fd3f0612910359c32b8d414a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0CI8G.tmp\dotnet50desktop_x64.exe

Filesize
1.3MB

MD5
f2a32390aa7ab4d0f6e9bd50bfce8f32

SHA1
76dad4078f27f50ca7693ff808ae69a21e9f191e

SHA256
cc3baa8304ad85041879fe7ad3e48c08b020ebb99b0d7ca26ea8e2ee66776728

SHA512
f6f06e0dbf77806498766a8a64968104360ac39caf851ee3055db6f89c7b3494e62cb36517edb411fe783aa6e5fc6935b51bf386d5a11493a7756d3d6700b3af

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0CI8G.tmp\netcorecheck_x64.exe

Filesize
140KB

MD5
de54c196cfe1bd90152460b6242f5ad3

SHA1
e1bc2721b1ba41b8157ce72bb6d56bf55b7b4785

SHA256
3b26fe9d187ce9e8275e970bd3884acaae4e0bbf7089759b3378ba44201a3b8b

SHA512
88a29b3788ad4da5f0581bc1e58dcd860060aaf1d3e3def3741d256652b8f257203e1e2b378dd7d38ae648f2efbd11268717a4107b4edb873babd8441b7f68d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IS5SL.tmp\MSCO Launcher Installer.tmp

Filesize
3.0MB

MD5
2aaad2678afe7d91c0f696e845307741

SHA1
60463b3923797b109d470e9a33065d08b8ca3d8a

SHA256
a07d64c1946a2fdf09c65d99988802c4df03edcc3f1188b855534dff23507cfd

SHA512
5a4e72752f5a66ae9287970462d099ef97ee011ebf6d15aaadfc09e901a9fa4e58d5d476d9cb92ace356b0406ff257bc9eb00623f782079ad8282c9724d54968

Download Submit
C:\Windows\Installer\MSI49A2.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI690A.tmp

Filesize
128KB

MD5
98002cf66554383f6755d900d1f503e5

SHA1
2496be56eb0b7ae5d815af81b3e7ecebf81d465e

SHA256
c9368c54d7bc5c5bb7953fe853fde2bae0b48382454aaa53f8dbcb80a909612e

SHA512
cde6f886323ca52b4bff5859264f11461263d61fbeff0f688b695943b975a940ad1764abcf53220520f2f3479ca9cb24d06a408ae36c49bfc074d633aa933e5b

Download Submit
C:\Windows\Installer\MSI8917.tmp

Filesize
201KB

MD5
2af718a6e047348d50acd7c76322336c

SHA1
2f90801d983690c3efb2184bf38310821f640be2

SHA256
9818aa6f39e604aac56ce704466b75ff9975b2b611a9266de6435cc9adf1ff3b

SHA512
72000aeb25831b8451beb355f01ffd7efc7b870e6eb4bcc20169a6fb3e8f193b1f2f0e97446cde7767a041e5c616d5e397abe9e5293c1f3716ffb044797e2181

Download Submit
C:\Windows\Installer\e5944b0.msi

Filesize
2.4MB

MD5
5e5f099b1cdaaa5464fbd544d8c2ebbb

SHA1
7e0dadbc47472ec14eb0defc9c8ddb2e913146aa

SHA256
b8f2fd86009ab963a876f708e17a342f6d6d93bf0469195169f6857994f47eb3

SHA512
e273f4fb96140f8a52736788667adeddd2189b28ef1babc6f8c9b2df69b4cae9b92cb705b74939ab8259d68c8050df4560b0f55b76841e47cb5dd1b2930f1837

Download Submit
C:\Windows\Temp\{AA1EC6C2-E032-4259-99C3-746ECC5A8387}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{AA1EC6C2-E032-4259-99C3-746ECC5A8387}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{AA1EC6C2-E032-4259-99C3-746ECC5A8387}\dotnet_host_5.0.17_win_x64.msi

Filesize
697KB

MD5
57a4e7cf0d9c76d85ea718fc8b676300

SHA1
6d0203f48d503c3c885a8fc6064acc73592ae1c5

SHA256
352524c1477d955122ab384f112692a81958a225cb12f9fab11dc8beada938bd

SHA512
a74b339c13ffd323fdfc04d862d91fe112498c461b1be5e371c1fe795fd20a1248dde513ff5cb7dabf5ae033d953d3e1b9c25227a650e4f79862e57d3444e7ab

Download Submit
C:\Windows\Temp\{AA1EC6C2-E032-4259-99C3-746ECC5A8387}\dotnet_hostfxr_5.0.17_win_x64.msi

Filesize
784KB

MD5
911b1d0ad5f89c5185c0e4fafea4d5de

SHA1
ff4e052462e361798627686873e4f0d07b74822a

SHA256
df407abab4d26eb421878d700e38574b7e628d30422e7d3937559eb7f3575eef

SHA512
46856e4f83b313fc8106a7c5b4a1ebf7c7f65b7c6efd7468dd5084eabb11791a4edef67f69594ef18c7f96045e38d3ff25f07f80c4f6f48bfae3df957318666b

Download Submit
C:\Windows\Temp\{AA1EC6C2-E032-4259-99C3-746ECC5A8387}\dotnet_runtime_5.0.17_win_x64.msi

Filesize
1.4MB

MD5
ad0e3178ab42553c5910f9a2674159bf

SHA1
0b3e0a626d4ab87c09bc1525d7345bc288bd60d4

SHA256
80642e90f3bf9a06c1c0d6ae5a22da9e29b78ca57b5e434934c95211014298d1

SHA512
550f8ec308f23259b736f7524844840daa9d198983cd431e0ac882d6b1c8c988f45c30222bbc41376737b00170fe9a9c7b07bc4158e66ad9cd4977874c6b6015

Download Submit
C:\Windows\Temp\{AA1EC6C2-E032-4259-99C3-746ECC5A8387}\windowsdesktop_runtime_5.0.17_win_x64.msi

Filesize
769KB

MD5
58fa1fd12c46c080c1008e066f2cb53d

SHA1
b8912a9696fcc729392a60a872bab0a21914dd27

SHA256
0637f50b2a2d4f0c4c9e7fee5fc6e2d17523123d5150a40e27b80fd66a31c05b

SHA512
9e46fa0d143f7b7374516eeb9576c5c45ab11101129075a5220e0037b3616eeac16adeab355edb644c5f9da569bc8fa404693ca50344dd3fc4c0d5ad2f6c0ec1

Download Submit
C:\Windows\Temp\{AD1A2D36-F601-4EB7-99B4-15061E0123A3}\.cr\dotnet50desktop_x64.exe

Filesize
609KB

MD5
a1591a05972cc13cbcccb4ea66de7f75

SHA1
b8a951533f3609b415eb9de6f15604b12bea030e

SHA256
ec9d13712d5afc3d83ec6379d9f66db3486f85ba7401cd79c915ea62b8e71c8a

SHA512
a82c870947325ad849aa49fd05c18ecb14fbe838c97dc29379d20a5b852e3a54321358fae431df71c4aac9dde725bb1324f254a2c4b20e9ba10afb3a61e518f8

Download Submit
memory/1840-143-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/1840-38-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/1840-36-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/1840-26-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/1840-23-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/1840-6-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/1840-840-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/4236-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4236-22-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download