06fb5f8b5c42c35d87a1031cc7d25c630c6cf4380460307a5e027e61d1d33b02

Analysis

max time kernel
45s
max time network
127s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26-05-2023 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2005_x64.exe
Size

3.1MB
MD5

abde5e0a22a46434bd0df652a63fff44
SHA1

c5088da4be3f72b4af2f3156893bf1d2b1f6f6ec
SHA256

b1cbcde3791e0b1c6df3def43d8c05035c60fe2f6a2d8ba091abb4509fb43ef1
SHA512

4ebd8971dea1efb9a72fee071694da7c9d8c797b3564cec7e0044d24b01a13009013f4a43719b7e223214a6c43d50d56790751b9e91cd324d40809bf0d605d9f
SSDEEP

49152:RVgGXsOTkzq69oXxerpduZ6xJftGEkU0oEBL/txTroHENHTpPE6fIr6VAVP04PLJ:R7XFcDehoLtXEBv11TqZl04P5PqE

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

VCREDI~2.EXE

pid process

1612 VCREDI~2.EXE
Loads dropped DLL 5 IoCs

Processes:

vcredist2005_x64.exeVCREDI~2.EXEMsiExec.exe

pid process

1600 vcredist2005_x64.exe
1612 VCREDI~2.EXE
1612 VCREDI~2.EXE
1612 VCREDI~2.EXE
572 MsiExec.exe

pid	process
1612	VCREDI~2.EXE

pid	process
1600	vcredist2005_x64.exe
1612	VCREDI~2.EXE
1612	VCREDI~2.EXE
1612	VCREDI~2.EXE
572	MsiExec.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vcredist2005_x64.exeVCREDI~2.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vcredist2005_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	vcredist2005_x64.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	VCREDI~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	VCREDI~2.EXE

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 1 IoCs

Processes:

msiexec.exe

description ioc process

File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe

Drops file in Windows directory 59 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\WinSxS\InstallTemp\20230526223335168.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335168.0\mfc80JPN.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223333748.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335168.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_3ed5eb6c.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335168.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_3ed5eb6c.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335168.0\mfc80FRA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335370.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_19a62d03.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335511.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335168.0\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335168.0\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223334871.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e986d26e.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223334871.0\mfc80.dll	msiexec.exe
File created	C:\Windows\Installer\6ce47a.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223334871.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223335370.0	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIEF62.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223334653.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_18a05f69.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335168.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335620.0\8.0.50727.4053.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223335168.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335511.0\8.0.50727.4053.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223333748.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223333748.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_79404cdd.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223334871.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335651.0\8.0.50727.4053.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223335573.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223335620.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223335651.0	msiexec.exe
File opened for modification	C:\Windows\Installer\6ce476.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223334871.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e986d26e.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335433.0\8.0.50727.4053.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223333748.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_79404cdd.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335651.0\8.0.50727.4053.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223335511.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223334871.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335168.0\mfc80KOR.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\6ce478.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\6ce476.msi	msiexec.exe
File created	C:\Windows\Installer\6ce478.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223334653.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_18a05f69.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335573.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335168.0\mfc80DEU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335370.0\vcomp.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335573.0\8.0.50727.4053.policy	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223334653.0\msvcm80.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223335433.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEABF.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335168.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335370.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_19a62d03.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335620.0\8.0.50727.4053.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223334653.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223334653.0\msvcr80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223334653.0\msvcp80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223334871.0\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223335433.0\8.0.50727.4053.cat	msiexec.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe

Modifies registry class 56 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Version = "134276920"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e0049004c005400540052005900320074004f005700650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf\VC_Redist	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\PackageCode = "83DB259064B8669479679DCD441743AC"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

1632 msiexec.exe
1632 msiexec.exe

pid	process
1632	msiexec.exe
1632	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	1476	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1476	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeSecurityPrivilege	1632	msiexec.exe
Token: SeCreateTokenPrivilege	1476	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1476	msiexec.exe
Token: SeLockMemoryPrivilege	1476	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1476	msiexec.exe
Token: SeMachineAccountPrivilege	1476	msiexec.exe
Token: SeTcbPrivilege	1476	msiexec.exe
Token: SeSecurityPrivilege	1476	msiexec.exe
Token: SeTakeOwnershipPrivilege	1476	msiexec.exe
Token: SeLoadDriverPrivilege	1476	msiexec.exe
Token: SeSystemProfilePrivilege	1476	msiexec.exe
Token: SeSystemtimePrivilege	1476	msiexec.exe
Token: SeProfSingleProcessPrivilege	1476	msiexec.exe
Token: SeIncBasePriorityPrivilege	1476	msiexec.exe
Token: SeCreatePagefilePrivilege	1476	msiexec.exe
Token: SeCreatePermanentPrivilege	1476	msiexec.exe
Token: SeBackupPrivilege	1476	msiexec.exe
Token: SeRestorePrivilege	1476	msiexec.exe
Token: SeShutdownPrivilege	1476	msiexec.exe
Token: SeDebugPrivilege	1476	msiexec.exe
Token: SeAuditPrivilege	1476	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1476	msiexec.exe
Token: SeChangeNotifyPrivilege	1476	msiexec.exe
Token: SeRemoteShutdownPrivilege	1476	msiexec.exe
Token: SeUndockPrivilege	1476	msiexec.exe
Token: SeSyncAgentPrivilege	1476	msiexec.exe
Token: SeEnableDelegationPrivilege	1476	msiexec.exe
Token: SeManageVolumePrivilege	1476	msiexec.exe
Token: SeImpersonatePrivilege	1476	msiexec.exe
Token: SeCreateGlobalPrivilege	1476	msiexec.exe
Token: SeBackupPrivilege	624	vssvc.exe
Token: SeRestorePrivilege	624	vssvc.exe
Token: SeAuditPrivilege	624	vssvc.exe
Token: SeBackupPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1628	DrvInst.exe
Token: SeRestorePrivilege	1628	DrvInst.exe
Token: SeRestorePrivilege	1628	DrvInst.exe
Token: SeRestorePrivilege	1628	DrvInst.exe
Token: SeRestorePrivilege	1628	DrvInst.exe
Token: SeRestorePrivilege	1628	DrvInst.exe
Token: SeRestorePrivilege	1628	DrvInst.exe
Token: SeLoadDriverPrivilege	1628	DrvInst.exe
Token: SeLoadDriverPrivilege	1628	DrvInst.exe
Token: SeLoadDriverPrivilege	1628	DrvInst.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1476 msiexec.exe
1476 msiexec.exe

pid	process
1476	msiexec.exe
1476	msiexec.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

vcredist2005_x64.exeVCREDI~2.EXEmsiexec.exe

description	pid	process	target process
PID 1600 wrote to memory of 1612	1600	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1600 wrote to memory of 1612	1600	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1600 wrote to memory of 1612	1600	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1600 wrote to memory of 1612	1600	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1600 wrote to memory of 1612	1600	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1600 wrote to memory of 1612	1600	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1600 wrote to memory of 1612	1600	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1612 wrote to memory of 1476	1612	VCREDI~2.EXE	msiexec.exe
PID 1612 wrote to memory of 1476	1612	VCREDI~2.EXE	msiexec.exe
PID 1612 wrote to memory of 1476	1612	VCREDI~2.EXE	msiexec.exe
PID 1612 wrote to memory of 1476	1612	VCREDI~2.EXE	msiexec.exe
PID 1612 wrote to memory of 1476	1612	VCREDI~2.EXE	msiexec.exe
PID 1612 wrote to memory of 1476	1612	VCREDI~2.EXE	msiexec.exe
PID 1612 wrote to memory of 1476	1612	VCREDI~2.EXE	msiexec.exe
PID 1632 wrote to memory of 572	1632	msiexec.exe	MsiExec.exe
PID 1632 wrote to memory of 572	1632	msiexec.exe	MsiExec.exe
PID 1632 wrote to memory of 572	1632	msiexec.exe	MsiExec.exe
PID 1632 wrote to memory of 572	1632	msiexec.exe	MsiExec.exe
PID 1632 wrote to memory of 572	1632	msiexec.exe	MsiExec.exe
PID 1632 wrote to memory of 572	1632	msiexec.exe	MsiExec.exe
PID 1632 wrote to memory of 572	1632	msiexec.exe	MsiExec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2005_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2005_x64.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1600

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\msiexec.exe
msiexec /i vcredist.msi
3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1476

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding FC5EA418B1479F710E1BDFCFDC77D931
2⤵
- Loads dropped DLL
PID:572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:624

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000002CC" "00000000000005A8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8633a7fcbad00ab06369cc9d43c19826

SHA1
1dd1673f497bd70646b413d2d3e06290b41869d2

SHA256
10aa70e3ff673463659d547838a545075caa75c59f61377b087cb95143dee0d6

SHA512
531821e5937f4b65ee68d8416da93c5f48c0706beb2ecf1196e74bf7f3a1f3e82c8a55e093c2c422acf72f05e3c47e79c069303726adc73d6e6e4959084797a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE4C4.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab

Filesize
312KB

MD5
0aa0da68a91e9133715d9cde2a180ffb

SHA1
892e941bed49b3404dad2aa33cd36b708e1443a9

SHA256
64570910e03c337d4e1f8ab1b9fb8e4dc46fdccb93857a1e9c73b296c6850fe0

SHA512
247dc48b39844fcfbfd46ef8eb1c72375b183f2d54361f5fe857d3a1b7275145cd0a9be8f287e037b46912a496a39a8855c20a63a8c663b60fc620b0b35e2313

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi

Filesize
3.0MB

MD5
391dddd564a9e8a20576fe05e5e1f25b

SHA1
84f17830075abea6e6a369dee6b93ac16a71f025

SHA256
a9a8dac04e3b38c2f8d33ee7cf6d658fa4ea089bbf9f4014eb61b9d5de7dc6a2

SHA512
10358d52620178296c9033b257db960d3bf9b1219fa5b6f02f1173234686930616da708c5ac051b0c0c8892b3b66164093fc64698de43e56cf3b6f1d875e418f

Download Submit
C:\Windows\Installer\6ce476.msi

Filesize
3.0MB

MD5
391dddd564a9e8a20576fe05e5e1f25b

SHA1
84f17830075abea6e6a369dee6b93ac16a71f025

SHA256
a9a8dac04e3b38c2f8d33ee7cf6d658fa4ea089bbf9f4014eb61b9d5de7dc6a2

SHA512
10358d52620178296c9033b257db960d3bf9b1219fa5b6f02f1173234686930616da708c5ac051b0c0c8892b3b66164093fc64698de43e56cf3b6f1d875e418f

Download Submit
C:\Windows\Installer\MSIEABF.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
\Windows\Installer\MSIEABF.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit