06fb5f8b5c42c35d87a1031cc7d25c630c6cf4380460307a5e027e61d1d33b02

Analysis

max time kernel
131s
max time network
127s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26-05-2023 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Pizza.Tower.v1.0.311/_Redist/_Redist/install_all.bat
Size

1KB
MD5

0a97820f9eef2c02e4fc49958b05f2a0
SHA1

9c88b0f039e0cfe5a5f3b60cbab15cb802d5e2d3
SHA256

38c080778514b99f159eece9be4f6d850decc0710589bf043aa73f0a604d1442
SHA512

b6db2caf24e9d909058f18fc828b33993eb7934346e7e362a3f6a3885ee16f0a4de211876803efc9810bbffb3bd3c876431d4e78adc014dc2d0f0378dccb121d

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

5 1528 msiexec.exe
Executes dropped EXE 7 IoCs

Processes:

VCREDI~3.EXEVCREDI~2.EXEinstall.exeinstall.exeSetup.exeSetup.exe

pid process

1692 VCREDI~3.EXE
1688 VCREDI~2.EXE
392 install.exe
1748 install.exe
1268
1852 Setup.exe
1340 Setup.exe

flow	pid	process
5	1528	msiexec.exe

pid	process
1692	VCREDI~3.EXE
1688	VCREDI~2.EXE
392	install.exe
1748	install.exe
1268
1852	Setup.exe
1340	Setup.exe

Loads dropped DLL 64 IoCs

Processes:

vcredist2005_x86.exeVCREDI~3.EXEMsiExec.exevcredist2005_x64.exeVCREDI~2.EXEMsiExec.exevcredist2008_x86.exeinstall.exevcredist2008_x64.exeinstall.exemsiexec.exevcredist2010_x86.exeSetup.exe

pid	process
924	vcredist2005_x86.exe
1692	VCREDI~3.EXE
1692	VCREDI~3.EXE
1692	VCREDI~3.EXE
280	MsiExec.exe
1228	vcredist2005_x64.exe
1688	VCREDI~2.EXE
1688	VCREDI~2.EXE
1688	VCREDI~2.EXE
1188	MsiExec.exe
1992	vcredist2008_x86.exe
392	install.exe
1340	vcredist2008_x64.exe
1340	vcredist2008_x64.exe
836
836
1748	install.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1600	vcredist2010_x86.exe
1852	Setup.exe
1852	Setup.exe
1852	Setup.exe
1852	Setup.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

VCREDI~2.EXEvcredist2012_x86.exevcredist2005_x86.exeVCREDI~3.EXEvcredist2005_x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	VCREDI~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	VCREDI~2.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vcredist2012_x86.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vcredist2005_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	VCREDI~3.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vcredist2005_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	vcredist2005_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	vcredist2005_x86.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	VCREDI~3.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} = "\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_x86_20230526223442.log\" /passive /norestart ignored /burn.runonce"	vcredist2012_x86.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in System32 directory 36 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	\??\c:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfcm100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100kor.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfcm100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\atl100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\msvcr100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100cht.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100chs.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfcm100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100kor.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100ita.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100cht.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100rus.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100jpn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100rus.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\msvcp100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100enu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100ita.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100fra.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\vcomp100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\atl100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100deu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100fra.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100jpn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\vcomp100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100deu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100chs.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100esn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\msvcp100.dll	msiexec.exe

Drops file in Program Files directory 6 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328150.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328150.0\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328369.0\mfc80ESP.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\6d1108.msp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328369.0\mfc80JPN.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223328369.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223411908.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223411908.0\mfc80FRA.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1642.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223411237.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_79404cdd.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223412220.0\8.0.50727.4053.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223411237.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328150.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328369.0\mfc80DEU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328712.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223411643.0\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223411908.0\mfc80DEU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223412158.0\8.0.50727.4053.policy	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\6d110f.msp	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223412158.0	msiexec.exe
File created	\??\c:\Windows\Installer\6d1102.ipi	msiexec.exe
File created	C:\Windows\Installer\6d10f5.ipi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223328603.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223411643.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e986d26e.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223411643.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223412111.0\vcomp.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223412236.0\8.0.50727.4053.cat	msiexec.exe
File created	\??\c:\Windows\Installer\6d110a.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223412205.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328369.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328603.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e79c4723.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328727.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328743.0\8.0.50727.4053.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223411347.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_18a05f69.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223412111.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_19a62d03.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328369.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328603.0\vcomp.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526223412205.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328369.0\mfc80FRA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223411347.0\msvcr80.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF4A6.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI1E5E.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223411347.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223411908.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_3ed5eb6c.cat	msiexec.exe
File created	\??\c:\Windows\Installer\6d1106.ipi	msiexec.exe
File created	C:\Windows\Installer\6d10f3.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223411643.0\mfc80.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\6d110a.ipi	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\6d1102.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\6d10f3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328369.0\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223328712.0\8.0.50727.4053.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223412158.0\8.0.50727.4053.cat	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223411237.0\ATL80.dll	msiexec.exe
File created	\??\c:\Windows\Installer\6d10fe.ipi	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\6d10fe.ipi	msiexec.exe
File created	C:\Windows\Installer\6d10f7.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526223411908.0\mfc80KOR.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A40.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\6d1111.ipi	msiexec.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

740 1608 WerFault.exe vcredist2012_x86.exe

pid	pid_target	process	target process
740	1608	WerFault.exe	vcredist2012_x86.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exeSetup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Modifies data under HKEY_USERS 60 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\34	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e004e002e004b004300300068004d0064007b00340060006d002b00380039004f002e002e003100540000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFCLOC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800360034003e0077006e002e005a006000290063004000760034003d004b002c0044004f00360056007e0028006e0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f004f007700390052005a004800670055003f005d004a004b0073002700780077005a0043003200560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\VC_RED_enu_amd64_net_SETUP	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList\Net\2 = "c:\\fc82f6aebf4aee972fe0529ecd\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f004f007700390052005a004800670055003f005d004a004b0073002700780077005a0043003200560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\FT_VCRedist_x86_KB2565063_Detection	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3e43b73803c7c394f8a6b2f0402e19c2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\LastUsedSource = "n;2;c:\\4957c5217020694f1ae9\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\FT_VC_Redist_OpenMP_x64 = "VC_Redist_12222_amd64_enu"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches\Patches = 3200440030003000350038004600360046003000380041003700340033003300300039003100380034004200450031003100370038004300390035004200320000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList\LastUsedSource = "n;2;c:\\68016451cdcf5083a1\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\4D54076CED4F5BA32BBD3E5FAD1CD4C9\SourceList\Net\2 = "c:\\fc82f6aebf4aee972fe0529ecd\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFCLOC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800380036003e0042005b00240070007200510032006f004d003800720048007b00720067003d00320065006e002e0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\VC_Redist_12222_amd64_enu	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\ProductName = "Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.OpenMP,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e0032005f0072002700710025004a006a004a0034007600780044002800660049004c0067005a00780000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f00410054004c005f007800360034003e0049005b00280055004d0049005b007600260036006a006d005f004f0071005400570060004100370000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f00410054004c005f007800360034003e006a0068004f00670050007e006b003600580037002e00580036005000780024002e0028005f00530000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800360034003e007900700040005500210076003f005400490037006c007a004c00450075005a003d005a003100730000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\LastUsedSource = "n;2;c:\\b450131cdbf1813126cc5412ba\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\Servicing_Key	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\KB2544655 = "Servicing_Key"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004300520054005f007800360034003e0028002e006f0034002e0054004c005e00690033005a00760060007d00610026003f0049002900260000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\Net\2 = "c:\\68016451cdcf5083a1\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f004f007700390052005a004800670055003f005d004a004b0073002700780077005a0043003200560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\Version = "167812379"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3e43b73803c7c394f8a6b2f0402e19c2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\PackageCode = "89402836B2F60B04F9803CF6D2C84E21"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\KB2544655 = "Servicing_Key"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\4D54076CED4F5BA32BBD3E5FAD1CD4C9\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f004f007700390052005a004800670055003f005d004a004b0073002700780077005a0043003200560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList\LastUsedSource = "n;2;c:\\fc82f6aebf4aee972fe0529ecd\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6	msiexec.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 7 IoCs

Processes:

vcredist2005_x86.exevcredist2005_x64.exevcredist2008_x86.exevcredist2008_x64.exevcredist2010_x86.exevcredist2010_x64.exevcredist2012_x86.exe

pid	process
924	vcredist2005_x86.exe
1228	vcredist2005_x64.exe
1992	vcredist2008_x86.exe
1340	vcredist2008_x64.exe
1600	vcredist2010_x86.exe
916	vcredist2010_x64.exe
268	vcredist2012_x86.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

msiexec.exeSetup.exeSetup.exe

pid	process
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1852	Setup.exe
1852	Setup.exe
1852	Setup.exe
1852	Setup.exe
1852	Setup.exe
1852	Setup.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1340	Setup.exe
1340	Setup.exe
1340	Setup.exe
1340	Setup.exe
1340	Setup.exe
1340	Setup.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe
1528	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	520	msiexec.exe
Token: SeIncreaseQuotaPrivilege	520	msiexec.exe
Token: SeRestorePrivilege	1528	msiexec.exe
Token: SeTakeOwnershipPrivilege	1528	msiexec.exe
Token: SeSecurityPrivilege	1528	msiexec.exe
Token: SeCreateTokenPrivilege	520	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	520	msiexec.exe
Token: SeLockMemoryPrivilege	520	msiexec.exe
Token: SeIncreaseQuotaPrivilege	520	msiexec.exe
Token: SeMachineAccountPrivilege	520	msiexec.exe
Token: SeTcbPrivilege	520	msiexec.exe
Token: SeSecurityPrivilege	520	msiexec.exe
Token: SeTakeOwnershipPrivilege	520	msiexec.exe
Token: SeLoadDriverPrivilege	520	msiexec.exe
Token: SeSystemProfilePrivilege	520	msiexec.exe
Token: SeSystemtimePrivilege	520	msiexec.exe
Token: SeProfSingleProcessPrivilege	520	msiexec.exe
Token: SeIncBasePriorityPrivilege	520	msiexec.exe
Token: SeCreatePagefilePrivilege	520	msiexec.exe
Token: SeCreatePermanentPrivilege	520	msiexec.exe
Token: SeBackupPrivilege	520	msiexec.exe
Token: SeRestorePrivilege	520	msiexec.exe
Token: SeShutdownPrivilege	520	msiexec.exe
Token: SeDebugPrivilege	520	msiexec.exe
Token: SeAuditPrivilege	520	msiexec.exe
Token: SeSystemEnvironmentPrivilege	520	msiexec.exe
Token: SeChangeNotifyPrivilege	520	msiexec.exe
Token: SeRemoteShutdownPrivilege	520	msiexec.exe
Token: SeUndockPrivilege	520	msiexec.exe
Token: SeSyncAgentPrivilege	520	msiexec.exe
Token: SeEnableDelegationPrivilege	520	msiexec.exe
Token: SeManageVolumePrivilege	520	msiexec.exe
Token: SeImpersonatePrivilege	520	msiexec.exe
Token: SeCreateGlobalPrivilege	520	msiexec.exe
Token: SeBackupPrivilege	820	vssvc.exe
Token: SeRestorePrivilege	820	vssvc.exe
Token: SeAuditPrivilege	820	vssvc.exe
Token: SeBackupPrivilege	1528	msiexec.exe
Token: SeRestorePrivilege	1528	msiexec.exe
Token: SeRestorePrivilege	1164	DrvInst.exe
Token: SeRestorePrivilege	1164	DrvInst.exe
Token: SeRestorePrivilege	1164	DrvInst.exe
Token: SeRestorePrivilege	1164	DrvInst.exe
Token: SeRestorePrivilege	1164	DrvInst.exe
Token: SeRestorePrivilege	1164	DrvInst.exe
Token: SeRestorePrivilege	1164	DrvInst.exe
Token: SeLoadDriverPrivilege	1164	DrvInst.exe
Token: SeLoadDriverPrivilege	1164	DrvInst.exe
Token: SeLoadDriverPrivilege	1164	DrvInst.exe
Token: SeRestorePrivilege	1528	msiexec.exe
Token: SeTakeOwnershipPrivilege	1528	msiexec.exe
Token: SeRestorePrivilege	1528	msiexec.exe
Token: SeTakeOwnershipPrivilege	1528	msiexec.exe
Token: SeRestorePrivilege	1528	msiexec.exe
Token: SeTakeOwnershipPrivilege	1528	msiexec.exe
Token: SeRestorePrivilege	1528	msiexec.exe
Token: SeTakeOwnershipPrivilege	1528	msiexec.exe
Token: SeRestorePrivilege	1528	msiexec.exe
Token: SeTakeOwnershipPrivilege	1528	msiexec.exe
Token: SeRestorePrivilege	1528	msiexec.exe
Token: SeTakeOwnershipPrivilege	1528	msiexec.exe
Token: SeRestorePrivilege	1528	msiexec.exe
Token: SeTakeOwnershipPrivilege	1528	msiexec.exe
Token: SeRestorePrivilege	1528	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

msiexec.exemsiexec.exeinstall.exeinstall.exevcredist2012_x86.exe

pid	process
520	msiexec.exe
520	msiexec.exe
1316	msiexec.exe
1316	msiexec.exe
392	install.exe
392	install.exe
1748	install.exe
1748	install.exe
1608	vcredist2012_x86.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exevcredist2005_x86.exeVCREDI~3.EXEmsiexec.exevcredist2005_x64.exeVCREDI~2.EXEvcredist2008_x86.exe

description	pid	process	target process
PID 1460 wrote to memory of 924	1460	cmd.exe	vcredist2005_x86.exe
PID 1460 wrote to memory of 924	1460	cmd.exe	vcredist2005_x86.exe
PID 1460 wrote to memory of 924	1460	cmd.exe	vcredist2005_x86.exe
PID 1460 wrote to memory of 924	1460	cmd.exe	vcredist2005_x86.exe
PID 1460 wrote to memory of 924	1460	cmd.exe	vcredist2005_x86.exe
PID 1460 wrote to memory of 924	1460	cmd.exe	vcredist2005_x86.exe
PID 1460 wrote to memory of 924	1460	cmd.exe	vcredist2005_x86.exe
PID 924 wrote to memory of 1692	924	vcredist2005_x86.exe	VCREDI~3.EXE
PID 924 wrote to memory of 1692	924	vcredist2005_x86.exe	VCREDI~3.EXE
PID 924 wrote to memory of 1692	924	vcredist2005_x86.exe	VCREDI~3.EXE
PID 924 wrote to memory of 1692	924	vcredist2005_x86.exe	VCREDI~3.EXE
PID 924 wrote to memory of 1692	924	vcredist2005_x86.exe	VCREDI~3.EXE
PID 924 wrote to memory of 1692	924	vcredist2005_x86.exe	VCREDI~3.EXE
PID 924 wrote to memory of 1692	924	vcredist2005_x86.exe	VCREDI~3.EXE
PID 1692 wrote to memory of 520	1692	VCREDI~3.EXE	msiexec.exe
PID 1692 wrote to memory of 520	1692	VCREDI~3.EXE	msiexec.exe
PID 1692 wrote to memory of 520	1692	VCREDI~3.EXE	msiexec.exe
PID 1692 wrote to memory of 520	1692	VCREDI~3.EXE	msiexec.exe
PID 1692 wrote to memory of 520	1692	VCREDI~3.EXE	msiexec.exe
PID 1692 wrote to memory of 520	1692	VCREDI~3.EXE	msiexec.exe
PID 1692 wrote to memory of 520	1692	VCREDI~3.EXE	msiexec.exe
PID 1528 wrote to memory of 280	1528	msiexec.exe	MsiExec.exe
PID 1528 wrote to memory of 280	1528	msiexec.exe	MsiExec.exe
PID 1528 wrote to memory of 280	1528	msiexec.exe	MsiExec.exe
PID 1528 wrote to memory of 280	1528	msiexec.exe	MsiExec.exe
PID 1528 wrote to memory of 280	1528	msiexec.exe	MsiExec.exe
PID 1528 wrote to memory of 280	1528	msiexec.exe	MsiExec.exe
PID 1528 wrote to memory of 280	1528	msiexec.exe	MsiExec.exe
PID 1460 wrote to memory of 1228	1460	cmd.exe	vcredist2005_x64.exe
PID 1460 wrote to memory of 1228	1460	cmd.exe	vcredist2005_x64.exe
PID 1460 wrote to memory of 1228	1460	cmd.exe	vcredist2005_x64.exe
PID 1460 wrote to memory of 1228	1460	cmd.exe	vcredist2005_x64.exe
PID 1460 wrote to memory of 1228	1460	cmd.exe	vcredist2005_x64.exe
PID 1460 wrote to memory of 1228	1460	cmd.exe	vcredist2005_x64.exe
PID 1460 wrote to memory of 1228	1460	cmd.exe	vcredist2005_x64.exe
PID 1228 wrote to memory of 1688	1228	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1228 wrote to memory of 1688	1228	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1228 wrote to memory of 1688	1228	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1228 wrote to memory of 1688	1228	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1228 wrote to memory of 1688	1228	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1228 wrote to memory of 1688	1228	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1228 wrote to memory of 1688	1228	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1688 wrote to memory of 1316	1688	VCREDI~2.EXE	msiexec.exe
PID 1688 wrote to memory of 1316	1688	VCREDI~2.EXE	msiexec.exe
PID 1688 wrote to memory of 1316	1688	VCREDI~2.EXE	msiexec.exe
PID 1688 wrote to memory of 1316	1688	VCREDI~2.EXE	msiexec.exe
PID 1688 wrote to memory of 1316	1688	VCREDI~2.EXE	msiexec.exe
PID 1688 wrote to memory of 1316	1688	VCREDI~2.EXE	msiexec.exe
PID 1688 wrote to memory of 1316	1688	VCREDI~2.EXE	msiexec.exe
PID 1528 wrote to memory of 1188	1528	msiexec.exe	MsiExec.exe
PID 1528 wrote to memory of 1188	1528	msiexec.exe	MsiExec.exe
PID 1528 wrote to memory of 1188	1528	msiexec.exe	MsiExec.exe
PID 1528 wrote to memory of 1188	1528	msiexec.exe	MsiExec.exe
PID 1528 wrote to memory of 1188	1528	msiexec.exe	MsiExec.exe
PID 1528 wrote to memory of 1188	1528	msiexec.exe	MsiExec.exe
PID 1528 wrote to memory of 1188	1528	msiexec.exe	MsiExec.exe
PID 1460 wrote to memory of 1992	1460	cmd.exe	vcredist2008_x86.exe
PID 1460 wrote to memory of 1992	1460	cmd.exe	vcredist2008_x86.exe
PID 1460 wrote to memory of 1992	1460	cmd.exe	vcredist2008_x86.exe
PID 1460 wrote to memory of 1992	1460	cmd.exe	vcredist2008_x86.exe
PID 1460 wrote to memory of 1992	1460	cmd.exe	vcredist2008_x86.exe
PID 1460 wrote to memory of 1992	1460	cmd.exe	vcredist2008_x86.exe
PID 1460 wrote to memory of 1992	1460	cmd.exe	vcredist2008_x86.exe
PID 1992 wrote to memory of 392	1992	vcredist2008_x86.exe	install.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\install_all.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2005_x86.exe
vcredist2005_x86.exe /q
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:924

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\msiexec.exe
msiexec /i vcredist.msi
4⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:520

C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2005_x64.exe
vcredist2005_x64.exe /q
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VCREDI~2.EXE
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VCREDI~2.EXE
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\msiexec.exe
msiexec /i vcredist.msi
4⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:1316

C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2008_x86.exe
vcredist2008_x86.exe /qb
2⤵
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1992

\??\c:\4957c5217020694f1ae9\install.exe
c:\4957c5217020694f1ae9\.\install.exe /qb
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:392

C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2008_x64.exe
vcredist2008_x64.exe /qb
2⤵
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1340

\??\c:\b450131cdbf1813126cc5412ba\install.exe
c:\b450131cdbf1813126cc5412ba\.\install.exe /qb
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1748

C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2010_x86.exe
vcredist2010_x86.exe /passive /norestart
2⤵
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1600

\??\c:\68016451cdcf5083a1\Setup.exe
c:\68016451cdcf5083a1\Setup.exe /passive /norestart
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1852

C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2010_x64.exe
vcredist2010_x64.exe /passive /norestart
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:916

\??\c:\fc82f6aebf4aee972fe0529ecd\Setup.exe
c:\fc82f6aebf4aee972fe0529ecd\Setup.exe /passive /norestart
3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1340

C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2012_x86.exe
vcredist2012_x86.exe /passive /norestart
2⤵
- Adds Run key to start application
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:268

C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2012_x86.exe
"C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2012_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{656700AE-DE9D-4662-8656-08D1CB1CFA1C} {9F23F7B4-4FE9-4F51-BF5C-53DE2E4200FB} 268
3⤵
- Suspicious use of FindShellTrayWindow
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 344
4⤵
- Program crash
PID:740

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 34B729B22452DCDBDB56B62EAD85F4CE
2⤵
- Loads dropped DLL
PID:280

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A8318C430EC1C1AA2A99D99615D746DF
2⤵
- Loads dropped DLL
PID:1188

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:820

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004A0" "0000000000000570"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\4957c5217020694f1ae9\install.exe

Filesize
547KB

MD5
4138c31964fbcb3b7418e086933324c3

SHA1
97cc6f58fb064ab6c4a2f02fb665fef77d30532f

SHA256
b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29

SHA512
40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557

Download Submit
C:\68016451cdcf5083a1\Setup.exe

Filesize
76KB

MD5
2af2c1a78542975b12282aca4300d515

SHA1
3216c853ed82e41dfbeb6ca48855fdcd41478507

SHA256
531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7

SHA512
4a70bd4b542f6001e46f827f341676c34af1ea216c50ad981dd04f547cd67f73aaa420fcbed379dc05dab199bf5ba00d899c49ff75da577613209f96226227eb

Download Submit
C:\Config.Msi\6d10ff.rbs

Filesize
29KB

MD5
96e760d32cbde7cf950c98324f19f506

SHA1
00394731455da2d2296ebe2378f879a8ff132188

SHA256
854e9b65bdff3904cd91d453a4747e60a10c3711b073999f5fb5edc130822a8b

SHA512
7eeb532db9cc1b5340af1cda9daae380e78810915da9ed1bdb828b29c25e5c54fce2f997a76fe9d06f079dd7a76f2d78052df955c60af95ff1bcf8e75732fbd6

Download Submit
C:\Config.Msi\6d1103.rbs

Filesize
29KB

MD5
74594b96695a0325da800f60d4675f9e

SHA1
f514cafa864fc753ecbf4131e32e71c7f46fef84

SHA256
415b7c71efb9009b01d69852bebd43d758be6ee29ebdc3fe7534ec2fcfa218eb

SHA512
f772cb4da322e074b4cb5c46061dd00eba7a1e4533edd373385da89d27e036a601c5ad71be5f60a307ddd97b8bbe0f44a97fc93bd901d21ec000a0c5953a7601

Download Submit
C:\Config.Msi\6d1107.rbs

Filesize
4KB

MD5
249f56caffe8e29e8638e829de2cc4c7

SHA1
38d7dd7f75c411a95750cf15541a27173c4a68be

SHA256
1c11678edd98325d45cfd3a081496f40c98fcacadf6894aafc409494b2b543aa

SHA512
f07a420af88b9491afeb15d1b06fc9a296211c1023f1a91c3e1f4a51b684015c05092adccddcd0e8e4a4319128c8369937ddfecd3f166bbecdc88acb1230b881

Download Submit
C:\Config.Msi\6d110b.rbs

Filesize
29KB

MD5
d35fa2a0b0d5ddf6a06d8dfc52afea19

SHA1
f142c08cb7fac09cdd83fb5645f5efad2bb985a9

SHA256
7d403c01f2be04c5d85e1e48f79e85127f9fb88d1d3f910592a326b0887f8491

SHA512
ddebb91a9a619113726a6f19d62bb981d7f4ec0c677c3697b49b3ab7f69c094094d2ed86f13f7d4b62b90e85ba85122f045b0893ca813b9f85159e0746e5dc3d

Download Submit
C:\Config.Msi\6d110e.rbs

Filesize
4KB

MD5
acddd81e08921fd0f8fc62f6c102b166

SHA1
e4fa3ca973ec3322ca5c6a58cec0b8fbefd5dbe8

SHA256
0ae5a6a63d7eb9f39284d8a16b09765103c4ddf86cbd6e44cc91f38eed1f79e7

SHA512
42923b94d50541564788480ec11dd7f555ef6a504d0a824b4322cf0f5b40d2171f83f6cd8dc30c1fd6d604d8e84794d769ba569836df3e689b971c27dc162a7c

Download Submit
C:\Config.Msi\6d1112.rbs

Filesize
29KB

MD5
3f7007a0cfbfcc0c254e5a8b4e27d178

SHA1
bd1b592e616bf018ab326a40465334deb14b67b2

SHA256
61099a1bbd8255565e946288633ea4d7c84f822d08b8e19ad1e3e881c3722eba

SHA512
85b76b31fd12f7cda8298ae5384db23728ebcc1e51a99cbf5cc9121d8e09149f361daa6213565d887c2961d8aa8d4f0e198623510b9af3bbbaddc58efd87652c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3622b9370023b491bb7d31f45e48eb54

SHA1
d7680faac06a94da02c8061af171e3658ed3787f

SHA256
9bd518e4c8082c714475e31e3d8897f3b7152bf515b163f04c81b93acd454b6d

SHA512
e0c69d9cde2474fea78c49012423583ba5ff4712a69f7a6633aaed4f73fd03c2e06be2f1a3045354b330e514572d925740d89ca541cb060d5fd30cb0da928132

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
3b4ff196db65c963327dcc2ad14e250e

SHA1
bf06ed2b63b21f543d78d5b4c8725e988b66d395

SHA256
b560c5c1f51c5e23ca9934e92e2b467273297cf69c021aadb687b4448a798571

SHA512
b60816518a11e8b52e0778cb4c084cf704bb30f98343b3d337dd3e772bf1f05a2fd1010bd97ef83a2e70c97f9f612be30c2528554dc1bfdf0fe4010929179544

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1160.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\HFI1586.tmp.html

Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE

Filesize
2.6MB

MD5
c5c698758bd9da02cc2ef94dcf1b4637

SHA1
1d6773537b0baba779090c7fa29be43d2130c3dd

SHA256
e1df4fda1f4f6a5d9faa94cc53e77458a53c56a87df4f1062708095150c86dbf

SHA512
c238860204de3933c7c41ba5f621f957d602286fa3a19a1bf4b6b272d8b417a20f5351ccf6ae5b46dde6ae938c7158e0f11d610e7a76a3530ba6825a96c9196b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE

Filesize
2.6MB

MD5
c5c698758bd9da02cc2ef94dcf1b4637

SHA1
1d6773537b0baba779090c7fa29be43d2130c3dd

SHA256
e1df4fda1f4f6a5d9faa94cc53e77458a53c56a87df4f1062708095150c86dbf

SHA512
c238860204de3933c7c41ba5f621f957d602286fa3a19a1bf4b6b272d8b417a20f5351ccf6ae5b46dde6ae938c7158e0f11d610e7a76a3530ba6825a96c9196b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab

Filesize
247KB

MD5
d5dd8a90812067e0ccb23a7299f82562

SHA1
5787391891cef8295666bce637d10e992d021d81

SHA256
71a4560b0eb5e45c385ce3aef154d97fa944b762f9aff3b3b9364d42bd1d5afd

SHA512
d38d3bcb8a640538a3a1b4052727d8d291d8d17218ba1abcaab1dca615bd83d3317a4bed89e495fadfbe6d20791562e5a8032284ae1cfeadc0020337ea0fe673

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi

Filesize
2.6MB

MD5
f194e681c552647c95441877b5552415

SHA1
285c6b1dbbc2d1525c9b1c276a4901b98d49b202

SHA256
6d4f42d5856384c2566ed79bdc587993208013640b035b04540de9f05ee597d6

SHA512
8ed21ce7829a1cb6c2dd4eff2e3701171aeba5b7e4337eaf0ddff86ea3fda812198a2e3fb4f1873b129944bdc8ddb09ebbd78e5c2b9811900cb853ef2afdab8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\vcredis1.cab

Filesize
312KB

MD5
0aa0da68a91e9133715d9cde2a180ffb

SHA1
892e941bed49b3404dad2aa33cd36b708e1443a9

SHA256
64570910e03c337d4e1f8ab1b9fb8e4dc46fdccb93857a1e9c73b296c6850fe0

SHA512
247dc48b39844fcfbfd46ef8eb1c72375b183f2d54361f5fe857d3a1b7275145cd0a9be8f287e037b46912a496a39a8855c20a63a8c663b60fc620b0b35e2313

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\vcredist.msi

Filesize
3.0MB

MD5
391dddd564a9e8a20576fe05e5e1f25b

SHA1
84f17830075abea6e6a369dee6b93ac16a71f025

SHA256
a9a8dac04e3b38c2f8d33ee7cf6d658fa4ea089bbf9f4014eb61b9d5de7dc6a2

SHA512
10358d52620178296c9033b257db960d3bf9b1219fa5b6f02f1173234686930616da708c5ac051b0c0c8892b3b66164093fc64698de43e56cf3b6f1d875e418f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A99.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\VWLFC0C.tmp

Filesize
392B

MD5
e22a069c76f4c8899b40fc0e75508ae5

SHA1
49ebd13606f0f27efa4f619169f4428bbefd763d

SHA256
1f885351ac3a2eaaffa6dd2373c75d0615510fdfa913327913c911141083cd6c

SHA512
93dd35015307a780847b4acc1d7e22d446d257e6b806ec9f0c5887371a8564f2af099d932939061d0587861d787ace2bb441185ad6d3ac8641a6ca492ead25f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI005E.txt

Filesize
2KB

MD5
5ddc31b1a2ac1a539bf6b5c5c61ec4bb

SHA1
38ab08145a557f85e35249557383c9046af177f9

SHA256
1df097e2aaacc544236c2a22c0f70fba0dbdc6de7888790f3b7b750d80c76048

SHA512
572dc78ca7b1264fc9e5f6b9fd50dd66d94e88c3e95adc4c02715669bde70230db89a095549c9251b611e0b7bdda9bb198e51b71cf0ee02e9b19c4981a21a66a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI006E.txt

Filesize
2KB

MD5
6bb634efca48e8eae68282a53058e6f1

SHA1
616dc3ca0797e8d5419cd9d9b75b46ff8089868a

SHA256
776457a79ff7621f27e3fada3f0b54568c0b9bb2ca3754bb3cac7b8e154c46b4

SHA512
07fdb8c2df7bf4d0ba624cefc200e83c0227356d03817f6adb2c87b0a68c2e7a3ec0433e26fa4454d1f557a28026134c2b2f3ca664dccc1d36c069bd725110a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Installer\6d10f7.msi

Filesize
2.6MB

MD5
f194e681c552647c95441877b5552415

SHA1
285c6b1dbbc2d1525c9b1c276a4901b98d49b202

SHA256
6d4f42d5856384c2566ed79bdc587993208013640b035b04540de9f05ee597d6

SHA512
8ed21ce7829a1cb6c2dd4eff2e3701171aeba5b7e4337eaf0ddff86ea3fda812198a2e3fb4f1873b129944bdc8ddb09ebbd78e5c2b9811900cb853ef2afdab8c

Download Submit
C:\Windows\Installer\6d10f8.msi

Filesize
3.0MB

MD5
391dddd564a9e8a20576fe05e5e1f25b

SHA1
84f17830075abea6e6a369dee6b93ac16a71f025

SHA256
a9a8dac04e3b38c2f8d33ee7cf6d658fa4ea089bbf9f4014eb61b9d5de7dc6a2

SHA512
10358d52620178296c9033b257db960d3bf9b1219fa5b6f02f1173234686930616da708c5ac051b0c0c8892b3b66164093fc64698de43e56cf3b6f1d875e418f

Download Submit
C:\Windows\Installer\MSI1642.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSIA8C4.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\b450131cdbf1813126cc5412ba\install.exe

Filesize
834KB

MD5
f0995d5ebde916fa146f51d324cf410c

SHA1
6a03e96a663051683b82601b5c7be72d72ecdb1c

SHA256
f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b

SHA512
8a2ca604c06077a1c5a7ac9782ff6815a4ea1b152502707120cf5a8edddcda7c8d1a71e16c80305a3fa098acb6ecf158c770e6d0a9cb2e57a9d875fb935664b8

Download Submit
C:\b450131cdbf1813126cc5412ba\install.exe

Filesize
834KB

MD5
f0995d5ebde916fa146f51d324cf410c

SHA1
6a03e96a663051683b82601b5c7be72d72ecdb1c

SHA256
f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b

SHA512
8a2ca604c06077a1c5a7ac9782ff6815a4ea1b152502707120cf5a8edddcda7c8d1a71e16c80305a3fa098acb6ecf158c770e6d0a9cb2e57a9d875fb935664b8

Download Submit
C:\fc82f6aebf4aee972fe0529ecd\Setup.exe

Filesize
76KB

MD5
2af2c1a78542975b12282aca4300d515

SHA1
3216c853ed82e41dfbeb6ca48855fdcd41478507

SHA256
531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7

SHA512
4a70bd4b542f6001e46f827f341676c34af1ea216c50ad981dd04f547cd67f73aaa420fcbed379dc05dab199bf5ba00d899c49ff75da577613209f96226227eb

Download Submit
\4957c5217020694f1ae9\install.exe

Filesize
547KB

MD5
4138c31964fbcb3b7418e086933324c3

SHA1
97cc6f58fb064ab6c4a2f02fb665fef77d30532f

SHA256
b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29

SHA512
40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557

Download Submit
\4957c5217020694f1ae9\install.res.1033.dll

Filesize
85KB

MD5
ff6003014eefc9c30abe20e3e1f5fbe8

SHA1
4a5bd05f94545f01efc10232385b8fecad300678

SHA256
a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067

SHA512
3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2

Download Submit
\68016451cdcf5083a1\Setup.exe

Filesize
76KB

MD5
2af2c1a78542975b12282aca4300d515

SHA1
3216c853ed82e41dfbeb6ca48855fdcd41478507

SHA256
531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7

SHA512
4a70bd4b542f6001e46f827f341676c34af1ea216c50ad981dd04f547cd67f73aaa420fcbed379dc05dab199bf5ba00d899c49ff75da577613209f96226227eb

Download Submit
\68016451cdcf5083a1\SetupEngine.dll

Filesize
789KB

MD5
63e7901d4fa7ac7766076720272060d0

SHA1
72dec0e4e12255d98ccd49937923c7b5590bbfac

SHA256
a5116ccb17b242713e5645c2374abf5827c0d2752b31553e3540c9123812e952

SHA512
de2e63bc090121484191cbf23194361d761b01c0fd332f35f0dfdfd0b11431b529e5c7f542031a0e7e26f31497d94b8baacfbf1c84c6493e66ac2ab76c11d0a0

Download Submit
\68016451cdcf5083a1\sqmapi.dll

Filesize
141KB

MD5
3f0363b40376047eff6a9b97d633b750

SHA1
4eaf6650eca5ce931ee771181b04263c536a948b

SHA256
bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c

SHA512
537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\4957c5217020694f1ae9\globdata.ini

Filesize
1KB

MD5
0a6b586fabd072bd7382b5e24194eac7

SHA1
60e3c7215c1a40fbfb3016d52c2de44592f8ca95

SHA256
7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

SHA512
b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

Download Submit
\??\c:\4957c5217020694f1ae9\install.ini

Filesize
841B

MD5
f8f6c0e030cb622f065fe47d61da91d7

SHA1
cf6fa99747de8f35c6aea52df234c9c57583baa3

SHA256
c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d

SHA512
b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde

Download Submit
\??\c:\4957c5217020694f1ae9\install.res.1033.dll

Filesize
85KB

MD5
ff6003014eefc9c30abe20e3e1f5fbe8

SHA1
4a5bd05f94545f01efc10232385b8fecad300678

SHA256
a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067

SHA512
3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2

Download Submit
\??\c:\4957c5217020694f1ae9\vc_red.cab

Filesize
3.7MB

MD5
0ee84ab717bc400c5e96c8d9d329fbb0

SHA1
be4ba7bbb068c7256b70f4fd7634eaeb2ad04d0a

SHA256
461d575bc1a07f64c14f1da885d2f310bd282cbbedcd0a5cf8ffa7057411805d

SHA512
4a6b0619f471a51df09fb6c1eff4ed166cdb7ef57f79ffdf709fa952a7c2a176c338084689c8ace1a94024a24579e9ee0ab6d411c25a1b42b0f517c57749d1a2

Download Submit
\??\c:\4957c5217020694f1ae9\vc_red.msi

Filesize
222KB

MD5
7e641e6a0b456271745c20c3bb8a18f9

SHA1
ae6cedcb81dc443611a310140ae4671789dbbf3a

SHA256
34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d

SHA512
f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903

Download Submit
\??\c:\68016451cdcf5083a1\1028\LocalizedData.xml

Filesize
29KB

MD5
7fc06a77d9aafca9fb19fafa0f919100

SHA1
e565740e7d582cd73f8d3b12de2f4579ff18bb41

SHA256
a27f809211ea1a2d5224cd01101aa3a59bf7853168e45de28a16ef7ed6acd46a

SHA512
466dcc6a5fb015be1619f5725fa62ca46eb0fb428e11f93fd9d82e5df61c3950b3fb62d4db7746cc4a2be199e5e69eaa30b6f3354e0017cfa14d127fad52f8cf

Download Submit
\??\c:\68016451cdcf5083a1\1033\LocalizedData.xml

Filesize
38KB

MD5
d642e322d1e8b739510ca540f8e779f9

SHA1
36279c76d9f34c09ebddc84fd33fcc7d4b9a896c

SHA256
5d90345ff74e177f6da8fb6459c1cfcac080e698215ca75feb130d0d1f2a76b9

SHA512
e1e16ae14bc7cc1608e1a08d3c92b6d0518b5fabd27f2c0eb514c87afc3d6192bf7a793a583afc65f1899f03dc419263b29174456e1ec9ab0f0110e0258e0f0d

Download Submit
\??\c:\68016451cdcf5083a1\DHTMLHeader.html

Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
\??\c:\68016451cdcf5083a1\ParameterInfo.xml

Filesize
21KB

MD5
13f8768c289476fdd103ff689d73cd2d

SHA1
ddebcecc02c6b1b996423d62d0def8760f031f58

SHA256
4eae293ca91b31aaa206e5a1c655714f0fe84e39f9331cb759d2236cdb915523

SHA512
c72998f30ebff8f4a757248639cf0351d03f5502be475b4cb8f02b09ad800dbbe2f9a82c7d9bde6d7bd748e0ee6e61b86e369192773fe726421a564e793a0139

Download Submit
\??\c:\68016451cdcf5083a1\Setup.exe

Filesize
76KB

MD5
2af2c1a78542975b12282aca4300d515

SHA1
3216c853ed82e41dfbeb6ca48855fdcd41478507

SHA256
531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7

SHA512
4a70bd4b542f6001e46f827f341676c34af1ea216c50ad981dd04f547cd67f73aaa420fcbed379dc05dab199bf5ba00d899c49ff75da577613209f96226227eb

Download Submit
\??\c:\68016451cdcf5083a1\SetupEngine.dll

Filesize
789KB

MD5
63e7901d4fa7ac7766076720272060d0

SHA1
72dec0e4e12255d98ccd49937923c7b5590bbfac

SHA256
a5116ccb17b242713e5645c2374abf5827c0d2752b31553e3540c9123812e952

SHA512
de2e63bc090121484191cbf23194361d761b01c0fd332f35f0dfdfd0b11431b529e5c7f542031a0e7e26f31497d94b8baacfbf1c84c6493e66ac2ab76c11d0a0

Download Submit
\??\c:\68016451cdcf5083a1\UiInfo.xml

Filesize
35KB

MD5
4f90fcef3836f5fc49426ad9938a1c60

SHA1
89eba3b81982d5d5c457ffa7a7096284a10de64a

SHA256
66a0299ce7ee12dd9fc2cfead3c3211e59bfb54d6c0627d044d44cef6e70367b

SHA512
4ce2731c1d32d7ca3a4f644f4b3111f06223de96c1e241fcc86f5fe665f4db18c8a241dae4e8a7e278d6afbf91b235a2c3517a40d4d22d9866880e19a7221160

Download Submit
\??\c:\68016451cdcf5083a1\sqmapi.dll

Filesize
141KB

MD5
3f0363b40376047eff6a9b97d633b750

SHA1
4eaf6650eca5ce931ee771181b04263c536a948b

SHA256
bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c

SHA512
537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8

Download Submit
\??\c:\b450131cdbf1813126cc5412ba\globdata.ini

Filesize
1KB

MD5
0a6b586fabd072bd7382b5e24194eac7

SHA1
60e3c7215c1a40fbfb3016d52c2de44592f8ca95

SHA256
7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

SHA512
b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

Download Submit
\??\c:\b450131cdbf1813126cc5412ba\install.ini

Filesize
841B

MD5
f8f6c0e030cb622f065fe47d61da91d7

SHA1
cf6fa99747de8f35c6aea52df234c9c57583baa3

SHA256
c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d

SHA512
b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde

Download Submit
\??\c:\b450131cdbf1813126cc5412ba\install.res.1033.dll

Filesize
84KB

MD5
e8ed5b7797472df6f5e1dae87c123e5e

SHA1
71e203899c3faf5e9eb5543bfd0eb748b78da566

SHA256
6ad479dd35201c74092068cccd6d12fd84a45d2c04e927b39901a9126f9e06dd

SHA512
dfdd6bba404753f6afbc804551550bdc771eccc034c01f4c5149beb6d98424cf7b86fc63aac361a1840df9bc8365c726baab672055534620db70ca2c0e2e1b3e

Download Submit
\??\c:\b450131cdbf1813126cc5412ba\vc_red.cab

Filesize
4.3MB

MD5
5cad07d592a2a43905d6b656b79a7abd

SHA1
9168413a66fe4e41ddd506a68e7f5e5feebf9d6b

SHA256
9f218cefe505a28a589b10f4e7c28ac479eca159e438012a9666e6f709bcf82f

SHA512
546065881b32421ba36076dd6848d98e444d89def7a4bfd3d7299d6de6f6f746a2abea2a00e24b02ba5ba2bde816a70529eb8ca48972ccc2d03f3ccb12df4261

Download Submit
\??\c:\b450131cdbf1813126cc5412ba\vc_red.msi

Filesize
230KB

MD5
4aa5bbddbf6b2d1cf509c566312f1203

SHA1
0557e25cf4c2aa1bcb170707cd282ae864d93d17

SHA256
017e62a7a046acf00f5565e60f8eed4c5f409913e7ddc2f431d4236bbfdabab8

SHA512
e32fad32aefb70592eec56c55eaf65d6a6ed33939a6cabe7ff0ec33f91c4687001a41575ccfcac448c4739b2af4e309c2ec9e526104fb292d04aa8746dfad8f9

Download Submit
\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll

Filesize
835KB

MD5
b370bef39a3665a33bd82b614ffbf361

SHA1
ac4608231fce95c4036dc04e1b0cf56ae813df03

SHA256
a9f818f65074355e9376f9519b6846333b395d9b2d884d8d15f8d2f4991b860a

SHA512
66ebf1275d86c07f5c86244b10187453ef40a550d74b9eb24ac3fbf51419786b87fdefe84812d85dc269cb49377e1b51732b697ae089cfbf35123ea90932fdb8

Download Submit
\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll

Filesize
835KB

MD5
b370bef39a3665a33bd82b614ffbf361

SHA1
ac4608231fce95c4036dc04e1b0cf56ae813df03

SHA256
a9f818f65074355e9376f9519b6846333b395d9b2d884d8d15f8d2f4991b860a

SHA512
66ebf1275d86c07f5c86244b10187453ef40a550d74b9eb24ac3fbf51419786b87fdefe84812d85dc269cb49377e1b51732b697ae089cfbf35123ea90932fdb8

Download Submit
\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll

Filesize
835KB

MD5
b370bef39a3665a33bd82b614ffbf361

SHA1
ac4608231fce95c4036dc04e1b0cf56ae813df03

SHA256
a9f818f65074355e9376f9519b6846333b395d9b2d884d8d15f8d2f4991b860a

SHA512
66ebf1275d86c07f5c86244b10187453ef40a550d74b9eb24ac3fbf51419786b87fdefe84812d85dc269cb49377e1b51732b697ae089cfbf35123ea90932fdb8

Download Submit
\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll

Filesize
835KB

MD5
b370bef39a3665a33bd82b614ffbf361

SHA1
ac4608231fce95c4036dc04e1b0cf56ae813df03

SHA256
a9f818f65074355e9376f9519b6846333b395d9b2d884d8d15f8d2f4991b860a

SHA512
66ebf1275d86c07f5c86244b10187453ef40a550d74b9eb24ac3fbf51419786b87fdefe84812d85dc269cb49377e1b51732b697ae089cfbf35123ea90932fdb8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE

Filesize
2.6MB

MD5
c5c698758bd9da02cc2ef94dcf1b4637

SHA1
1d6773537b0baba779090c7fa29be43d2130c3dd

SHA256
e1df4fda1f4f6a5d9faa94cc53e77458a53c56a87df4f1062708095150c86dbf

SHA512
c238860204de3933c7c41ba5f621f957d602286fa3a19a1bf4b6b272d8b417a20f5351ccf6ae5b46dde6ae938c7158e0f11d610e7a76a3530ba6825a96c9196b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE

Filesize
2.6MB

MD5
c5c698758bd9da02cc2ef94dcf1b4637

SHA1
1d6773537b0baba779090c7fa29be43d2130c3dd

SHA256
e1df4fda1f4f6a5d9faa94cc53e77458a53c56a87df4f1062708095150c86dbf

SHA512
c238860204de3933c7c41ba5f621f957d602286fa3a19a1bf4b6b272d8b417a20f5351ccf6ae5b46dde6ae938c7158e0f11d610e7a76a3530ba6825a96c9196b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE

Filesize
2.6MB

MD5
c5c698758bd9da02cc2ef94dcf1b4637

SHA1
1d6773537b0baba779090c7fa29be43d2130c3dd

SHA256
e1df4fda1f4f6a5d9faa94cc53e77458a53c56a87df4f1062708095150c86dbf

SHA512
c238860204de3933c7c41ba5f621f957d602286fa3a19a1bf4b6b272d8b417a20f5351ccf6ae5b46dde6ae938c7158e0f11d610e7a76a3530ba6825a96c9196b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE

Filesize
2.6MB

MD5
c5c698758bd9da02cc2ef94dcf1b4637

SHA1
1d6773537b0baba779090c7fa29be43d2130c3dd

SHA256
e1df4fda1f4f6a5d9faa94cc53e77458a53c56a87df4f1062708095150c86dbf

SHA512
c238860204de3933c7c41ba5f621f957d602286fa3a19a1bf4b6b272d8b417a20f5351ccf6ae5b46dde6ae938c7158e0f11d610e7a76a3530ba6825a96c9196b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
\Windows\Installer\MSI1642.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
\Windows\Installer\MSIA8C4.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
\b450131cdbf1813126cc5412ba\install.exe

Filesize
834KB

MD5
f0995d5ebde916fa146f51d324cf410c

SHA1
6a03e96a663051683b82601b5c7be72d72ecdb1c

SHA256
f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b

SHA512
8a2ca604c06077a1c5a7ac9782ff6815a4ea1b152502707120cf5a8edddcda7c8d1a71e16c80305a3fa098acb6ecf158c770e6d0a9cb2e57a9d875fb935664b8

Download Submit
\b450131cdbf1813126cc5412ba\install.exe

Filesize
834KB

MD5
f0995d5ebde916fa146f51d324cf410c

SHA1
6a03e96a663051683b82601b5c7be72d72ecdb1c

SHA256
f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b

SHA512
8a2ca604c06077a1c5a7ac9782ff6815a4ea1b152502707120cf5a8edddcda7c8d1a71e16c80305a3fa098acb6ecf158c770e6d0a9cb2e57a9d875fb935664b8

Download Submit
\b450131cdbf1813126cc5412ba\install.exe

Filesize
834KB

MD5
f0995d5ebde916fa146f51d324cf410c

SHA1
6a03e96a663051683b82601b5c7be72d72ecdb1c

SHA256
f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b

SHA512
8a2ca604c06077a1c5a7ac9782ff6815a4ea1b152502707120cf5a8edddcda7c8d1a71e16c80305a3fa098acb6ecf158c770e6d0a9cb2e57a9d875fb935664b8

Download Submit
\b450131cdbf1813126cc5412ba\install.exe

Filesize
834KB

MD5
f0995d5ebde916fa146f51d324cf410c

SHA1
6a03e96a663051683b82601b5c7be72d72ecdb1c

SHA256
f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b

SHA512
8a2ca604c06077a1c5a7ac9782ff6815a4ea1b152502707120cf5a8edddcda7c8d1a71e16c80305a3fa098acb6ecf158c770e6d0a9cb2e57a9d875fb935664b8

Download Submit
\b450131cdbf1813126cc5412ba\install.exe

Filesize
834KB

MD5
f0995d5ebde916fa146f51d324cf410c

SHA1
6a03e96a663051683b82601b5c7be72d72ecdb1c

SHA256
f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b

SHA512
8a2ca604c06077a1c5a7ac9782ff6815a4ea1b152502707120cf5a8edddcda7c8d1a71e16c80305a3fa098acb6ecf158c770e6d0a9cb2e57a9d875fb935664b8

Download Submit
\b450131cdbf1813126cc5412ba\install.res.1033.dll

Filesize
84KB

MD5
e8ed5b7797472df6f5e1dae87c123e5e

SHA1
71e203899c3faf5e9eb5543bfd0eb748b78da566

SHA256
6ad479dd35201c74092068cccd6d12fd84a45d2c04e927b39901a9126f9e06dd

SHA512
dfdd6bba404753f6afbc804551550bdc771eccc034c01f4c5149beb6d98424cf7b86fc63aac361a1840df9bc8365c726baab672055534620db70ca2c0e2e1b3e

Download Submit
memory/1340-762-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1852-624-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download