ffb7484dbd43f1a8de746604b64da32f8f408b8c76429cb8d36c0fe6c31d6438

Analysis

max time kernel
134s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-02-2024 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dependencies/install_all.bat
Size

1KB
MD5

1181cfea0692f5646210553284360554
SHA1

996b6be083a6ccd5a14861c965752d0576ed5a24
SHA256

ac1e6184909616e988ac48583649d254883a35a8715811e491988f4f84796d84
SHA512

e6abb56c800a9aea5e801e9abde54beaab7784a4ee43f624e4b3a4218d461c4b1359ed5c4fa2d89373d7f9d5a238ac1ac17f6a799554548d2223d90526b82c28

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

install.exeinstall.exeSetup.exeSetup.exe

pid process

620 install.exe
2544 install.exe
2676 Setup.exe
2768 Setup.exe

pid	process
620	install.exe
2544	install.exe
2676	Setup.exe
2768	Setup.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exemsiexec.exe

pid	process
940	MsiExec.exe
2728	MsiExec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vcredist2005_x86.exevcredist2005_x64.exevcredist2012_x86.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	vcredist2005_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	vcredist2005_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} = "\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_x86_20240218020903.log\" /passive /norestart ignored /burn.runonce"	vcredist2012_x86.exe

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

5 1836 msiexec.exe

flow	pid	process
5	1836	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in System32 directory 36 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\atl100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\atl100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe

Drops file in Program Files directory 6 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exeDrvInst.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\WinSxS\InstallTemp\20240218020833871.0\8.0.50727.6195.policy	msiexec.exe
File created	C:\Windows\Installer\f773925.msi	msiexec.exe
File created	C:\Windows\Installer\f77391a.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020752562.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020753888.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\f77391d.ipi	msiexec.exe
File created	C:\Windows\Installer\f773920.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020833761.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240218020833839.0	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\f773932.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020753170.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020754013.0\8.0.50727.6195.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020833371.0\mfc80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020833371.0\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020752921.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020753170.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020754122.0\8.0.50727.6195.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240218020754122.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240218020833964.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI75A6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3FC0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5AFF.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020752921.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020753623.0\mfc80KOR.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240218020754013.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020753623.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020833543.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020833761.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020833871.0\8.0.50727.6195.cat	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020753170.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020753623.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020754106.0\8.0.50727.6195.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020833371.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020833543.0\mfc80ESP.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F4E.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020833543.0\mfc80FRA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020753997.0\8.0.50727.6195.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240218020752562.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240218020754106.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020833106.0\msvcp80.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240218020833761.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240218020834011.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020754075.0\8.0.50727.6195.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020833028.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020833106.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240218020833902.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020752921.0\msvcp80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020753623.0\mfc80FRA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020754122.0\8.0.50727.6195.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240218020753997.0	msiexec.exe
File opened for modification	C:\Windows\Installer\f773937.ipi	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\f77393b.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020753170.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020833371.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020833964.0\8.0.50727.6195.cat	msiexec.exe
File created	\??\c:\Windows\Installer\f773928.ipi	msiexec.exe
File created	C:\Windows\Installer\f77393d.msp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ul_ATL80.dll.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020752921.0\msvcr80.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\f773934.msp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\WinSxS\InstallTemp\20240218020753888.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.cat	msiexec.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1640 1624 WerFault.exe vcredist2012_x86.exe

pid	pid_target	process	target process
1640	1624	WerFault.exe	vcredist2012_x86.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exeSetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exeDrvInst.exeDrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\PackageCode = "C558A51006735C645AEE5A0FC6A310C9"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e006f006f0063007b006200340036003f004500380042006a005f0079005d005d007e004f006f002c0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f00410054004c005f007800360034003e0049005b00280055004d0049005b007600260036006a006d005f004f0071005400570060004100370000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e004e002e004b004300300068004d0064007b00340060006d002b00380039004f002e002e003100540000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\KB2565063 = "Servicing_Key"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\KB2544655 = "Servicing_Key"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\FT_VC_Redist_MFCLOC_x64 = "VC_Redist_12222_amd64_enu"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Version = "167812379"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\FT_VCRedist_x64_KB2565063_Detection	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\ProductName = "Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_MFC_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\LastUsedSource = "n;2;f:\\d7d94c39aa2a99ae76ea2087be690236\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\VC_Redist	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\KB2549743 = "Servicing_Key"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e00690060003700480050004400240062002400350035007e004a007b00730074007e0029006200780000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList\Net\2 = "f:\\f03f137b46232420d7\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\VC_RED_enu_x86_net_SETUP	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\FT_VC_Redist_MFC_x64 = "VC_Redist_12222_amd64_enu"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_MFCLOC_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\KB2565063 = "Servicing_Key"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\Patches	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\VCRedist_amd64_enu	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e004b00520050005200400047006b006e005d0033003d002b004c00380047003600210061002e00490000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\Patches\4D54076CED4F5BA32BBD3E5FAD1CD4C9 = ":SP1.1;:#SP1.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\VC_RED_enu_amd64_net_SETUP	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\4D54076CED4F5BA32BBD3E5FAD1CD4C9\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\KB2524860 = "Servicing_Key"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\Servicing_Key	msiexec.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 7 IoCs

Processes:

vcredist2005_x86.exevcredist2005_x64.exevcredist2008_x86.exevcredist2008_x64.exevcredist2010_x86.exevcredist2010_x64.exevcredist2012_x86.exe

pid	process
2448	vcredist2005_x86.exe
1472	vcredist2005_x64.exe
2252	vcredist2008_x86.exe
2720	vcredist2008_x64.exe
1112	vcredist2010_x86.exe
1176	vcredist2010_x64.exe
1632	vcredist2012_x86.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

msiexec.exeSetup.exeSetup.exe

pid	process
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2676	Setup.exe
2676	Setup.exe
2676	Setup.exe
2676	Setup.exe
2676	Setup.exe
2676	Setup.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2768	Setup.exe
2768	Setup.exe
2768	Setup.exe
2768	Setup.exe
2768	Setup.exe
2768	Setup.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe
2700	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	2432	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2700	msiexec.exe
Token: SeTakeOwnershipPrivilege	2700	msiexec.exe
Token: SeSecurityPrivilege	2700	msiexec.exe
Token: SeCreateTokenPrivilege	2432	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2432	msiexec.exe
Token: SeLockMemoryPrivilege	2432	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2432	msiexec.exe
Token: SeMachineAccountPrivilege	2432	msiexec.exe
Token: SeTcbPrivilege	2432	msiexec.exe
Token: SeSecurityPrivilege	2432	msiexec.exe
Token: SeTakeOwnershipPrivilege	2432	msiexec.exe
Token: SeLoadDriverPrivilege	2432	msiexec.exe
Token: SeSystemProfilePrivilege	2432	msiexec.exe
Token: SeSystemtimePrivilege	2432	msiexec.exe
Token: SeProfSingleProcessPrivilege	2432	msiexec.exe
Token: SeIncBasePriorityPrivilege	2432	msiexec.exe
Token: SeCreatePagefilePrivilege	2432	msiexec.exe
Token: SeCreatePermanentPrivilege	2432	msiexec.exe
Token: SeBackupPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeShutdownPrivilege	2432	msiexec.exe
Token: SeDebugPrivilege	2432	msiexec.exe
Token: SeAuditPrivilege	2432	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2432	msiexec.exe
Token: SeChangeNotifyPrivilege	2432	msiexec.exe
Token: SeRemoteShutdownPrivilege	2432	msiexec.exe
Token: SeUndockPrivilege	2432	msiexec.exe
Token: SeSyncAgentPrivilege	2432	msiexec.exe
Token: SeEnableDelegationPrivilege	2432	msiexec.exe
Token: SeManageVolumePrivilege	2432	msiexec.exe
Token: SeImpersonatePrivilege	2432	msiexec.exe
Token: SeCreateGlobalPrivilege	2432	msiexec.exe
Token: SeBackupPrivilege	2828	vssvc.exe
Token: SeRestorePrivilege	2828	vssvc.exe
Token: SeAuditPrivilege	2828	vssvc.exe
Token: SeBackupPrivilege	2700	msiexec.exe
Token: SeRestorePrivilege	2700	msiexec.exe
Token: SeRestorePrivilege	2912	DrvInst.exe
Token: SeRestorePrivilege	2912	DrvInst.exe
Token: SeRestorePrivilege	2912	DrvInst.exe
Token: SeRestorePrivilege	2912	DrvInst.exe
Token: SeRestorePrivilege	2912	DrvInst.exe
Token: SeRestorePrivilege	2912	DrvInst.exe
Token: SeRestorePrivilege	2912	DrvInst.exe
Token: SeLoadDriverPrivilege	2912	DrvInst.exe
Token: SeLoadDriverPrivilege	2912	DrvInst.exe
Token: SeLoadDriverPrivilege	2912	DrvInst.exe
Token: SeRestorePrivilege	2700	msiexec.exe
Token: SeTakeOwnershipPrivilege	2700	msiexec.exe
Token: SeRestorePrivilege	2700	msiexec.exe
Token: SeTakeOwnershipPrivilege	2700	msiexec.exe
Token: SeRestorePrivilege	2700	msiexec.exe
Token: SeTakeOwnershipPrivilege	2700	msiexec.exe
Token: SeRestorePrivilege	2700	msiexec.exe
Token: SeTakeOwnershipPrivilege	2700	msiexec.exe
Token: SeRestorePrivilege	2700	msiexec.exe
Token: SeTakeOwnershipPrivilege	2700	msiexec.exe
Token: SeRestorePrivilege	2700	msiexec.exe
Token: SeTakeOwnershipPrivilege	2700	msiexec.exe
Token: SeRestorePrivilege	2700	msiexec.exe
Token: SeTakeOwnershipPrivilege	2700	msiexec.exe
Token: SeRestorePrivilege	2700	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

msiexec.exemsiexec.exeinstall.exeinstall.exevcredist2012_x86.exe

pid	process
2432	msiexec.exe
2432	msiexec.exe
1836	msiexec.exe
1836	msiexec.exe
620	install.exe
620	install.exe
2544	install.exe
2544	install.exe
1624	vcredist2012_x86.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exevcredist2005_x86.exemsiexec.exevcredist2005_x64.exevcredist2008_x86.exevcredist2008_x64.exe

description	pid	process	target process
PID 2288 wrote to memory of 2448	2288	cmd.exe	vcredist2005_x86.exe
PID 2288 wrote to memory of 2448	2288	cmd.exe	vcredist2005_x86.exe
PID 2288 wrote to memory of 2448	2288	cmd.exe	vcredist2005_x86.exe
PID 2288 wrote to memory of 2448	2288	cmd.exe	vcredist2005_x86.exe
PID 2288 wrote to memory of 2448	2288	cmd.exe	vcredist2005_x86.exe
PID 2288 wrote to memory of 2448	2288	cmd.exe	vcredist2005_x86.exe
PID 2288 wrote to memory of 2448	2288	cmd.exe	vcredist2005_x86.exe
PID 2448 wrote to memory of 2432	2448	vcredist2005_x86.exe	msiexec.exe
PID 2448 wrote to memory of 2432	2448	vcredist2005_x86.exe	msiexec.exe
PID 2448 wrote to memory of 2432	2448	vcredist2005_x86.exe	msiexec.exe
PID 2448 wrote to memory of 2432	2448	vcredist2005_x86.exe	msiexec.exe
PID 2448 wrote to memory of 2432	2448	vcredist2005_x86.exe	msiexec.exe
PID 2448 wrote to memory of 2432	2448	vcredist2005_x86.exe	msiexec.exe
PID 2448 wrote to memory of 2432	2448	vcredist2005_x86.exe	msiexec.exe
PID 2700 wrote to memory of 940	2700	msiexec.exe	MsiExec.exe
PID 2700 wrote to memory of 940	2700	msiexec.exe	MsiExec.exe
PID 2700 wrote to memory of 940	2700	msiexec.exe	MsiExec.exe
PID 2700 wrote to memory of 940	2700	msiexec.exe	MsiExec.exe
PID 2700 wrote to memory of 940	2700	msiexec.exe	MsiExec.exe
PID 2700 wrote to memory of 940	2700	msiexec.exe	MsiExec.exe
PID 2700 wrote to memory of 940	2700	msiexec.exe	MsiExec.exe
PID 2288 wrote to memory of 1472	2288	cmd.exe	vcredist2005_x64.exe
PID 2288 wrote to memory of 1472	2288	cmd.exe	vcredist2005_x64.exe
PID 2288 wrote to memory of 1472	2288	cmd.exe	vcredist2005_x64.exe
PID 2288 wrote to memory of 1472	2288	cmd.exe	vcredist2005_x64.exe
PID 2288 wrote to memory of 1472	2288	cmd.exe	vcredist2005_x64.exe
PID 2288 wrote to memory of 1472	2288	cmd.exe	vcredist2005_x64.exe
PID 2288 wrote to memory of 1472	2288	cmd.exe	vcredist2005_x64.exe
PID 1472 wrote to memory of 1836	1472	vcredist2005_x64.exe	msiexec.exe
PID 1472 wrote to memory of 1836	1472	vcredist2005_x64.exe	msiexec.exe
PID 1472 wrote to memory of 1836	1472	vcredist2005_x64.exe	msiexec.exe
PID 1472 wrote to memory of 1836	1472	vcredist2005_x64.exe	msiexec.exe
PID 1472 wrote to memory of 1836	1472	vcredist2005_x64.exe	msiexec.exe
PID 1472 wrote to memory of 1836	1472	vcredist2005_x64.exe	msiexec.exe
PID 1472 wrote to memory of 1836	1472	vcredist2005_x64.exe	msiexec.exe
PID 2700 wrote to memory of 2728	2700	msiexec.exe	MsiExec.exe
PID 2700 wrote to memory of 2728	2700	msiexec.exe	MsiExec.exe
PID 2700 wrote to memory of 2728	2700	msiexec.exe	MsiExec.exe
PID 2700 wrote to memory of 2728	2700	msiexec.exe	MsiExec.exe
PID 2700 wrote to memory of 2728	2700	msiexec.exe	MsiExec.exe
PID 2700 wrote to memory of 2728	2700	msiexec.exe	MsiExec.exe
PID 2700 wrote to memory of 2728	2700	msiexec.exe	MsiExec.exe
PID 2288 wrote to memory of 2252	2288	cmd.exe	vcredist2008_x86.exe
PID 2288 wrote to memory of 2252	2288	cmd.exe	vcredist2008_x86.exe
PID 2288 wrote to memory of 2252	2288	cmd.exe	vcredist2008_x86.exe
PID 2288 wrote to memory of 2252	2288	cmd.exe	vcredist2008_x86.exe
PID 2288 wrote to memory of 2252	2288	cmd.exe	vcredist2008_x86.exe
PID 2288 wrote to memory of 2252	2288	cmd.exe	vcredist2008_x86.exe
PID 2288 wrote to memory of 2252	2288	cmd.exe	vcredist2008_x86.exe
PID 2252 wrote to memory of 620	2252	vcredist2008_x86.exe	install.exe
PID 2252 wrote to memory of 620	2252	vcredist2008_x86.exe	install.exe
PID 2252 wrote to memory of 620	2252	vcredist2008_x86.exe	install.exe
PID 2252 wrote to memory of 620	2252	vcredist2008_x86.exe	install.exe
PID 2252 wrote to memory of 620	2252	vcredist2008_x86.exe	install.exe
PID 2252 wrote to memory of 620	2252	vcredist2008_x86.exe	install.exe
PID 2252 wrote to memory of 620	2252	vcredist2008_x86.exe	install.exe
PID 2288 wrote to memory of 2720	2288	cmd.exe	vcredist2008_x64.exe
PID 2288 wrote to memory of 2720	2288	cmd.exe	vcredist2008_x64.exe
PID 2288 wrote to memory of 2720	2288	cmd.exe	vcredist2008_x64.exe
PID 2288 wrote to memory of 2720	2288	cmd.exe	vcredist2008_x64.exe
PID 2288 wrote to memory of 2720	2288	cmd.exe	vcredist2008_x64.exe
PID 2288 wrote to memory of 2720	2288	cmd.exe	vcredist2008_x64.exe
PID 2288 wrote to memory of 2720	2288	cmd.exe	vcredist2008_x64.exe
PID 2720 wrote to memory of 2544	2720	vcredist2008_x64.exe	install.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\dependencies\install_all.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288

C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2005_x86.exe
vcredist2005_x86.exe /q
2⤵
- Adds Run key to start application
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2448

C:\Windows\SysWOW64\msiexec.exe
msiexec /i vcredist.msi
3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2432

C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2005_x64.exe
vcredist2005_x64.exe /q
2⤵
- Adds Run key to start application
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\msiexec.exe
msiexec /i vcredist.msi
3⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:1836

C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2008_x86.exe
vcredist2008_x86.exe /qb
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2252

\??\f:\f6f9ab9c843da842997a73f6ed23f5\install.exe
f:\f6f9ab9c843da842997a73f6ed23f5\.\install.exe /qb
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:620

C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2008_x64.exe
vcredist2008_x64.exe /qb
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2720

\??\f:\932559b246c384865841110d\install.exe
f:\932559b246c384865841110d\.\install.exe /qb
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:2544

C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2010_x86.exe
vcredist2010_x86.exe /passive /norestart
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1112

\??\f:\d7d94c39aa2a99ae76ea2087be690236\Setup.exe
f:\d7d94c39aa2a99ae76ea2087be690236\Setup.exe /passive /norestart
3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2676

C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2010_x64.exe
vcredist2010_x64.exe /passive /norestart
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1176

\??\f:\f03f137b46232420d7\Setup.exe
f:\f03f137b46232420d7\Setup.exe /passive /norestart
3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2768

C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2012_x86.exe
vcredist2012_x86.exe /passive /norestart
2⤵
- Adds Run key to start application
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1632

C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2012_x86.exe
"C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2012_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{B4D868A6-21EF-4203-B59A-C79EFAE9981C} {DFA78499-82D7-41AF-8C64-AF04A023F1B1} 1632
3⤵
- Suspicious use of FindShellTrayWindow
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 348
4⤵
- Program crash
PID:1640

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 33DB3881E1C95F0E27AD9FB6A4DBE98E
2⤵
- Loads dropped DLL
PID:940

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding F0050F001857DDCB59BFC7C0A7DC7D24
2⤵
- Loads dropped DLL
PID:2728

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000594" "00000000000005C8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot20" "" "" "65dbac317" "0000000000000000" "0000000000000540" "0000000000000324"
1⤵
- Modifies data under HKEY_USERS
PID:2248

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot21" "" "" "6f9bf5bcb" "0000000000000000" "0000000000000550" "00000000000003AC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2512

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f773929.rbs
Filesize
29KB

MD5
e653bb30fed1328c9aecee8246813b55

SHA1
fd754ffe5571129182902582a145f632535796e0

SHA256
bd387c473da4d33eca73144bf26261dc305373ced1e278df6f19c3bf38f86cbb

SHA512
cc9c6e564d5cf0d85e676c2153043632ca98fdb0ca7ef85e5f5d05090f0f79bc6533dca541f88c7a6897b0eaa056385eec7fa5eb77a407add198a4795d880120

Download Submit
C:\Config.Msi\f77392e.rbs
Filesize
29KB

MD5
3394d0e4bab76441c1698ee9e12ffa82

SHA1
4026d33c00112e6ee56b3f172244352afb539259

SHA256
661a282217438f654939879272d887a194aa1eeba6672214fa7e3d50afd171f2

SHA512
fc2d00044293d5a4da9289729e308199468cf1e2526e97d936ee18fdf3a5203042e29e9a28b87a00f93e22be1ce77cd8ea33b19902410079b62cf59d26f839b3

Download Submit
C:\Config.Msi\f773933.rbs
Filesize
4KB

MD5
ff9f964b4016d5a5e93064b44f38673a

SHA1
24186fb8879f2500bfba1da22585ae6e33492a38

SHA256
a92c97f43515b6babb564805ecbaaf9d24b5761132fe382afe7812fb142031e5

SHA512
14b04e4531a7208092fe4f984da5b56b2da33d957282aa6e2abc72e034cc4980eb162142ea80b66f42d05c5b6607ffe58cc884a9c7328b61713668be3efac377

Download Submit
C:\Config.Msi\f773938.rbs
Filesize
29KB

MD5
b526ba2bd9f73f4a36f6e4f2df0025af

SHA1
481d02ae56fe0c739419785422c2b19aff93b5ab

SHA256
f367feaf8c1c51de9c97dc96a3424f3b36c5732925a4fc043eb7b445be515449

SHA512
e4167b468247cad11dc1f263b03a5c465d9100af905ec0d1fd993ff8db74067d733e91bdddc2ee1475401f7fef2cfc09c6c617372749dfee75f7bc61b9b37b4c

Download Submit
C:\Config.Msi\f77393c.rbs
Filesize
4KB

MD5
d915e441cdbf7e9c74775885ef3cd6c3

SHA1
d84f762b4a8458025f63908a598cdc3ff9410fa6

SHA256
18bd26b504e753a6c607a3298133f57419a276ad4974fdbd9e907726e37d472e

SHA512
cf30adc894cb98d07d58e78fe2e9453c67734878e6220998f9d55a2477bfda3806f697df97d10117bf0fd7cd27e47e685813d547662c5e63086ab8c113521f47

Download Submit
C:\Config.Msi\f773941.rbs
Filesize
28KB

MD5
7b042b33408211110fcfc05eafd6a942

SHA1
0849354962275e8f21fc2218550d9f2aa5393b47

SHA256
309c4e01e07734cb0571c70c2726c660a76c0cd2a7c37a363af193eaa2934f00

SHA512
3a26a68b15be5fe47988c335439abd31f2bfbcb94b1cca4568a44f4237c575ae929cdba6b48c15624b2842435c87a51e2c8c60d929b6f754393ce2cee6707b45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
358c414a7ccaf187b04241932a3e9699

SHA1
c5805baee7a057928ca15a79fd7a398f28c71509

SHA256
05ba683015d79d6a04995a1853df8e6a527327584948565b22d5fad4cdbfeadf

SHA512
88d15c7bfcdd1576d622a47cfcdda201fc31270b99ab74cd2e5e390b544b12d77354453ce28c0d382c28f8c5e59877dcdff7848833181befb32f42ea8f490e83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab39F4.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
Filesize
312KB

MD5
77a9bff5af149160775741e204734d47

SHA1
7b5126af69b5a79593f39db94180f1ff11b0e39d

SHA256
20a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038

SHA512
bb0440f58f07e113bddd9a0afb5aab8af6493218784fe5fa6f4032e3a37088f91b7e766dee87cec4a9ea11d425d27b3b536430de3a52222e8bca3e0247d81e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
Filesize
247KB

MD5
cc064d4b81619991de8131a86ad77681

SHA1
88d80d86cc20c27d7d2a872af719300bd2bb73f9

SHA256
913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477

SHA512
5aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
Filesize
2.0MB

MD5
2c2dbce2373092d16354a5a08d5a220b

SHA1
64a5b0df3c0633ab668b5771b14bc1904aaa359a

SHA256
a93477c0a9e5a5f60f63fdffe67cc90502fbd8d363157576640ed798cfb55b64

SHA512
653c4485648745ed6db080c67fec6fa086a25bd3d5e93a0200f3e025a63e0a29482cdeb24d507b6c5c5dcbac2adda43487685934483b74626f2298394ab42968

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
Filesize
2.6MB

MD5
b20bbeb818222b657df49a9cfe4fed79

SHA1
3f6508e880b86502773a3275bc9527f046d45502

SHA256
91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4

SHA512
f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup_20240218_020845524.html
Filesize
16KB

MD5
a9573684ac0fd602c12f3c2fcf579d68

SHA1
e2070ff9de4c5716e2e3793a726b8f439d235b2f

SHA256
b60d1d42309b15b597a2390a725ac73ffbce253fdac4bff60ba240ea5b636c1d

SHA512
1169050bb3a6a60f139a65baecb5f4c28076610f0ce4767bcfa5099f799a26dbcda9b7a2d51c01db725248a84db0eca5babd52ad21997a1ba741b8bbc0cfafd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8631.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\VWL22DC.tmp
Filesize
326B

MD5
f0a7f4daefafbf86c5fa4afd0f34d5a6

SHA1
3870ee11b04e6f14fc21eb4ae6845f7b3a544039

SHA256
1eb960ac6588c123b1d116e2ead36b19886000b115718d590a8ccacd5e5f3978

SHA512
0e83f0c1ac2ef1da16bd6cc068b8cbe402815f6ac2c8bd80f10872abd44908efda1220c4d40c207069067003ac4db9d103440f7f6e5b82f372da13adae4f7f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\VWL30FF.tmp
Filesize
392B

MD5
62a48e2aebee1e6963f1699b81d650ce

SHA1
64ea95ff0e5b154db52d3708eb3e3556419e3750

SHA256
4cb9ccfb2f635ed1c2b8a5da953c6f9380e3e6da989e71c759f2f89bfdb06f3e

SHA512
bbc0e2bc1b8aa30bcab022e1d7c77c16d57be8a6894e94995d3f1fe52aefb23882eb781130674c6eb3a98ee2f534c4f9bb76896612b4013686eabad01b7ead6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI21E8.txt
Filesize
2KB

MD5
de83cd3d82df85df6ed192e4ccc580c2

SHA1
a79a0d29f90ea70582c7981e2e1a6b0155b93901

SHA256
f1efbb5a5e04f993133bb5f4a87939902ecc6704ab99dfef6a313a1778fbf043

SHA512
77d4b6231e8244246855503d27d5ff5cf3e4b1a312b7e5034e05f8661976716d3d912bcd2ea4a177c38ac7234167dcc13dcb0c14be54855b76abe320d8488171

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI21F2.txt
Filesize
2KB

MD5
1c023de4518e87286e999503445858ea

SHA1
754813174b5070e3462e7904dc4a66dbb39a5f32

SHA256
cde7c6e60b33dc160c7a0827c061f2be90362407be65f73aa9654a26345cd0bc

SHA512
946e55bf17b70641b72e9a114076b0639f725a48b7345f0d39712d7bcb0c2e03de04ce8499d3aea45d94095caab726c90fc18011d4888dc54acba1d58f2f34e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Installer\MSI3FC0.tmp
Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\f77391f.msi
Filesize
1.8MB

MD5
d1bd15637741f76d533dcdb5de2b7e1c

SHA1
ec5d34b093ff76b0a8130bebf4baed739cee6a6d

SHA256
fca889f9da108038c18135786ae14e63506717c95268314dcf5e4a423b4e847f

SHA512
3ad58a35c90ca9119b6d81af1b25a3b106d8f25a58af8128a944783e4bab08a114cf7621f3fe9371f86697a2658fd1b855e86196c2f6a3de0d95dbecb8f5c85e

Download Submit
C:\Windows\Installer\f773920.msi
Filesize
3.0MB

MD5
6dbdf338a0a25cdb236d43ea3ca2395e

SHA1
685b6ea61e574e628392eaac8b10aff4309f1081

SHA256
200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb

SHA512
6b5b31c55cf72ab92b17fb6074b3901a1e6afe0796ef9bc831e4dfb97450376d2889cd24b1cf3fce60eb3c1bcd1b31254b5cfa3ef6107974dfa0b35c233daf5a

Download Submit
F:\932559b246c384865841110d\install.exe
Filesize
834KB

MD5
f0995d5ebde916fa146f51d324cf410c

SHA1
6a03e96a663051683b82601b5c7be72d72ecdb1c

SHA256
f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b

SHA512
8a2ca604c06077a1c5a7ac9782ff6815a4ea1b152502707120cf5a8edddcda7c8d1a71e16c80305a3fa098acb6ecf158c770e6d0a9cb2e57a9d875fb935664b8

Download Submit
F:\d7d94c39aa2a99ae76ea2087be690236\Setup.exe
Filesize
76KB

MD5
2af2c1a78542975b12282aca4300d515

SHA1
3216c853ed82e41dfbeb6ca48855fdcd41478507

SHA256
531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7

SHA512
4a70bd4b542f6001e46f827f341676c34af1ea216c50ad981dd04f547cd67f73aaa420fcbed379dc05dab199bf5ba00d899c49ff75da577613209f96226227eb

Download Submit
F:\f6f9ab9c843da842997a73f6ed23f5\install.exe
Filesize
547KB

MD5
4138c31964fbcb3b7418e086933324c3

SHA1
97cc6f58fb064ab6c4a2f02fb665fef77d30532f

SHA256
b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29

SHA512
40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557

Download Submit
\??\f:\932559b246c384865841110d\install.res.1033.dll
Filesize
84KB

MD5
e8ed5b7797472df6f5e1dae87c123e5e

SHA1
71e203899c3faf5e9eb5543bfd0eb748b78da566

SHA256
6ad479dd35201c74092068cccd6d12fd84a45d2c04e927b39901a9126f9e06dd

SHA512
dfdd6bba404753f6afbc804551550bdc771eccc034c01f4c5149beb6d98424cf7b86fc63aac361a1840df9bc8365c726baab672055534620db70ca2c0e2e1b3e

Download Submit
\??\f:\932559b246c384865841110d\vc_red.cab
Filesize
3.9MB

MD5
7e46915d2d9841626f038209b1b54159

SHA1
aa5ae8453153c8c295a67c16f875825a8c6c9fa5

SHA256
8de6eb409de0036db428b99d84c98e9885dddcd3f1a89a3d3655cf93a6b73085

SHA512
595a26e68e8bc232dca6fa61dd32f0c64680fd7ee226a0eaefebe915b254c77f2c761f75b510174550096a48e61128ab7b60e40ef29c7928145defe31332be51

Download Submit
\??\f:\932559b246c384865841110d\vc_red.msi
Filesize
230KB

MD5
4aa5bbddbf6b2d1cf509c566312f1203

SHA1
0557e25cf4c2aa1bcb170707cd282ae864d93d17

SHA256
017e62a7a046acf00f5565e60f8eed4c5f409913e7ddc2f431d4236bbfdabab8

SHA512
e32fad32aefb70592eec56c55eaf65d6a6ed33939a6cabe7ff0ec33f91c4687001a41575ccfcac448c4739b2af4e309c2ec9e526104fb292d04aa8746dfad8f9

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\1028\LocalizedData.xml
Filesize
29KB

MD5
7fc06a77d9aafca9fb19fafa0f919100

SHA1
e565740e7d582cd73f8d3b12de2f4579ff18bb41

SHA256
a27f809211ea1a2d5224cd01101aa3a59bf7853168e45de28a16ef7ed6acd46a

SHA512
466dcc6a5fb015be1619f5725fa62ca46eb0fb428e11f93fd9d82e5df61c3950b3fb62d4db7746cc4a2be199e5e69eaa30b6f3354e0017cfa14d127fad52f8cf

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\1031\LocalizedData.xml
Filesize
40KB

MD5
b83c3803712e61811c438f6e98790369

SHA1
61a0bc59388786ced045acd82621bee8578cae5a

SHA256
2aa6e8d402e44d9ee895b18195f46bf90259de1b6f44efd46a7075b110f2dcd6

SHA512
e020f93e3a082476087e690ad051f1feb210e0915924bb4548cc9f53a7ee2760211890eb6036ce9e5e4a311abc0300e89e25efbbb894c2a621ffbc9d64cc8a38

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\1033\LocalizedData.xml
Filesize
38KB

MD5
d642e322d1e8b739510ca540f8e779f9

SHA1
36279c76d9f34c09ebddc84fd33fcc7d4b9a896c

SHA256
5d90345ff74e177f6da8fb6459c1cfcac080e698215ca75feb130d0d1f2a76b9

SHA512
e1e16ae14bc7cc1608e1a08d3c92b6d0518b5fabd27f2c0eb514c87afc3d6192bf7a793a583afc65f1899f03dc419263b29174456e1ec9ab0f0110e0258e0f0d

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\1033\SetupResources.dll
Filesize
16KB

MD5
0b4e76baf52d580f657f91972196cd91

SHA1
e6ac8f80ab8ade18ac7e834ac6d0536bb483988c

SHA256
74a7767d8893dcc1a745522d5a509561162f95bc9e8bcc3056f37a367dba64a4

SHA512
ed53292c549d09da9118e944a646aa5dc0a6231811eafcda4258c892b218bcf3e0363a2c974868d2d2722155983c5dc8e29bed36d58e566e1695e23ce07fea87

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\1036\LocalizedData.xml
Filesize
40KB

MD5
e382abc19294f779d2833287242e7bc6

SHA1
1ceae32d6b24a3832f9244f5791382865b668a72

SHA256
43f913ff28d677316f560a0f45221f35f27cfaf5fc5bd645974a82dca589edbf

SHA512
06054c8048cade36a3af54f9a07fd8fa5eb4f3228790996d2abea7ee1ee7eb563d46bd54ff97441f9610e778194082c44e66c5f566c9c50a042aba9eb9cae25e

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\1040\LocalizedData.xml
Filesize
39KB

MD5
0af948fe4142e34092f9dd47a4b8c275

SHA1
b3d6dd5c126280398d9055f90e2c2c26dbae4eaa

SHA256
c4c7c0ddaa6d6a3a1dc260e9c5a24bdfaa98c427c69e8a65427dd7cac0a4b248

SHA512
d97b5fe2553ca78a3019d53e33d2db80c9fa1cf1d8d2501d9ddf0576c7e6ea38dab754fe4712123abf34b97e10b18fb4bbd1c76d3dacb87b4682e501f93423d9

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\1041\LocalizedData.xml
Filesize
33KB

MD5
7fcfbc308b0c42dcbd8365ba62bada05

SHA1
18a0f0e89b36818c94de0ad795cc593d0e3e29a9

SHA256
01e7d24dd8e00b5c333e96d1bb83813e02e96f89aad0c2f28f84551d28abbbe2

SHA512
cd6f912a037e86d9e1982c73f0f8b3c4d5a9a6b5b108a7b89a46e6691e430a7cb55718de9a0c05650bb194c8d4a2e309ad6221d638cfca8e16aa5920881ba649

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\1042\LocalizedData.xml
Filesize
32KB

MD5
71dfd70ae141f1d5c1366cb661b354b2

SHA1
c4b22590e6f6dd5d39e5158b831ae217ce17a776

SHA256
cccda55294aeb4af166a8c0449bca2189ddf5aa9a43d5e939dd3803e61738331

SHA512
5000d62f3de41c3fb0ed8a8e9c37dbf4eb427c4f1e3ad3823d4716c6fe62250bac11b7987a302b8a45d91aabcf332457f7aff7d99f15edeffe540639e9440e8a

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\1049\LocalizedData.xml
Filesize
39KB

MD5
0eeb554d0b9f9fcdb22401e2532e9cd0

SHA1
08799520b72a1ef92ac5b94a33509d1eddf6caf8

SHA256
beef0631c17a4fb1ff0b625c50c6cb6c8ce90a1ae62c5e60e14bf3d915ad509c

SHA512
2180e46a5a2ea1f59c879b729806ca02a232c66660f29c338c1fa7fbee2afa4b13d8777d1f7b63cf831eb42f3e55282d70aa8e53f40616b8a6e4d695c36e313d

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\2052\LocalizedData.xml
Filesize
30KB

MD5
52b1dc12ce4153aa759fb3bbe04d01fc

SHA1
bf21f8591c473d1fce68a9faf1e5942f486f6eba

SHA256
d1735c8cfd8e10ba019d70818c19fa865e7c72f30ab6421a3748408f85fb96c3

SHA512
418903ae9a7baebf73d055e4774ff1917fbaab9ee7ed8c120c34bb10e7303f6dd7b7dae701596d4626387a30ae1b4d329a9af49b8718b360e2ff619c56c19623

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\3082\LocalizedData.xml
Filesize
39KB

MD5
5397a12d466d55d566b4209e0e4f92d3

SHA1
fcffd8961fb487995543fc173521fdf5df6e243b

SHA256
f124d318138ff084b6484deb354cca0f72296e1341bf01169792b3e060c89e89

SHA512
7708f5a2ad3e4c90c4c216600435af87a1557f60caf880a3dd9b5f482e17399af9f0b9de03ff1dbdd210583e0fec5b466e35794ac24d6d37f9bbc094e52fc77b

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\DHTMLHeader.html
Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\ParameterInfo.xml
Filesize
21KB

MD5
13f8768c289476fdd103ff689d73cd2d

SHA1
ddebcecc02c6b1b996423d62d0def8760f031f58

SHA256
4eae293ca91b31aaa206e5a1c655714f0fe84e39f9331cb759d2236cdb915523

SHA512
c72998f30ebff8f4a757248639cf0351d03f5502be475b4cb8f02b09ad800dbbe2f9a82c7d9bde6d7bd748e0ee6e61b86e369192773fe726421a564e793a0139

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\SetupEngine.dll
Filesize
789KB

MD5
63e7901d4fa7ac7766076720272060d0

SHA1
72dec0e4e12255d98ccd49937923c7b5590bbfac

SHA256
a5116ccb17b242713e5645c2374abf5827c0d2752b31553e3540c9123812e952

SHA512
de2e63bc090121484191cbf23194361d761b01c0fd332f35f0dfdfd0b11431b529e5c7f542031a0e7e26f31497d94b8baacfbf1c84c6493e66ac2ab76c11d0a0

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\SetupUi.dll
Filesize
288KB

MD5
0d214ced87bf0b55883359160a68dacb

SHA1
a60526505d56d447c6bbde03da980db67062c4c6

SHA256
29cf99d7e67b4c54bafd109577a385387a39301bcdec8ae4ba1a8a0044306713

SHA512
d9004ebd42d4aa7d13343b3746cf454ca1a5144f7b0f437f1a31639cc6bd90c5dd3385612df926bf53c3ef85cfe33756c067cb757fff257d674a10d638fc03c5

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\SetupUi.xsd
Filesize
29KB

MD5
2fadd9e618eff8175f2a6e8b95c0cacc

SHA1
9ab1710a217d15b192188b19467932d947b0a4f8

SHA256
222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093

SHA512
a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\Strings.xml
Filesize
13KB

MD5
332adf643747297b9bfa9527eaefe084

SHA1
670f933d778eca39938a515a39106551185205e9

SHA256
e49545feeae22198728ad04236e31e02035af7cc4d68e10cbecffd08669cbeca

SHA512
bea95ce35c4c37b4b2e36cc1e81fc297cc4a8e17b93f10423a02b015ddb593064541b5eb7003560fbeee512ed52869a113a6fb439c1133af01f884a0db0344b0

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\UiInfo.xml
Filesize
35KB

MD5
4f90fcef3836f5fc49426ad9938a1c60

SHA1
89eba3b81982d5d5c457ffa7a7096284a10de64a

SHA256
66a0299ce7ee12dd9fc2cfead3c3211e59bfb54d6c0627d044d44cef6e70367b

SHA512
4ce2731c1d32d7ca3a4f644f4b3111f06223de96c1e241fcc86f5fe665f4db18c8a241dae4e8a7e278d6afbf91b235a2c3517a40d4d22d9866880e19a7221160

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\graphics\Rotate1.ico
Filesize
894B

MD5
26a00597735c5f504cf8b3e7e9a7a4c1

SHA1
d913cb26128d5ca1e1ac3dab782de363c9b89934

SHA256
37026c4ea2182d7908b3cf0cef8a6f72bddca5f1cfbc702f35b569ad689cf0af

SHA512
08cefc5a2b625f261668f70cc9e1536dc4878d332792c751884526e49e7fee1ecfa6fccfddf7be80910393421cc088c0fd0b0c27c7a7eff2ae03719e06022fdf

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\graphics\Rotate2.ico
Filesize
894B

MD5
8419caa81f2377e09b7f2f6218e505ae

SHA1
2cf5ad8c8da4f1a38aab433673f4dddc7ae380e9

SHA256
db89d8a45c369303c04988322b2774d2c7888da5250b4dab2846deef58a7de22

SHA512
74e504d2c3a8e82925110b7cfb45fde8a4e6df53a188e47cf22d664cbb805eba749d2db23456fc43a86e57c810bc3d9166e7c72468fbd736da6a776f8ca015d1

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\graphics\Rotate3.ico
Filesize
894B

MD5
924fd539523541d42dad43290e6c0db5

SHA1
19a161531a2c9dbc443b0f41b97cbde7375b8983

SHA256
02a7fe932029c6fa24d1c7cc06d08a27e84f43a0cbc47b7c43cac59424b3d1f6

SHA512
86a4c5d981370efa20183cc4a52c221467692e91539ac38c8def1cc200140f6f3d9412b6e62faf08ca6668df401d8b842c61b1f3c2a4c4570f3b2cec79c9ee8b

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\graphics\Rotate4.ico
Filesize
894B

MD5
bb55b5086a9da3097fb216c065d15709

SHA1
1206c708bd08231961f17da3d604a8956addccfe

SHA256
8d82ff7970c9a67da8134686560fe3a6c986a160ced9d1cc1392f2ba75c698ab

SHA512
de9226064680da6696976a4a320e08c41f73d127fbb81bf142048996df6206ddb1c2fe347c483cc8e0e50a00dab33db9261d03f1cd7ca757f5ca7bb84865fca9

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\graphics\Rotate5.ico
Filesize
894B

MD5
3b4861f93b465d724c60670b64fccfcf

SHA1
c672d63c62e00e24fbb40da96a0cc45b7c5ef7f0

SHA256
7237051d9af5db972a1fecf0b35cd8e9021471740782b0dbf60d3801dc9f5f75

SHA512
2e798b0c9e80f639571525f39c2f50838d5244eeda29b18a1fae6c15d939d5c8cd29f6785d234b54bda843a645d1a95c7339707991a81946b51f7e8d5ed40d2c

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\graphics\Rotate6.ico
Filesize
894B

MD5
70006bf18a39d258012875aefb92a3d1

SHA1
b47788f3f8c5c305982eb1d0e91c675ee02c7beb

SHA256
19abcedf93d790e19fb3379cb3b46371d3cbff48fe7e63f4fdcc2ac23a9943e4

SHA512
97fdbdd6efadbfb08161d8546299952470228a042bd2090cd49896bc31ccb7c73dab8f9de50cdaf6459f7f5c14206af7b90016deeb1220943d61c7324541fe2c

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\graphics\Rotate7.ico
Filesize
894B

MD5
fb4dfebe83f554faf1a5cec033a804d9

SHA1
6c9e509a5d1d1b8d495bbc8f57387e1e7e193333

SHA256
4f46a9896de23a92d2b5f963bcfb3237c3e85da05b8f7660641b3d1d5afaae6f

SHA512
3caeb21177685b9054b64dec997371c4193458ff8607bce67e4fbe72c4af0e6808d344dd0d59d3d0f5ce00e4c2b8a4ffca0f7d9352b0014b9259d76d7f03d404

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\graphics\Rotate8.ico
Filesize
894B

MD5
d1c53003264dce4effaf462c807e2d96

SHA1
92562ad5876a5d0cb35e2d6736b635cb5f5a91d9

SHA256
5fb03593071a99c7b3803fe8424520b8b548b031d02f2a86e8f5412ac519723c

SHA512
c34f8c05a50dc0de644d1f9d97696cdb0a1961c7c7e412eb3df2fd57bbd34199cf802962ca6a4b5445a317d9c7875e86e8e62f6c1df8cc3415afc0bd26e285bd

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\graphics\print.ico
Filesize
1KB

MD5
7e55ddc6d611176e697d01c90a1212cf

SHA1
e2620da05b8e4e2360da579a7be32c1b225deb1b

SHA256
ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed

SHA512
283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\graphics\save.ico
Filesize
1KB

MD5
7d62e82d960a938c98da02b1d5201bd5

SHA1
194e96b0440bf8631887e5e9d3cc485f8e90fbf5

SHA256
ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5

SHA512
ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\graphics\setup.ico
Filesize
35KB

MD5
3d25d679e0ff0b8c94273dcd8b07049d

SHA1
a517fc5e96bc68a02a44093673ee7e076ad57308

SHA256
288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f

SHA512
3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\header.bmp
Filesize
7KB

MD5
3ad1a8c3b96993bcdf45244be2c00eef

SHA1
308f98e199f74a43d325115a8e7072d5f2c6202d

SHA256
133b86a4f1c67a159167489fdaeab765bfa1050c23a7ae6d5c517188fb45f94a

SHA512
133442c4a65269f817675adf01adcf622e509aa7ec7583bca8cd9a7eb6018d2aab56066054f75657038efb947cd3b3e5dc4fe7f0863c8b3b1770a8fa4fe2e658

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\sqmapi.dll
Filesize
141KB

MD5
3f0363b40376047eff6a9b97d633b750

SHA1
4eaf6650eca5ce931ee771181b04263c536a948b

SHA256
bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c

SHA512
537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\vc_red.cab
Filesize
1.2MB

MD5
f78391a1905f3029e47d7da4ff6394c8

SHA1
caa807c8f4edbb3421bd2e091bc343fac2d98380

SHA256
3c6d23e1759ac227cf3e65f77fe7e380236378dd7c88cca7f4e2cf8e818f2302

SHA512
9d01c6dcf67194e8e966963dc3c818b6ef2c15f7897ddac8e11a86144e839ff540d1ba999e033c535f1a2bea348c45b1547d8c9eabdd0eac580e3fd7e0dccbac

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\vc_red.msi
Filesize
160KB

MD5
3ff9acea77afc124be8454269bb7143f

SHA1
8dd6ecab8576245cd6c8617c24e019325a3b2bdc

SHA256
9ecf3980b29c6aa20067f9f45c64b45ad310a3d83606cd9667895ad35f106e66

SHA512
8d51f692747cfdd59fc839918a34d2b6cbbb510c90dea83ba936b3f5f39ee4cbd48f6bb7e35ed9e0945bf724d682812532191d91c8f3c2adb6ff80a8df89ff7a

Download Submit
\??\f:\d7d94c39aa2a99ae76ea2087be690236\watermark.bmp
Filesize
301KB

MD5
1a5caafacfc8c7766e404d019249cf67

SHA1
35d4878db63059a0f25899f4be00b41f430389bf

SHA256
2e87d5742413254db10f7bd0762b6cdb98ff9c46ca9acddfd9b1c2e5418638f2

SHA512
202c13ded002d234117f08b18ca80d603246e6a166e18ba422e30d394ada7e47153dd3cce9728affe97128fdd797fe6302c74dc6882317e2ba254c8a6db80f46

Download Submit
\??\f:\f6f9ab9c843da842997a73f6ed23f5\globdata.ini
Filesize
1KB

MD5
0a6b586fabd072bd7382b5e24194eac7

SHA1
60e3c7215c1a40fbfb3016d52c2de44592f8ca95

SHA256
7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

SHA512
b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

Download Submit
\??\f:\f6f9ab9c843da842997a73f6ed23f5\install.ini
Filesize
841B

MD5
f8f6c0e030cb622f065fe47d61da91d7

SHA1
cf6fa99747de8f35c6aea52df234c9c57583baa3

SHA256
c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d

SHA512
b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde

Download Submit
\??\f:\f6f9ab9c843da842997a73f6ed23f5\install.res.1033.dll
Filesize
85KB

MD5
ff6003014eefc9c30abe20e3e1f5fbe8

SHA1
4a5bd05f94545f01efc10232385b8fecad300678

SHA256
a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067

SHA512
3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2

Download Submit
\??\f:\f6f9ab9c843da842997a73f6ed23f5\vc_red.cab
Filesize
853KB

MD5
f39a48c7b42ffe27b8706fd2111afa24

SHA1
6d61174793da8f3907fc022c4b1ca79e5090ffc0

SHA256
5ee6311e9f26b72ce41497b671c34ccc3d6c470b1af4d906664d507a743ee9f6

SHA512
53645cf99d5c3a96104a6e02f81f527f7ba312c2cc14846f8bd3d431f92af67cd412d48f2582681bcfb89e4d9813d8165f0d9dc07eb653c348a90575055f34af

Download Submit
\??\f:\f6f9ab9c843da842997a73f6ed23f5\vc_red.msi
Filesize
222KB

MD5
7e641e6a0b456271745c20c3bb8a18f9

SHA1
ae6cedcb81dc443611a310140ae4671789dbbf3a

SHA256
34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d

SHA512
f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903

Download Submit
\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll
Filesize
835KB

MD5
b370bef39a3665a33bd82b614ffbf361

SHA1
ac4608231fce95c4036dc04e1b0cf56ae813df03

SHA256
a9f818f65074355e9376f9519b6846333b395d9b2d884d8d15f8d2f4991b860a

SHA512
66ebf1275d86c07f5c86244b10187453ef40a550d74b9eb24ac3fbf51419786b87fdefe84812d85dc269cb49377e1b51732b697ae089cfbf35123ea90932fdb8

Download Submit
memory/2676-518-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2768-666-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download