Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25-05-2024 13:36

General

  • Target

    install_all.bat

  • Size

    1KB

  • MD5

    eb55aae630088c91b88d2bfae4115ea0

  • SHA1

    1495c69946edca474fe30c2b713aacb9f03bbf3a

  • SHA256

    492ee4c16ac45a5483088583c9caa08252d3a1bb3922dbbec834d61673538f17

  • SHA512

    48e4a3fa644b1859131cfec782641aaee9938c88f939ca0509df0f4120b922187753ce7cd7d912d2f90108526ba34d767baa28c9eeeb25d43fff77d38ddfd882

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 36 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 64 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\install_all.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Users\Admin\AppData\Local\Temp\vcredist2005_x86.exe
      vcredist2005_x86.exe /q
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious use of WriteProcessMemory
      PID:2996
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec /i vcredist.msi
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2312
    • C:\Users\Admin\AppData\Local\Temp\vcredist2005_x64.exe
      vcredist2005_x64.exe /q
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious use of WriteProcessMemory
      PID:440
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec /i vcredist.msi
        3⤵
        • Enumerates connected drives
        • Suspicious use of FindShellTrayWindow
        PID:3060
    • C:\Users\Admin\AppData\Local\Temp\vcredist2008_x86.exe
      vcredist2008_x86.exe /qb
      2⤵
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious use of WriteProcessMemory
      PID:1496
      • \??\f:\c9ed427a6a8a1061f930\install.exe
        f:\c9ed427a6a8a1061f930\.\install.exe /qb
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        PID:2324
    • C:\Users\Admin\AppData\Local\Temp\vcredist2008_x64.exe
      vcredist2008_x64.exe /qb
      2⤵
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious use of WriteProcessMemory
      PID:2428
      • \??\f:\7b20fb9b27c5d1a52761b01e\install.exe
        f:\7b20fb9b27c5d1a52761b01e\.\install.exe /qb
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        PID:2608
    • C:\Users\Admin\AppData\Local\Temp\vcredist2010_x86.exe
      vcredist2010_x86.exe /passive /norestart
      2⤵
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      PID:1524
      • \??\f:\7cec5e1d35fe1e02ff16869681\Setup.exe
        f:\7cec5e1d35fe1e02ff16869681\Setup.exe /passive /norestart
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2204
    • C:\Users\Admin\AppData\Local\Temp\vcredist2010_x64.exe
      vcredist2010_x64.exe /passive /norestart
      2⤵
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      PID:1780
      • \??\f:\2cf32df4ecf0a92457ab743f93\Setup.exe
        f:\2cf32df4ecf0a92457ab743f93\Setup.exe /passive /norestart
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2016
    • C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86.exe
      vcredist2012_x86.exe /passive /norestart
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      PID:1596
      • C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86.exe
        "C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{0DE8ADD9-70FD-4D91-8359-CC1B895E027B} {0066F9E7-48E5-4A11-9FC4-D4EB9AB9AE27} 1596
        3⤵
        • Suspicious use of FindShellTrayWindow
        PID:1604
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 344
          4⤵
          • Program crash
          PID:1600
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 312491A7AEFC47A11729F87146568105
      2⤵
      • Loads dropped DLL
      PID:1888
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B1D7CF204318004EF3D4DEAD27B2745C
      2⤵
      • Loads dropped DLL
      PID:1996
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2812
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000580" "00000000000003DC"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2544
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot20" "" "" "65dbac317" "0000000000000000" "00000000000003DC" "00000000000003A8"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    PID:1752
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot21" "" "" "6f9bf5bcb" "0000000000000000" "0000000000000534" "0000000000000580"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    PID:680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f767493.rbs

    Filesize

    29KB

    MD5

    411a4e4882ab6206c667d34038b6b11a

    SHA1

    856aa07eae51b42fa06ab3e229ab7f5af4272df7

    SHA256

    93199c6355c3ab581606394468fcefb98c949495533dfb3813b2736e94818c5e

    SHA512

    4c785a49d25ee98580e9405d09996f3db24c29e5dd170f970d4e508c9618b811a1814b6cc402c826e06ccfbb85f2135bac48169d3475fcb037995cdd689cd246

  • C:\Config.Msi\f767498.rbs

    Filesize

    29KB

    MD5

    157efc4cb79b3f83e7c3033b0ca5588d

    SHA1

    32b523214501afa85d64474d63f29ec6a56d61de

    SHA256

    13b7bf69c1c34c0b93a9a6806e7c52398d43b18f7a82699331009eb69d27e8db

    SHA512

    b6faff0551c286e504bdccfaa148c8dcf9b1b96fe5d720a6964dc2ca990e3efb8cbc747d35255f32c79f67628e7a173fecc7a51928b7a43e8406ba77cc08c5b9

  • C:\Config.Msi\f76749d.rbs

    Filesize

    4KB

    MD5

    1e71fdbc29d24ee1e623db6138d88fa3

    SHA1

    dcff5985a1c3ff83ca3d61a371d34e17838e3876

    SHA256

    ef326213100883d73bccce6a8fe789f44b32702f9f0ad9b43e0232d4dd21e59b

    SHA512

    4926aaa5c2c358ce5691803c35712b9a21935fb7fbee0d2b72093c27c0c9855cd757ab21fbff170e154d99b131d71d888b142241b81abcd6e7bf2ac85a01f98b

  • C:\Config.Msi\f7674a2.rbs

    Filesize

    29KB

    MD5

    f740cc54f989efd5c2c3fa814a9505d3

    SHA1

    200ce0eb5cf50f584d902aac28935167ad024226

    SHA256

    f6bb3655ab11182fae088d615fe363dd2d499b198d57b6e00d404c797cc9bc06

    SHA512

    069c31cf5af53c857896c609689e1403b26bcb4fe36019a05ecccc7b7d4530e930f917254ca2211028fc03cc24674ee0305255e862aee27209447b295aba308d

  • C:\Config.Msi\f7674a6.rbs

    Filesize

    4KB

    MD5

    f24a611c30816c432671b3f95d6c4c44

    SHA1

    ce2e5e54af26d7716beb79c01e9d2091e756cc48

    SHA256

    f1e18d3567018c1092346866aed1b4c5c05b4b93c0847dc0831de5c40e0e611b

    SHA512

    67e9a63ec35dd6d4cc44141264b095735cb814c03042f65fb48b026e9c04cd8a0c6d27f358063929de98f5a26e3c14679156904ee9df0107a30f2bc22efe61ee

  • C:\Config.Msi\f7674ab.rbs

    Filesize

    29KB

    MD5

    514b718cffe9a2daf54c0adf1ac0ee2c

    SHA1

    09a7e31e2f88094e627b5d07cb70d8db52760918

    SHA256

    ba26ae6592f99f4217b64772bb56d4f80ab8124ddf373346f821ebb81bdcc006

    SHA512

    f95a88ef3902beb6dcb374d0666412c475cea36491d06d62ccb944fb5d7c6582c381ee8ad44d92ad7d6d924ebd5e0057dd32f11a67c341922a05ce8f56f6f082

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1173e5f90f0a03adfad0b4a06a6d7e29

    SHA1

    508946f7283940510da6e65fb816f61b5a629879

    SHA256

    9bd16dec741bbc42a92390ef5d0697a4d3079eb65f36f31f599cfc87bcfdff0e

    SHA512

    fec64324610f4338738c711364225b98445508a775a33258a190cb0c13f12deaf718fd78212a43c892ecc828bb7dba76ae2825ed66d1cced35fd2645651cd75e

  • C:\Users\Admin\AppData\Local\Temp\Cab74E2.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab

    Filesize

    247KB

    MD5

    cc064d4b81619991de8131a86ad77681

    SHA1

    88d80d86cc20c27d7d2a872af719300bd2bb73f9

    SHA256

    913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477

    SHA512

    5aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab

    Filesize

    312KB

    MD5

    77a9bff5af149160775741e204734d47

    SHA1

    7b5126af69b5a79593f39db94180f1ff11b0e39d

    SHA256

    20a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038

    SHA512

    bb0440f58f07e113bddd9a0afb5aab8af6493218784fe5fa6f4032e3a37088f91b7e766dee87cec4a9ea11d425d27b3b536430de3a52222e8bca3e0247d81e3b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi

    Filesize

    2.6MB

    MD5

    b20bbeb818222b657df49a9cfe4fed79

    SHA1

    3f6508e880b86502773a3275bc9527f046d45502

    SHA256

    91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4

    SHA512

    f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi

    Filesize

    3.0MB

    MD5

    6dbdf338a0a25cdb236d43ea3ca2395e

    SHA1

    685b6ea61e574e628392eaac8b10aff4309f1081

    SHA256

    200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb

    SHA512

    6b5b31c55cf72ab92b17fb6074b3901a1e6afe0796ef9bc831e4dfb97450376d2889cd24b1cf3fce60eb3c1bcd1b31254b5cfa3ef6107974dfa0b35c233daf5a

  • C:\Users\Admin\AppData\Local\Temp\TarA0D2.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\AppData\Local\Temp\VWLEDC8.tmp

    Filesize

    392B

    MD5

    4260fb566011585e01e8d09d14d5b9d1

    SHA1

    8b45bcb4c6767de7247c57971dc50f241bb82f52

    SHA256

    31ddb553551fb088a1233e1221c64f018a349efd13a17311e921fa3c5483ead5

    SHA512

    a5ed86b7ea184eda949121382775755c5969b353e8e9154d4ceb3a107f414aff87c46a1b90ae1f863beb065bb55c2859c5222d3fb6a251c0f9a5d7dfc6b99e29

  • C:\Users\Admin\AppData\Local\Temp\VWLF69E.tmp

    Filesize

    392B

    MD5

    b18387568f477df53500c529de6140ae

    SHA1

    748439162324948f6ef7771d201f67862ca6b968

    SHA256

    ab45fdf7b2a3fa7f68a6ed55aca70551342dde0a4d6075c3f71ce43b8e6ff837

    SHA512

    41d340d348e530d8525ed91506542ab9a5f71688e041d5d7042d57f115a3644e2b54a608dbc77fb949190db171912f68b9dc19800c2d481713110df0bd915098

  • C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI54DC.txt

    Filesize

    2KB

    MD5

    16cbe323438795da28711ef4bd1ff4f7

    SHA1

    a22977ff3bb0a1cce4c40f4caf7bb2d60c3a8ddf

    SHA256

    5f9a6b4a9cadab74ef5b16bc49afa29b5e8922e988f6622cb6bdb3c1991d8dc3

    SHA512

    da2ce805d2c942e6811abfe0371c8e878a0e8a845c19fc7247ea8b9b1d86e4499285aca00393f80e5be1865ad2508d343d6b9cf1a81f53b4920c10281fa71433

  • C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI54DF.txt

    Filesize

    2KB

    MD5

    cf61b807c3907c04b6eabf42661f59c0

    SHA1

    27c0276c6eb165fd5eb90c94cf4e31e4a3513800

    SHA256

    24f3066c31817563cefe9b4e603f702699979c51c5a2c1b0d517174176bdcaa4

    SHA512

    0589f2fa2d38a3e4552285900c0a12fa1f95ae9373e41e692493aa3b53a60a7250c3238e506c00c675f4334e206fda7b592f55f9e4664daa142aab2facb5a80e

  • C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png

    Filesize

    1KB

    MD5

    d6bd210f227442b3362493d046cea233

    SHA1

    ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

    SHA256

    335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

    SHA512

    464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

  • C:\Windows\Installer\MSI7754.tmp

    Filesize

    28KB

    MD5

    85221b3bcba8dbe4b4a46581aa49f760

    SHA1

    746645c92594bfc739f77812d67cfd85f4b92474

    SHA256

    f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

    SHA512

    060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

  • F:\7b20fb9b27c5d1a52761b01e\install.exe

    Filesize

    834KB

    MD5

    f0995d5ebde916fa146f51d324cf410c

    SHA1

    6a03e96a663051683b82601b5c7be72d72ecdb1c

    SHA256

    f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b

    SHA512

    8a2ca604c06077a1c5a7ac9782ff6815a4ea1b152502707120cf5a8edddcda7c8d1a71e16c80305a3fa098acb6ecf158c770e6d0a9cb2e57a9d875fb935664b8

  • F:\7cec5e1d35fe1e02ff16869681\Setup.exe

    Filesize

    76KB

    MD5

    2af2c1a78542975b12282aca4300d515

    SHA1

    3216c853ed82e41dfbeb6ca48855fdcd41478507

    SHA256

    531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7

    SHA512

    4a70bd4b542f6001e46f827f341676c34af1ea216c50ad981dd04f547cd67f73aaa420fcbed379dc05dab199bf5ba00d899c49ff75da577613209f96226227eb

  • F:\c9ed427a6a8a1061f930\install.exe

    Filesize

    547KB

    MD5

    4138c31964fbcb3b7418e086933324c3

    SHA1

    97cc6f58fb064ab6c4a2f02fb665fef77d30532f

    SHA256

    b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29

    SHA512

    40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557

  • \??\f:\7b20fb9b27c5d1a52761b01e\install.res.1033.dll

    Filesize

    84KB

    MD5

    e8ed5b7797472df6f5e1dae87c123e5e

    SHA1

    71e203899c3faf5e9eb5543bfd0eb748b78da566

    SHA256

    6ad479dd35201c74092068cccd6d12fd84a45d2c04e927b39901a9126f9e06dd

    SHA512

    dfdd6bba404753f6afbc804551550bdc771eccc034c01f4c5149beb6d98424cf7b86fc63aac361a1840df9bc8365c726baab672055534620db70ca2c0e2e1b3e

  • \??\f:\7b20fb9b27c5d1a52761b01e\vc_red.cab

    Filesize

    4.3MB

    MD5

    5cad07d592a2a43905d6b656b79a7abd

    SHA1

    9168413a66fe4e41ddd506a68e7f5e5feebf9d6b

    SHA256

    9f218cefe505a28a589b10f4e7c28ac479eca159e438012a9666e6f709bcf82f

    SHA512

    546065881b32421ba36076dd6848d98e444d89def7a4bfd3d7299d6de6f6f746a2abea2a00e24b02ba5ba2bde816a70529eb8ca48972ccc2d03f3ccb12df4261

  • \??\f:\7b20fb9b27c5d1a52761b01e\vc_red.msi

    Filesize

    230KB

    MD5

    4aa5bbddbf6b2d1cf509c566312f1203

    SHA1

    0557e25cf4c2aa1bcb170707cd282ae864d93d17

    SHA256

    017e62a7a046acf00f5565e60f8eed4c5f409913e7ddc2f431d4236bbfdabab8

    SHA512

    e32fad32aefb70592eec56c55eaf65d6a6ed33939a6cabe7ff0ec33f91c4687001a41575ccfcac448c4739b2af4e309c2ec9e526104fb292d04aa8746dfad8f9

  • \??\f:\7cec5e1d35fe1e02ff16869681\1028\LocalizedData.xml

    Filesize

    29KB

    MD5

    7fc06a77d9aafca9fb19fafa0f919100

    SHA1

    e565740e7d582cd73f8d3b12de2f4579ff18bb41

    SHA256

    a27f809211ea1a2d5224cd01101aa3a59bf7853168e45de28a16ef7ed6acd46a

    SHA512

    466dcc6a5fb015be1619f5725fa62ca46eb0fb428e11f93fd9d82e5df61c3950b3fb62d4db7746cc4a2be199e5e69eaa30b6f3354e0017cfa14d127fad52f8cf

  • \??\f:\7cec5e1d35fe1e02ff16869681\1031\LocalizedData.xml

    Filesize

    40KB

    MD5

    b83c3803712e61811c438f6e98790369

    SHA1

    61a0bc59388786ced045acd82621bee8578cae5a

    SHA256

    2aa6e8d402e44d9ee895b18195f46bf90259de1b6f44efd46a7075b110f2dcd6

    SHA512

    e020f93e3a082476087e690ad051f1feb210e0915924bb4548cc9f53a7ee2760211890eb6036ce9e5e4a311abc0300e89e25efbbb894c2a621ffbc9d64cc8a38

  • \??\f:\7cec5e1d35fe1e02ff16869681\1033\LocalizedData.xml

    Filesize

    38KB

    MD5

    d642e322d1e8b739510ca540f8e779f9

    SHA1

    36279c76d9f34c09ebddc84fd33fcc7d4b9a896c

    SHA256

    5d90345ff74e177f6da8fb6459c1cfcac080e698215ca75feb130d0d1f2a76b9

    SHA512

    e1e16ae14bc7cc1608e1a08d3c92b6d0518b5fabd27f2c0eb514c87afc3d6192bf7a793a583afc65f1899f03dc419263b29174456e1ec9ab0f0110e0258e0f0d

  • \??\f:\7cec5e1d35fe1e02ff16869681\1033\SetupResources.dll

    Filesize

    16KB

    MD5

    0b4e76baf52d580f657f91972196cd91

    SHA1

    e6ac8f80ab8ade18ac7e834ac6d0536bb483988c

    SHA256

    74a7767d8893dcc1a745522d5a509561162f95bc9e8bcc3056f37a367dba64a4

    SHA512

    ed53292c549d09da9118e944a646aa5dc0a6231811eafcda4258c892b218bcf3e0363a2c974868d2d2722155983c5dc8e29bed36d58e566e1695e23ce07fea87

  • \??\f:\7cec5e1d35fe1e02ff16869681\1036\LocalizedData.xml

    Filesize

    40KB

    MD5

    e382abc19294f779d2833287242e7bc6

    SHA1

    1ceae32d6b24a3832f9244f5791382865b668a72

    SHA256

    43f913ff28d677316f560a0f45221f35f27cfaf5fc5bd645974a82dca589edbf

    SHA512

    06054c8048cade36a3af54f9a07fd8fa5eb4f3228790996d2abea7ee1ee7eb563d46bd54ff97441f9610e778194082c44e66c5f566c9c50a042aba9eb9cae25e

  • \??\f:\7cec5e1d35fe1e02ff16869681\1040\LocalizedData.xml

    Filesize

    39KB

    MD5

    0af948fe4142e34092f9dd47a4b8c275

    SHA1

    b3d6dd5c126280398d9055f90e2c2c26dbae4eaa

    SHA256

    c4c7c0ddaa6d6a3a1dc260e9c5a24bdfaa98c427c69e8a65427dd7cac0a4b248

    SHA512

    d97b5fe2553ca78a3019d53e33d2db80c9fa1cf1d8d2501d9ddf0576c7e6ea38dab754fe4712123abf34b97e10b18fb4bbd1c76d3dacb87b4682e501f93423d9

  • \??\f:\7cec5e1d35fe1e02ff16869681\1041\LocalizedData.xml

    Filesize

    33KB

    MD5

    7fcfbc308b0c42dcbd8365ba62bada05

    SHA1

    18a0f0e89b36818c94de0ad795cc593d0e3e29a9

    SHA256

    01e7d24dd8e00b5c333e96d1bb83813e02e96f89aad0c2f28f84551d28abbbe2

    SHA512

    cd6f912a037e86d9e1982c73f0f8b3c4d5a9a6b5b108a7b89a46e6691e430a7cb55718de9a0c05650bb194c8d4a2e309ad6221d638cfca8e16aa5920881ba649

  • \??\f:\7cec5e1d35fe1e02ff16869681\1042\LocalizedData.xml

    Filesize

    32KB

    MD5

    71dfd70ae141f1d5c1366cb661b354b2

    SHA1

    c4b22590e6f6dd5d39e5158b831ae217ce17a776

    SHA256

    cccda55294aeb4af166a8c0449bca2189ddf5aa9a43d5e939dd3803e61738331

    SHA512

    5000d62f3de41c3fb0ed8a8e9c37dbf4eb427c4f1e3ad3823d4716c6fe62250bac11b7987a302b8a45d91aabcf332457f7aff7d99f15edeffe540639e9440e8a

  • \??\f:\7cec5e1d35fe1e02ff16869681\1049\LocalizedData.xml

    Filesize

    39KB

    MD5

    0eeb554d0b9f9fcdb22401e2532e9cd0

    SHA1

    08799520b72a1ef92ac5b94a33509d1eddf6caf8

    SHA256

    beef0631c17a4fb1ff0b625c50c6cb6c8ce90a1ae62c5e60e14bf3d915ad509c

    SHA512

    2180e46a5a2ea1f59c879b729806ca02a232c66660f29c338c1fa7fbee2afa4b13d8777d1f7b63cf831eb42f3e55282d70aa8e53f40616b8a6e4d695c36e313d

  • \??\f:\7cec5e1d35fe1e02ff16869681\2052\LocalizedData.xml

    Filesize

    30KB

    MD5

    52b1dc12ce4153aa759fb3bbe04d01fc

    SHA1

    bf21f8591c473d1fce68a9faf1e5942f486f6eba

    SHA256

    d1735c8cfd8e10ba019d70818c19fa865e7c72f30ab6421a3748408f85fb96c3

    SHA512

    418903ae9a7baebf73d055e4774ff1917fbaab9ee7ed8c120c34bb10e7303f6dd7b7dae701596d4626387a30ae1b4d329a9af49b8718b360e2ff619c56c19623

  • \??\f:\7cec5e1d35fe1e02ff16869681\3082\LocalizedData.xml

    Filesize

    39KB

    MD5

    5397a12d466d55d566b4209e0e4f92d3

    SHA1

    fcffd8961fb487995543fc173521fdf5df6e243b

    SHA256

    f124d318138ff084b6484deb354cca0f72296e1341bf01169792b3e060c89e89

    SHA512

    7708f5a2ad3e4c90c4c216600435af87a1557f60caf880a3dd9b5f482e17399af9f0b9de03ff1dbdd210583e0fec5b466e35794ac24d6d37f9bbc094e52fc77b

  • \??\f:\7cec5e1d35fe1e02ff16869681\DHTMLHeader.html

    Filesize

    15KB

    MD5

    cd131d41791a543cc6f6ed1ea5bd257c

    SHA1

    f42a2708a0b42a13530d26515274d1fcdbfe8490

    SHA256

    e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

    SHA512

    a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

  • \??\f:\7cec5e1d35fe1e02ff16869681\ParameterInfo.xml

    Filesize

    21KB

    MD5

    13f8768c289476fdd103ff689d73cd2d

    SHA1

    ddebcecc02c6b1b996423d62d0def8760f031f58

    SHA256

    4eae293ca91b31aaa206e5a1c655714f0fe84e39f9331cb759d2236cdb915523

    SHA512

    c72998f30ebff8f4a757248639cf0351d03f5502be475b4cb8f02b09ad800dbbe2f9a82c7d9bde6d7bd748e0ee6e61b86e369192773fe726421a564e793a0139

  • \??\f:\7cec5e1d35fe1e02ff16869681\SetupEngine.dll

    Filesize

    789KB

    MD5

    63e7901d4fa7ac7766076720272060d0

    SHA1

    72dec0e4e12255d98ccd49937923c7b5590bbfac

    SHA256

    a5116ccb17b242713e5645c2374abf5827c0d2752b31553e3540c9123812e952

    SHA512

    de2e63bc090121484191cbf23194361d761b01c0fd332f35f0dfdfd0b11431b529e5c7f542031a0e7e26f31497d94b8baacfbf1c84c6493e66ac2ab76c11d0a0

  • \??\f:\7cec5e1d35fe1e02ff16869681\SetupUi.dll

    Filesize

    288KB

    MD5

    0d214ced87bf0b55883359160a68dacb

    SHA1

    a60526505d56d447c6bbde03da980db67062c4c6

    SHA256

    29cf99d7e67b4c54bafd109577a385387a39301bcdec8ae4ba1a8a0044306713

    SHA512

    d9004ebd42d4aa7d13343b3746cf454ca1a5144f7b0f437f1a31639cc6bd90c5dd3385612df926bf53c3ef85cfe33756c067cb757fff257d674a10d638fc03c5

  • \??\f:\7cec5e1d35fe1e02ff16869681\SetupUi.xsd

    Filesize

    29KB

    MD5

    2fadd9e618eff8175f2a6e8b95c0cacc

    SHA1

    9ab1710a217d15b192188b19467932d947b0a4f8

    SHA256

    222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093

    SHA512

    a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca

  • \??\f:\7cec5e1d35fe1e02ff16869681\Strings.xml

    Filesize

    13KB

    MD5

    332adf643747297b9bfa9527eaefe084

    SHA1

    670f933d778eca39938a515a39106551185205e9

    SHA256

    e49545feeae22198728ad04236e31e02035af7cc4d68e10cbecffd08669cbeca

    SHA512

    bea95ce35c4c37b4b2e36cc1e81fc297cc4a8e17b93f10423a02b015ddb593064541b5eb7003560fbeee512ed52869a113a6fb439c1133af01f884a0db0344b0

  • \??\f:\7cec5e1d35fe1e02ff16869681\UiInfo.xml

    Filesize

    35KB

    MD5

    4f90fcef3836f5fc49426ad9938a1c60

    SHA1

    89eba3b81982d5d5c457ffa7a7096284a10de64a

    SHA256

    66a0299ce7ee12dd9fc2cfead3c3211e59bfb54d6c0627d044d44cef6e70367b

    SHA512

    4ce2731c1d32d7ca3a4f644f4b3111f06223de96c1e241fcc86f5fe665f4db18c8a241dae4e8a7e278d6afbf91b235a2c3517a40d4d22d9866880e19a7221160

  • \??\f:\7cec5e1d35fe1e02ff16869681\graphics\Rotate1.ico

    Filesize

    894B

    MD5

    26a00597735c5f504cf8b3e7e9a7a4c1

    SHA1

    d913cb26128d5ca1e1ac3dab782de363c9b89934

    SHA256

    37026c4ea2182d7908b3cf0cef8a6f72bddca5f1cfbc702f35b569ad689cf0af

    SHA512

    08cefc5a2b625f261668f70cc9e1536dc4878d332792c751884526e49e7fee1ecfa6fccfddf7be80910393421cc088c0fd0b0c27c7a7eff2ae03719e06022fdf

  • \??\f:\7cec5e1d35fe1e02ff16869681\graphics\Rotate2.ico

    Filesize

    894B

    MD5

    8419caa81f2377e09b7f2f6218e505ae

    SHA1

    2cf5ad8c8da4f1a38aab433673f4dddc7ae380e9

    SHA256

    db89d8a45c369303c04988322b2774d2c7888da5250b4dab2846deef58a7de22

    SHA512

    74e504d2c3a8e82925110b7cfb45fde8a4e6df53a188e47cf22d664cbb805eba749d2db23456fc43a86e57c810bc3d9166e7c72468fbd736da6a776f8ca015d1

  • \??\f:\7cec5e1d35fe1e02ff16869681\graphics\Rotate3.ico

    Filesize

    894B

    MD5

    924fd539523541d42dad43290e6c0db5

    SHA1

    19a161531a2c9dbc443b0f41b97cbde7375b8983

    SHA256

    02a7fe932029c6fa24d1c7cc06d08a27e84f43a0cbc47b7c43cac59424b3d1f6

    SHA512

    86a4c5d981370efa20183cc4a52c221467692e91539ac38c8def1cc200140f6f3d9412b6e62faf08ca6668df401d8b842c61b1f3c2a4c4570f3b2cec79c9ee8b

  • \??\f:\7cec5e1d35fe1e02ff16869681\graphics\Rotate4.ico

    Filesize

    894B

    MD5

    bb55b5086a9da3097fb216c065d15709

    SHA1

    1206c708bd08231961f17da3d604a8956addccfe

    SHA256

    8d82ff7970c9a67da8134686560fe3a6c986a160ced9d1cc1392f2ba75c698ab

    SHA512

    de9226064680da6696976a4a320e08c41f73d127fbb81bf142048996df6206ddb1c2fe347c483cc8e0e50a00dab33db9261d03f1cd7ca757f5ca7bb84865fca9

  • \??\f:\7cec5e1d35fe1e02ff16869681\graphics\Rotate5.ico

    Filesize

    894B

    MD5

    3b4861f93b465d724c60670b64fccfcf

    SHA1

    c672d63c62e00e24fbb40da96a0cc45b7c5ef7f0

    SHA256

    7237051d9af5db972a1fecf0b35cd8e9021471740782b0dbf60d3801dc9f5f75

    SHA512

    2e798b0c9e80f639571525f39c2f50838d5244eeda29b18a1fae6c15d939d5c8cd29f6785d234b54bda843a645d1a95c7339707991a81946b51f7e8d5ed40d2c

  • \??\f:\7cec5e1d35fe1e02ff16869681\graphics\Rotate6.ico

    Filesize

    894B

    MD5

    70006bf18a39d258012875aefb92a3d1

    SHA1

    b47788f3f8c5c305982eb1d0e91c675ee02c7beb

    SHA256

    19abcedf93d790e19fb3379cb3b46371d3cbff48fe7e63f4fdcc2ac23a9943e4

    SHA512

    97fdbdd6efadbfb08161d8546299952470228a042bd2090cd49896bc31ccb7c73dab8f9de50cdaf6459f7f5c14206af7b90016deeb1220943d61c7324541fe2c

  • \??\f:\7cec5e1d35fe1e02ff16869681\graphics\Rotate7.ico

    Filesize

    894B

    MD5

    fb4dfebe83f554faf1a5cec033a804d9

    SHA1

    6c9e509a5d1d1b8d495bbc8f57387e1e7e193333

    SHA256

    4f46a9896de23a92d2b5f963bcfb3237c3e85da05b8f7660641b3d1d5afaae6f

    SHA512

    3caeb21177685b9054b64dec997371c4193458ff8607bce67e4fbe72c4af0e6808d344dd0d59d3d0f5ce00e4c2b8a4ffca0f7d9352b0014b9259d76d7f03d404

  • \??\f:\7cec5e1d35fe1e02ff16869681\graphics\Rotate8.ico

    Filesize

    894B

    MD5

    d1c53003264dce4effaf462c807e2d96

    SHA1

    92562ad5876a5d0cb35e2d6736b635cb5f5a91d9

    SHA256

    5fb03593071a99c7b3803fe8424520b8b548b031d02f2a86e8f5412ac519723c

    SHA512

    c34f8c05a50dc0de644d1f9d97696cdb0a1961c7c7e412eb3df2fd57bbd34199cf802962ca6a4b5445a317d9c7875e86e8e62f6c1df8cc3415afc0bd26e285bd

  • \??\f:\7cec5e1d35fe1e02ff16869681\graphics\print.ico

    Filesize

    1KB

    MD5

    7e55ddc6d611176e697d01c90a1212cf

    SHA1

    e2620da05b8e4e2360da579a7be32c1b225deb1b

    SHA256

    ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed

    SHA512

    283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e

  • \??\f:\7cec5e1d35fe1e02ff16869681\graphics\save.ico

    Filesize

    1KB

    MD5

    7d62e82d960a938c98da02b1d5201bd5

    SHA1

    194e96b0440bf8631887e5e9d3cc485f8e90fbf5

    SHA256

    ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5

    SHA512

    ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67

  • \??\f:\7cec5e1d35fe1e02ff16869681\graphics\setup.ico

    Filesize

    35KB

    MD5

    3d25d679e0ff0b8c94273dcd8b07049d

    SHA1

    a517fc5e96bc68a02a44093673ee7e076ad57308

    SHA256

    288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f

    SHA512

    3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255

  • \??\f:\7cec5e1d35fe1e02ff16869681\header.bmp

    Filesize

    7KB

    MD5

    3ad1a8c3b96993bcdf45244be2c00eef

    SHA1

    308f98e199f74a43d325115a8e7072d5f2c6202d

    SHA256

    133b86a4f1c67a159167489fdaeab765bfa1050c23a7ae6d5c517188fb45f94a

    SHA512

    133442c4a65269f817675adf01adcf622e509aa7ec7583bca8cd9a7eb6018d2aab56066054f75657038efb947cd3b3e5dc4fe7f0863c8b3b1770a8fa4fe2e658

  • \??\f:\7cec5e1d35fe1e02ff16869681\sqmapi.dll

    Filesize

    141KB

    MD5

    3f0363b40376047eff6a9b97d633b750

    SHA1

    4eaf6650eca5ce931ee771181b04263c536a948b

    SHA256

    bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c

    SHA512

    537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8

  • \??\f:\7cec5e1d35fe1e02ff16869681\vc_red.cab

    Filesize

    4.0MB

    MD5

    c580a38f1a1a7d838076a1b897c37011

    SHA1

    c689488077d1c21820797707078af826ea676b70

    SHA256

    71c0acc75eecdf39051819dc7c26503583f6be6c43ab2c320853de15bece9978

    SHA512

    ea3a62bd312f1ddeebe5e3c7911eb3a73bc3ee184abb7e9b55bc962214f50bbf05d2499caf151d0bd00735e2021fbea9584bf3e868a1d4502b75ec3b62c7ff56

  • \??\f:\7cec5e1d35fe1e02ff16869681\watermark.bmp

    Filesize

    301KB

    MD5

    1a5caafacfc8c7766e404d019249cf67

    SHA1

    35d4878db63059a0f25899f4be00b41f430389bf

    SHA256

    2e87d5742413254db10f7bd0762b6cdb98ff9c46ca9acddfd9b1c2e5418638f2

    SHA512

    202c13ded002d234117f08b18ca80d603246e6a166e18ba422e30d394ada7e47153dd3cce9728affe97128fdd797fe6302c74dc6882317e2ba254c8a6db80f46

  • \??\f:\c9ed427a6a8a1061f930\globdata.ini

    Filesize

    1KB

    MD5

    0a6b586fabd072bd7382b5e24194eac7

    SHA1

    60e3c7215c1a40fbfb3016d52c2de44592f8ca95

    SHA256

    7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

    SHA512

    b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

  • \??\f:\c9ed427a6a8a1061f930\install.ini

    Filesize

    841B

    MD5

    f8f6c0e030cb622f065fe47d61da91d7

    SHA1

    cf6fa99747de8f35c6aea52df234c9c57583baa3

    SHA256

    c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d

    SHA512

    b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde

  • \??\f:\c9ed427a6a8a1061f930\install.res.1033.dll

    Filesize

    85KB

    MD5

    ff6003014eefc9c30abe20e3e1f5fbe8

    SHA1

    4a5bd05f94545f01efc10232385b8fecad300678

    SHA256

    a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067

    SHA512

    3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2

  • \??\f:\c9ed427a6a8a1061f930\vc_red.cab

    Filesize

    3.7MB

    MD5

    0ee84ab717bc400c5e96c8d9d329fbb0

    SHA1

    be4ba7bbb068c7256b70f4fd7634eaeb2ad04d0a

    SHA256

    461d575bc1a07f64c14f1da885d2f310bd282cbbedcd0a5cf8ffa7057411805d

    SHA512

    4a6b0619f471a51df09fb6c1eff4ed166cdb7ef57f79ffdf709fa952a7c2a176c338084689c8ace1a94024a24579e9ee0ab6d411c25a1b42b0f517c57749d1a2

  • \??\f:\c9ed427a6a8a1061f930\vc_red.msi

    Filesize

    222KB

    MD5

    7e641e6a0b456271745c20c3bb8a18f9

    SHA1

    ae6cedcb81dc443611a310140ae4671789dbbf3a

    SHA256

    34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d

    SHA512

    f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903

  • \Program Files\Common Files\Microsoft Shared\VC\msdia90.dll

    Filesize

    835KB

    MD5

    b370bef39a3665a33bd82b614ffbf361

    SHA1

    ac4608231fce95c4036dc04e1b0cf56ae813df03

    SHA256

    a9f818f65074355e9376f9519b6846333b395d9b2d884d8d15f8d2f4991b860a

    SHA512

    66ebf1275d86c07f5c86244b10187453ef40a550d74b9eb24ac3fbf51419786b87fdefe84812d85dc269cb49377e1b51732b697ae089cfbf35123ea90932fdb8

  • memory/2016-698-0x00000000748D0000-0x00000000748F4000-memory.dmp

    Filesize

    144KB

  • memory/2016-697-0x0000000074C00000-0x0000000074CC8000-memory.dmp

    Filesize

    800KB

  • memory/2204-558-0x0000000074C40000-0x0000000074D08000-memory.dmp

    Filesize

    800KB

  • memory/2204-559-0x00000000748D0000-0x00000000748F4000-memory.dmp

    Filesize

    144KB

  • memory/2324-303-0x0000000074B50000-0x0000000074B67000-memory.dmp

    Filesize

    92KB

  • memory/2608-389-0x000007FEF6300000-0x000007FEF6318000-memory.dmp

    Filesize

    96KB