Overview
overview
7Static
static
3MKL_fishin....0.rar
windows7-x64
4MKL_fishin....0.rar
windows10-2004-x64
3FixTOOLLLL...lC.rar
windows7-x64
3FixTOOLLLL...lC.rar
windows10-2004-x64
3Visual-C++...ll.bat
windows7-x64
7Visual-C++...ll.bat
windows10-2004-x64
7Visual-C++...64.exe
windows7-x64
7Visual-C++...64.exe
windows10-2004-x64
7Visual-C++...86.exe
windows7-x64
7Visual-C++...86.exe
windows10-2004-x64
7Visual-C++...64.exe
windows7-x64
7Visual-C++...64.exe
windows10-2004-x64
7Visual-C++...86.exe
windows7-x64
7Visual-C++...86.exe
windows10-2004-x64
7Visual-C++...64.exe
windows7-x64
7Visual-C++...64.exe
windows10-2004-x64
7Visual-C++...86.exe
windows7-x64
7Visual-C++...86.exe
windows10-2004-x64
7Visual-C++...64.exe
windows7-x64
7Visual-C++...64.exe
windows10-2004-x64
7Visual-C++...86.exe
windows7-x64
7Visual-C++...86.exe
windows10-2004-x64
7Visual-C++...64.exe
windows7-x64
7Visual-C++...64.exe
windows10-2004-x64
7Visual-C++...86.exe
windows7-x64
7Visual-C++...86.exe
windows10-2004-x64
7Visual-C++...64.exe
windows7-x64
7Visual-C++...64.exe
windows10-2004-x64
7Visual-C++...86.exe
windows7-x64
7Visual-C++...86.exe
windows10-2004-x64
7Visual-C++...��.txt
windows7-x64
1Visual-C++...��.txt
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 12:21
Static task
static1
Behavioral task
behavioral1
Sample
MKL_fishingSwitchCity_V3.0.rar
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
MKL_fishingSwitchCity_V3.0.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
FixTOOLLLLLLLLLLLLLLLLLL/FIX/VisualC.rar
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
FixTOOLLLLLLLLLLLLLLLLLL/FIX/VisualC.rar
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
Visual-C++/install_all.bat
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
Visual-C++/install_all.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
Visual-C++/vcredist2005_x64.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
Visual-C++/vcredist2005_x64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Visual-C++/vcredist2005_x86.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Visual-C++/vcredist2005_x86.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Visual-C++/vcredist2008_x64.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Visual-C++/vcredist2008_x64.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
Visual-C++/vcredist2008_x86.exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
Visual-C++/vcredist2008_x86.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Visual-C++/vcredist2010_x64.exe
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
Visual-C++/vcredist2010_x64.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
Visual-C++/vcredist2010_x86.exe
Resource
win7-20240419-en
Behavioral task
behavioral18
Sample
Visual-C++/vcredist2010_x86.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
Visual-C++/vcredist2012_x64.exe
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
Visual-C++/vcredist2012_x64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Visual-C++/vcredist2012_x86.exe
Resource
win7-20240611-en
Behavioral task
behavioral22
Sample
Visual-C++/vcredist2012_x86.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Visual-C++/vcredist2013_x64.exe
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
Visual-C++/vcredist2013_x64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Visual-C++/vcredist2013_x86.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
Visual-C++/vcredist2013_x86.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
Visual-C++/vcredist2015_2017_2019_x64.exe
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
Visual-C++/vcredist2015_2017_2019_x64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Visual-C++/vcredist2015_2017_2019_x86.exe
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
Visual-C++/vcredist2015_2017_2019_x86.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
Visual-C++/วิธีติดตั้ง.txt
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Visual-C++/วิธีติดตั้ง.txt
Resource
win10v2004-20240508-en
General
-
Target
Visual-C++/vcredist2005_x64.exe
-
Size
3.0MB
-
MD5
56eaf4e1237c974f6984edc93972c123
-
SHA1
ee916012783024dac67fc606457377932c826f05
-
SHA256
0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
-
SHA512
f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736
-
SSDEEP
49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
MsiExec.exepid process 1536 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vcredist2005_x64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x64.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll msiexec.exe -
Drops file in Windows directory 59 IoCs
Processes:
msiexec.exeDrvInst.exedescription ioc process File created C:\Windows\WinSxS\InstallTemp\20240619122539204.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.manifest msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240619122539204.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122538736.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539001.0\mfc80ENU.dll msiexec.exe File opened for modification C:\Windows\Installer\MSICAFF.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539001.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539251.1\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240619122538736.0 msiexec.exe File opened for modification C:\Windows\Installer\f76c6cb.ipi msiexec.exe File opened for modification C:\Windows\Installer\f76c6c8.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122538393.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539204.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539297.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240619122539266.0 msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\WinSxS\InstallTemp\20240619122538393.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539266.1\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240619122538393.0 msiexec.exe File created C:\Windows\Installer\f76c6cb.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539251.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122538736.0\mfc80u.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240619122539297.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122538283.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122538736.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539266.1\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\Installer\MSIF2DA.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539001.0\mfc80ESP.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240619122538283.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240619122539251.1 msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539001.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122538393.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122538736.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539001.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539204.0\vcomp.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539251.1\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122538393.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539001.0\mfc80CHS.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539001.0\mfc80JPN.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539001.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539297.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\Installer\f76c6cd.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122538736.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539001.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.manifest msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240619122539001.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240619122539266.1 msiexec.exe File created C:\Windows\Installer\f76c6c8.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122538736.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539266.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539266.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240619122539251.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539001.0\mfc80CHT.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539001.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122538283.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.cat msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\WinSxS\InstallTemp\20240619122538283.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122538393.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240619122539251.0\8.0.50727.6195.policy msiexec.exe -
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
-
Modifies data under HKEY_USERS 46 IoCs
Processes:
DrvInst.exemsiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe -
Modifies registry class 56 IoCs
Processes:
msiexec.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\PackageName = "vcredist.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0049004c005400540052005900320074004f005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\VC_Redist msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Assignment = "1" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\Servicing_Key msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Version = "134278728" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\PackageCode = "C558A51006735C645AEE5A0FC6A310C9" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\InstanceType = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 2704 msiexec.exe 2704 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid process Token: SeShutdownPrivilege 2172 msiexec.exe Token: SeIncreaseQuotaPrivilege 2172 msiexec.exe Token: SeRestorePrivilege 2704 msiexec.exe Token: SeTakeOwnershipPrivilege 2704 msiexec.exe Token: SeSecurityPrivilege 2704 msiexec.exe Token: SeCreateTokenPrivilege 2172 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2172 msiexec.exe Token: SeLockMemoryPrivilege 2172 msiexec.exe Token: SeIncreaseQuotaPrivilege 2172 msiexec.exe Token: SeMachineAccountPrivilege 2172 msiexec.exe Token: SeTcbPrivilege 2172 msiexec.exe Token: SeSecurityPrivilege 2172 msiexec.exe Token: SeTakeOwnershipPrivilege 2172 msiexec.exe Token: SeLoadDriverPrivilege 2172 msiexec.exe Token: SeSystemProfilePrivilege 2172 msiexec.exe Token: SeSystemtimePrivilege 2172 msiexec.exe Token: SeProfSingleProcessPrivilege 2172 msiexec.exe Token: SeIncBasePriorityPrivilege 2172 msiexec.exe Token: SeCreatePagefilePrivilege 2172 msiexec.exe Token: SeCreatePermanentPrivilege 2172 msiexec.exe Token: SeBackupPrivilege 2172 msiexec.exe Token: SeRestorePrivilege 2172 msiexec.exe Token: SeShutdownPrivilege 2172 msiexec.exe Token: SeDebugPrivilege 2172 msiexec.exe Token: SeAuditPrivilege 2172 msiexec.exe Token: SeSystemEnvironmentPrivilege 2172 msiexec.exe Token: SeChangeNotifyPrivilege 2172 msiexec.exe Token: SeRemoteShutdownPrivilege 2172 msiexec.exe Token: SeUndockPrivilege 2172 msiexec.exe Token: SeSyncAgentPrivilege 2172 msiexec.exe Token: SeEnableDelegationPrivilege 2172 msiexec.exe Token: SeManageVolumePrivilege 2172 msiexec.exe Token: SeImpersonatePrivilege 2172 msiexec.exe Token: SeCreateGlobalPrivilege 2172 msiexec.exe Token: SeBackupPrivilege 2724 vssvc.exe Token: SeRestorePrivilege 2724 vssvc.exe Token: SeAuditPrivilege 2724 vssvc.exe Token: SeBackupPrivilege 2704 msiexec.exe Token: SeRestorePrivilege 2704 msiexec.exe Token: SeRestorePrivilege 2996 DrvInst.exe Token: SeRestorePrivilege 2996 DrvInst.exe Token: SeRestorePrivilege 2996 DrvInst.exe Token: SeRestorePrivilege 2996 DrvInst.exe Token: SeRestorePrivilege 2996 DrvInst.exe Token: SeRestorePrivilege 2996 DrvInst.exe Token: SeRestorePrivilege 2996 DrvInst.exe Token: SeLoadDriverPrivilege 2996 DrvInst.exe Token: SeLoadDriverPrivilege 2996 DrvInst.exe Token: SeLoadDriverPrivilege 2996 DrvInst.exe Token: SeRestorePrivilege 2704 msiexec.exe Token: SeTakeOwnershipPrivilege 2704 msiexec.exe Token: SeRestorePrivilege 2704 msiexec.exe Token: SeTakeOwnershipPrivilege 2704 msiexec.exe Token: SeRestorePrivilege 2704 msiexec.exe Token: SeTakeOwnershipPrivilege 2704 msiexec.exe Token: SeRestorePrivilege 2704 msiexec.exe Token: SeTakeOwnershipPrivilege 2704 msiexec.exe Token: SeRestorePrivilege 2704 msiexec.exe Token: SeTakeOwnershipPrivilege 2704 msiexec.exe Token: SeRestorePrivilege 2704 msiexec.exe Token: SeTakeOwnershipPrivilege 2704 msiexec.exe Token: SeRestorePrivilege 2704 msiexec.exe Token: SeTakeOwnershipPrivilege 2704 msiexec.exe Token: SeRestorePrivilege 2704 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 2172 msiexec.exe 2172 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
vcredist2005_x64.exemsiexec.exedescription pid process target process PID 2392 wrote to memory of 2172 2392 vcredist2005_x64.exe msiexec.exe PID 2392 wrote to memory of 2172 2392 vcredist2005_x64.exe msiexec.exe PID 2392 wrote to memory of 2172 2392 vcredist2005_x64.exe msiexec.exe PID 2392 wrote to memory of 2172 2392 vcredist2005_x64.exe msiexec.exe PID 2392 wrote to memory of 2172 2392 vcredist2005_x64.exe msiexec.exe PID 2392 wrote to memory of 2172 2392 vcredist2005_x64.exe msiexec.exe PID 2392 wrote to memory of 2172 2392 vcredist2005_x64.exe msiexec.exe PID 2704 wrote to memory of 1536 2704 msiexec.exe MsiExec.exe PID 2704 wrote to memory of 1536 2704 msiexec.exe MsiExec.exe PID 2704 wrote to memory of 1536 2704 msiexec.exe MsiExec.exe PID 2704 wrote to memory of 1536 2704 msiexec.exe MsiExec.exe PID 2704 wrote to memory of 1536 2704 msiexec.exe MsiExec.exe PID 2704 wrote to memory of 1536 2704 msiexec.exe MsiExec.exe PID 2704 wrote to memory of 1536 2704 msiexec.exe MsiExec.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Visual-C++\vcredist2005_x64.exe"C:\Users\Admin\AppData\Local\Temp\Visual-C++\vcredist2005_x64.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 57B215765203FCD9C23C22D49FDE2EB22⤵
- Loads dropped DLL
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000049C" "00000000000004A4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5026636186cc29d55008f97d89e4b42a0
SHA16f8ee24000852c3dd319f19aad6fcb94a7fccdd2
SHA256270ef8300b22f1753c2834d219da3c945c4e1ca0f241f164947ed0dca679d50e
SHA51246264fd04ef7ae47d74bb87678700f26e5ceca0bf65e9bd0367a1a7ccae32e6c46a4ff37515fa5f2c817c9e4c84f2edf0406c1089f9403fd13591d1468c84267
-
C:\Users\Admin\AppData\Local\Temp\CabC735.tmpFilesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cabFilesize
312KB
MD577a9bff5af149160775741e204734d47
SHA17b5126af69b5a79593f39db94180f1ff11b0e39d
SHA25620a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038
SHA512bb0440f58f07e113bddd9a0afb5aab8af6493218784fe5fa6f4032e3a37088f91b7e766dee87cec4a9ea11d425d27b3b536430de3a52222e8bca3e0247d81e3b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msiFilesize
3.0MB
MD56dbdf338a0a25cdb236d43ea3ca2395e
SHA1685b6ea61e574e628392eaac8b10aff4309f1081
SHA256200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
SHA5126b5b31c55cf72ab92b17fb6074b3901a1e6afe0796ef9bc831e4dfb97450376d2889cd24b1cf3fce60eb3c1bcd1b31254b5cfa3ef6107974dfa0b35c233daf5a
-
C:\Windows\Installer\MSICAFF.tmpFilesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d