4b4bb4d19fb639e5698983e39d7ad061c7667bcec19056560532c7ad0d67d0e4

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PlantsVsZombiesSetup_instalador.exe
Size

40.8MB
MD5

95c188d0e4bff425431bcdfd49d06d25
SHA1

c46979be135ef1c486144fa062466cdc51b740f5
SHA256

4b4bb4d19fb639e5698983e39d7ad061c7667bcec19056560532c7ad0d67d0e4
SHA512

804943b85f968cea2cbc9f0f7a2d55c5d53d00d777e251f6662c60172a3bd8017c4de6ce17d25f58dd8d3031f86f025727f7fa31859eeb50b755a2f61570c839
SSDEEP

786432:kz5Jx9wem1r+qHk/rYmfZ6f8/39RsAaZh9BLTtYHmc9iLMnH:kz5Jzi0ZfZP9iAsBLBYHv6eH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	PlantsVsZombiesSetup_instalador.exe

Executes dropped EXE 2 IoCs

pid	Process
1224	vcredist_x86.exe
1584	install.exe

Loads dropped DLL 1 IoCs

pid	Process
1584	install.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PopCap Games\Plants vs. Zombies\Install.log	PlantsVsZombiesSetup_instalador.exe
File created	C:\Program Files (x86)\PopCap Games\Plants vs. Zombies\Install_props.xml	PlantsVsZombiesSetup_instalador.exe
File opened for modification	C:\Program Files (x86)\PopCap Games\Plants vs. Zombies\Install_props.xml	PlantsVsZombiesSetup_instalador.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\InstallTemp\20240708054433049.0\mfc90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433018.0\9.0.21022.8.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.1\9.0.30729.1.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708054433096.1	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433033.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.0\mfc90ita.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.0\mfc90rus.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433002.0\vcomp90.dll	msiexec.exe
File created	\??\c:\Windows\Installer\$PatchCache$\Managed\D20352A90C039D93DBF6126ECE614057\9.0.30729\FL_msdia71_dll_2_60035_x86_ln.3643236F_FC70_11D3_A536_0090278A1BB8	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708054433002.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433002.0\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.0\mfc90kor.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433033.0\msvcp90.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B1.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433080.0\9.0.30729.1.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.0\mfc90chs.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433033.0\msvcr90.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708054433033.0	msiexec.exe
File created	\??\c:\Windows\Installer\e57ff40.msi	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\D20352A90C039D93DBF6126ECE614057	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9A25302D-30C0-39D9-BD6F-21E6EC160475}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.0\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708054433064.1	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433096.0\9.0.30729.1.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433096.1\9.0.30729.1.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.0\mfc90deu.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433049.0\mfcm90.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\e57ff40.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433002.0\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054432971.0\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433033.0\msvcm90.dll	msiexec.exe
File created	\??\c:\Windows\Installer\e57ff44.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433049.0\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.0\mfc90esp.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.0\mfc90jpn.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.0\mfc90cht.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.0\mfc90esn.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433049.0\mfc90u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433049.0\mfcm90u.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708054433018.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054432971.0\atl90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433080.0\9.0.30729.1.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.0\mfc90fra.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433096.1\9.0.30729.1.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708054433049.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433033.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.0\mfc90enu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\D20352A90C039D93DBF6126ECE614057\9.0.30729\FL_msdia71_dll_2_60035_x86_ln.3643236F_FC70_11D3_A536_0090278A1BB8	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054432971.0\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.0\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03.manifest	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\D20352A90C039D93DBF6126ECE614057\9.0.30729	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708054433096.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433018.0\9.0.21022.8.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433049.0\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433096.0\9.0.30729.1.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708054433080.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708054433064.1\9.0.30729.1.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708054432971.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708054433064.0	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e00390032002c002b004b006e00240039002e0037006d0024006f0066007000790021004b007400620000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFC,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004d00460043005f007800380036003e004d0072004e0075004700740065007d0054003400240066006f0062004f005000340040004d004d0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.OpenMP,version="9.0.21022.8",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e004d004f00700050006d00360078002b0044003400700061006d006600580031006f00390032007a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41A387AA3A7A33D3590FA953D1350011	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.ATL,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e007900590067002500610066004a005700640037003800700038006d007200570035002b004d00660000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41A387AA3A7A33D3590FA953D1350011	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFCLOC,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800380036003e0063002e00410078003f007d0058003200710034003900530045006800470072004b0038007400360000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\Version = "151025673"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\FT_VC_Redist_MFC_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\PackageName = "vc_red.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\FT_VC_Redist_ATL_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\LastUsedSource = "n;1;c:\\f4a22d103f410b0db49b663373\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Media\1 = ";1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e006b0027005600490037006f00520050007e00370055003d006f0029006d00730026002c003300420000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFC,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004d00460043005f007800380036003e0049004000790043006a0027006200720045003400710030004c0044006f0059004c007e006600580000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\AuthorizedLUAApp = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.ATL,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e006500720069002d002e003800540052004600340074006d00310053006a006d00350059005d00380000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\PackageCode = "6C7E9C94F9A4F6E4EA39E910D4A1AC39"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41A387AA3A7A33D3590FA953D1350011\D20352A90C039D93DBF6126ECE614057	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Net\1 = "c:\\f4a22d103f410b0db49b663373\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\ProductName = "Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFCLOC,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800380036003e0040006500650034004900600034006b0069003500590047006500590051006300340025007700780000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\VC_RED_enu_x86_net_SETUP	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.21022.8",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e004d0039002c004f005500350063004d0078003400660069003f00660040007b00300021004400480000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\FT_VC_Redist_MFCLOC_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\VC_Redist_12222_x86_enu	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\FT_VC_Redist_CRT_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\FT_VC_Redist_OpenMP_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1964	PlantsVsZombiesSetup_instalador.exe
1964	PlantsVsZombiesSetup_instalador.exe
4104	msiexec.exe
4104	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1584	install.exe
Token: SeIncreaseQuotaPrivilege	1584	install.exe
Token: SeSecurityPrivilege	4104	msiexec.exe
Token: SeCreateTokenPrivilege	1584	install.exe
Token: SeAssignPrimaryTokenPrivilege	1584	install.exe
Token: SeLockMemoryPrivilege	1584	install.exe
Token: SeIncreaseQuotaPrivilege	1584	install.exe
Token: SeMachineAccountPrivilege	1584	install.exe
Token: SeTcbPrivilege	1584	install.exe
Token: SeSecurityPrivilege	1584	install.exe
Token: SeTakeOwnershipPrivilege	1584	install.exe
Token: SeLoadDriverPrivilege	1584	install.exe
Token: SeSystemProfilePrivilege	1584	install.exe
Token: SeSystemtimePrivilege	1584	install.exe
Token: SeProfSingleProcessPrivilege	1584	install.exe
Token: SeIncBasePriorityPrivilege	1584	install.exe
Token: SeCreatePagefilePrivilege	1584	install.exe
Token: SeCreatePermanentPrivilege	1584	install.exe
Token: SeBackupPrivilege	1584	install.exe
Token: SeRestorePrivilege	1584	install.exe
Token: SeShutdownPrivilege	1584	install.exe
Token: SeDebugPrivilege	1584	install.exe
Token: SeAuditPrivilege	1584	install.exe
Token: SeSystemEnvironmentPrivilege	1584	install.exe
Token: SeChangeNotifyPrivilege	1584	install.exe
Token: SeRemoteShutdownPrivilege	1584	install.exe
Token: SeUndockPrivilege	1584	install.exe
Token: SeSyncAgentPrivilege	1584	install.exe
Token: SeEnableDelegationPrivilege	1584	install.exe
Token: SeManageVolumePrivilege	1584	install.exe
Token: SeImpersonatePrivilege	1584	install.exe
Token: SeCreateGlobalPrivilege	1584	install.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe
Token: SeRestorePrivilege	4104	msiexec.exe
Token: SeTakeOwnershipPrivilege	4104	msiexec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1224	1964	PlantsVsZombiesSetup_instalador.exe	83
PID 1964 wrote to memory of 1224	1964	PlantsVsZombiesSetup_instalador.exe	83
PID 1964 wrote to memory of 1224	1964	PlantsVsZombiesSetup_instalador.exe	83
PID 1224 wrote to memory of 1584	1224	vcredist_x86.exe	86
PID 1224 wrote to memory of 1584	1224	vcredist_x86.exe	86
PID 1224 wrote to memory of 1584	1224	vcredist_x86.exe	86

C:\Users\Admin\AppData\Local\Temp\PlantsVsZombiesSetup_instalador.exe
"C:\Users\Admin\AppData\Local\Temp\PlantsVsZombiesSetup_instalador.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\popcfg2\vcredist_x86.exe
  "C:\Users\Admin\AppData\Local\Temp\popcfg2\vcredist_x86.exe" /q
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1224
- - \??\c:\f4a22d103f410b0db49b663373\install.exe
    c:\f4a22d103f410b0db49b663373\.\install.exe /q
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1584

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\VWL961.tmp

Filesize
392B

MD5
47656b40b038a6f4c24d3d9c75579289

SHA1
7c5d889877351702e34a54101e7c8b9de6a21184

SHA256
507e95dc43a4d8aab175913a778887081d0de691f4b1f0f1604946c139d5cde3

SHA512
2047ec1cf67a3dde767a179f0653d4b230987aa5b3dd9eac0ac70a5ec8328d3adc28442263da0ca832530ff02a1cfa4dcf1d21fe166b5c9b75dff52558de16e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI4FE3.txt

Filesize
1KB

MD5
cb4bb8eb0a9547e88431d0cb4b3a7c8c

SHA1
63f61ff0b7565ac060e35ce5e7ed1d7498a32ffc

SHA256
a1c50e0a09d35baa36d56c0316d8b20ebbc49dfe4a6b5e6b6560d1d15949f0c7

SHA512
3e48d3698bc65be21c7aeb159209ec8824c405ca1cf04286c8449793264abe55b33349c603d50f3a1ad8fdd65740d5fbcf8bf2514a6a3cc3dfaa2c177daf8ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\popcfg2\defines.xml

Filesize
1KB

MD5
cdaaebdfd3ef6bab4ee3638907902d49

SHA1
3b4e6316c89e1a24643e512d60118498c9c79853

SHA256
8ef0ec424b2a86f718829c67254f9f3cb14a750f72b9d2b711761bf6635cac3f

SHA512
ca125b8079058b2b0e3fdee38c758c8807738a0556293074a269ae018f4a8cb2aabe1ccadc0b2b3355144c897e8d6bfe6cbf667958d7ec76a0a68f83b50ce9ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\popcfg2\eula.rtf

Filesize
52KB

MD5
977e662aa64f82e18254938fc04e1cc4

SHA1
d33c0842896d8089037efb5b4924b7b12b5ebe3d

SHA256
5fe1559110c4cf1a53256bdb3d93ad9387295198530405b7d7ea1280c217ec2f

SHA512
90417e5ac7e7f4d1ce1d3d53972f5bdb58f0a57e6aeefb00ad85079991071e9f91a6a8468650e124583a4f5a59df181cde668e5d3aa3565ceb0235cd833ad45a

Download Submit
C:\Users\Admin\AppData\Local\Temp\popcfg2\install.xml

Filesize
3KB

MD5
ffae67978e87e939553b867210fa6f79

SHA1
0a3f34219055896a55ee97ebbb4a4ca30b5cb6f4

SHA256
ff0c1899d234fd0300e6953cc4202495db0b3f540c7131671e7e61f73671b165

SHA512
93f5f9d378ba434ea01748abe207ded9f3bc3c4a91945c536754f7a2a114d32e05a0b175c6172dd1d92dfeb0be7339d438e6e9d56640a025b74eede5e98d2931

Download Submit
C:\Users\Admin\AppData\Local\Temp\popcfg2\logo.bmp

Filesize
24KB

MD5
1843d66328cedc1ce60cb98f3d593f4a

SHA1
d84a82214e498123609a13aa54164f972776d33a

SHA256
7f3e2f0ec8926e7911fe024271387657adf8bda95581c6235f995be57ff56ea1

SHA512
f1fa3aa6a62c868d69d17b6ab5e5cb39e4099f971c84c16f6857c6202016ad9104a5f2e188e8721be5ac3ab43c4bc45122e84fff473e4913aed60b4fa3e8c8c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\popcfg2\product.bmp

Filesize
19KB

MD5
967b5522d0a7e6c3864cc7239d0e2ba5

SHA1
b59c6c8b92ccfd270e003818c185a2ab556b14d9

SHA256
a46e016098d2322fdcb130e10f73e9c55195719623b7f1889edb5dba229e23c3

SHA512
c9f1f2f425fd3c5541aa5dc0944044923b7417755c3411cc6e50d14982b35a0c785a5c619f0cebcdcf32c9b049f8090b76bd3cb6adc78fe2f5e2df3a82972a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\popcfg2\props.xml

Filesize
6KB

MD5
ed1a4daf65608f02a8bd5a1bb2e19ac6

SHA1
496643241d51f5347f53fc176c69858b65febe6a

SHA256
b0d21cd683d0982eff52f5fe42d8841377110806a2fd1b1d09ea7ccc1893fd14

SHA512
8998362f9fc37dbd535d3cd248aaa43abcbcdfc4dbee308890f41f0ca62073d7658ee398497f15e44a8ea0116a820ea6bf2b57bd7f2baebdf05bd46f49f72606

Download Submit
C:\Users\Admin\AppData\Local\Temp\popcfg2\vcredist_x86.exe

Filesize
4.0MB

MD5
5689d43c3b201dd3810fa3bba4a6476a

SHA1
6939100e397cef26ec22e95e53fcd9fc979b7bc9

SHA256
41f45a46ee56626ff2699d525bb56a3bb4718c5ca5f4fb5b3b38add64584026b

SHA512
4875134c664503242ec60717232f2917edca20286fc4b675223edbbe5dc0239ebfaf8f67edd76fedcaa2be5419490dc6f47930ca260e6c9988ccf242416c204b

Download Submit
C:\f4a22d103f410b0db49b663373\install.exe

Filesize
549KB

MD5
33c9213ff5849ef7346799cae4d8ac80

SHA1
5421169811570171e9d2d0a1cdca9665273e7b59

SHA256
3377e31d233ff41aea253e6221815820997763acdf40b005f8791400366cb8ff

SHA512
da0fc3f57156e06c0c37c1fb5176e1b147ce4aa21f519112123722496b04ad4bc3d366e2b51fd78de1ba0304d35bfd5e5fc95cabc2b3eb174f77636a8fa162a1

Download Submit
\??\c:\f4a22d103f410b0db49b663373\VC_RED.cab

Filesize
3.7MB

MD5
ecca3c1acb74cb73c600eabdd3f9c9d9

SHA1
f015759f623c377494a5996670204f1fcd0895e3

SHA256
43b7648183347374236296f2176c7c7da920da9c1a08adda761e12614efb299e

SHA512
2785b8e8cfc310ec114cee696c5b85900fc71186dcbf0c99a9c13f4f0fdcc9e9dd583c9d1fd82492a680efcd7071c3593b02b628bd947bc19b1302b931aca807

Download Submit
\??\c:\f4a22d103f410b0db49b663373\eula.1028.txt

Filesize
3KB

MD5
f187c4924020065b61ec9ef8eb482415

SHA1
280fc99fb90f10a41461a8ee33dbfba5f02d059d

SHA256
cfa4f2c6c2a8f86896c5a6f9a16e81932734136c3dfde6b4ed44735e9c8115c2

SHA512
1d5a8e80fb6805577258f87c4efd7c26a9ac1c69f7dea1553d6f26bcc462d2d9c01d4b94077f70110a33b39648c9aa3bb685e10534f19ba832d475e9ee6aa743

Download Submit
\??\c:\f4a22d103f410b0db49b663373\eula.1031.txt

Filesize
15KB

MD5
3168ed3b48c1dc8d373c2abc036574cf

SHA1
7ffbcfb6cd9b262a0e9a55853d76055693f60c60

SHA256
3e4d78fcc11eecb23af12a4eaa316114bb36d39561f6062a3921c08a43261321

SHA512
9465640705c382bb736e468a2ffb303ecfb2637c55ddca759d1fb190279b98103def64a8c599deaa1439e58c41d7b2c2809332c2a5f18945e9ee3d6c046a5197

Download Submit
\??\c:\f4a22d103f410b0db49b663373\eula.1033.txt

Filesize
9KB

MD5
162fc8231b1bd62f1d24024bb70140d5

SHA1
7fa4601390f1a69b4824ee1334bee772c2941a24

SHA256
c68a0fd93e8c64139a42af4fcd4670c6faea3a5d5d1e9dd35b197f7d5268d92b

SHA512
a707b5ef0e914ba61e815be5224831441922ed8d933f7a2ffe8aecf41f5a1790a1e45981f19d86aa5eab5ea73d03b0c8e2ab6b9f398ab0154d1c828da6f6beda

Download Submit
\??\c:\f4a22d103f410b0db49b663373\eula.1036.txt

Filesize
11KB

MD5
c360851dfdf51b6ddc9cfcc62c584898

SHA1
f8fbe6b98039d01700dc49eb454bb1c1d8cc4aa6

SHA256
3456ebc9c6decef8b27b10d97f7f6d30a73b5da0024e1b8a0657e3b9a1cc93d9

SHA512
a340a7d98b4b6f925a803805224e733433e76230a36c4ab17e28f9d5951b81280d776153414701b29bb05b496b726932683e35fb603587d7ff5b716a88fece8d

Download Submit
\??\c:\f4a22d103f410b0db49b663373\eula.1040.txt

Filesize
13KB

MD5
04b833156f39fcc4cee4ae7a0e7224a1

SHA1
2ffa9577a21962532c26819f9f1e8cd71ab396bd

SHA256
ebafaeb37464ed00e579dab5b573908e026cd0e3444079f398aada13fa9a6f66

SHA512
8d3f6a900ebd63a3af74ab41ac54d3041de5fe47331a5e0d442d1707f72a8f557d93d2f527bbb857fb1c67dd8332961fd69acc87de81ba4f2006c37b575f9608

Download Submit
\??\c:\f4a22d103f410b0db49b663373\eula.1041.txt

Filesize
5KB

MD5
031fab3fb14a85334e7e49d62a5179fe

SHA1
12370185ef938a791609602245372e3e70db31be

SHA256
467773ddffdb3f31027595313b70d1ea934c828b124d1063a4aa4dbe90f15961

SHA512
7424a52bbb18a006816ee544d47f660e086557d13bb587d765631307da96aba56d8b9cd3d4e7d50c2a791815273910cef95ebe928bc03dd9c540b97ac7a86447

Download Submit
\??\c:\f4a22d103f410b0db49b663373\eula.1042.txt

Filesize
5KB

MD5
6fcd6b5ef928a75655d6be51555288c7

SHA1
eafdcc178343780b83f1280dad9d517aaedab9e4

SHA256
3d45f022996cd6d9ebb659a202fbfd099795f9a39ed4e6bbd62ac6f6ed5f8c7b

SHA512
635ba44d8d8ecfbdb83a88688126f68c9c607e452e67d19247dfe7c307c341dad9b1d2dc3eae56311c4b3e9617ab1ee2bd2a908570df632af6de1e1fa08bf905

Download Submit
\??\c:\f4a22d103f410b0db49b663373\eula.1049.txt

Filesize
13KB

MD5
bc3a8865b60ec692293679e3e400fd58

SHA1
2b43b69e6158f307fb60c47a70a606cd7e295341

SHA256
f82bca639841fa7387ae9bbf9eca33295fab20fade57496e458152068c06f8a3

SHA512
0d9820416802623e7cd5539d75871447f665481b81758c08f392f412bc0fd2ef12008be0960c108d1c1ce6f26422f1b16161705104d7a582df6a1006b0d1b610

Download Submit
\??\c:\f4a22d103f410b0db49b663373\eula.2052.txt

Filesize
3KB

MD5
ec4b365a67e7d7db46f095f1b3dcb046

SHA1
d4506530b132ef4aad51fcbc0315dadc110c9b81

SHA256
744275c515354ece1a997dd510f0b3ea607147bbf2b7d73f8fca61839675ba27

SHA512
5e5d1e196fc6ac194589bc6c6ab24e259aed8cbd856999390495fd5ec4211f212c6898e1b63538bfbb4401a5b4da08f3a2e09bca1cfb2e9c2cee38e63190b2a2

Download Submit
\??\c:\f4a22d103f410b0db49b663373\eula.3082.txt

Filesize
12KB

MD5
c2d1221cd1c783b5d58b150f2d51aebf

SHA1
3bc9b6419a5f9dcf9064ae9ef3a76c699e750a60

SHA256
c79ff7b9e67aed57f939343a3d5fd4fb01aa7412530693464571148b893b7132

SHA512
c4ec596814b408e3c0aaf98864e2769c6175dba020f3014dd79f0190d81812020c932afca449e6b8b35233f36f2ab2efad0dc8d0d68dccdb40f6715fb1d050b4

Download Submit
\??\c:\f4a22d103f410b0db49b663373\globdata.ini

Filesize
1KB

MD5
0a6b586fabd072bd7382b5e24194eac7

SHA1
60e3c7215c1a40fbfb3016d52c2de44592f8ca95

SHA256
7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

SHA512
b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

Download Submit
\??\c:\f4a22d103f410b0db49b663373\install.ini

Filesize
844B

MD5
5feaa6a36fea7dfdb88c18d69ba6d6a9

SHA1
7afd91a7b046d68b6ee9fd367bcd7a4fec546216

SHA256
67a50ffbb8a1d500eaa4d9f0227d6a8595a2750154e6b31662fc4f51286e47fc

SHA512
6c8c0456f232a02a49d51b3f1a830a18b9078e621cd0dc3f4f76f79b83035e8affac67bce3af9a37fa9096a34a8499c59cf982b63a4b2400b9190d2db293e682

Download Submit
\??\c:\f4a22d103f410b0db49b663373\install.res.1028.dll

Filesize
74KB

MD5
5e7e93fb7b9d36665b10be97703dafe5

SHA1
17b42892768e9742920febf70e9214997e3f04ef

SHA256
b8f0f576199e32fd906538537c8da052ee666a91ef971c577a53fd715e544604

SHA512
8f2828606ae34a691be77cdc5dc20f3aeb641bb24742fac04860a6f847c42cdc8453b8e5f9722f7b016438849c2b57fc8ea9b41111b69ffed30624e16824a1d6

Download Submit
\??\c:\f4a22d103f410b0db49b663373\install.res.1031.dll

Filesize
94KB

MD5
a1157142485b86985c03e26add533201

SHA1
05320791cdf33ff3a9989396f6b54172b2d7d0ee

SHA256
94779d2272a18a0340156225485aab95d0473aef478442dfe392d11b7e6f41db

SHA512
3fa2b3c4c57e071f24cdd02fc53dca5206370c8161cd9ba7b95fa8a9bce9e5268f3f7824908f93df7a087afd38425219447339f40908ffc9b1d593d063ae21c1

Download Submit
\??\c:\f4a22d103f410b0db49b663373\install.res.1033.dll

Filesize
89KB

MD5
8e97ea8a1ed69806232e8743f9a28706

SHA1
e911d3802e64f9be0e1ac68865bbcc92624d6a1f

SHA256
2893b1b9751f833d4a3ded7c1fba1a96cada2927a2349c5d751365eed647c100

SHA512
aa57fe0b822145aa1d8eb72f9735ef5d92036f24c4c80392799d701447d18ea510331f5653b39c43dc923cd0f1a61bf87be0f8a4927f6e3754d19ac76fd443c3

Download Submit
\??\c:\f4a22d103f410b0db49b663373\install.res.1036.dll

Filesize
94KB

MD5
cbf6e77d932688970a28328ca5263501

SHA1
b1d469e921ba90df15760943f228ebb2cbc55792

SHA256
3ffe888bc0bbe9bb81369b49171d532839fbea931d8553371e857df6ef815c13

SHA512
eeb2773960f7ecf9e87b5225cc730651388fab7dadda766a38d345f051ce2cab7027ac6c7286092e86f71c67b8c8a8c01c3808f205082280ad051fcba96358c9

Download Submit
\??\c:\f4a22d103f410b0db49b663373\install.res.1040.dll

Filesize
93KB

MD5
dcca7196203d338b41ead5e1418c6a92

SHA1
44267accc8577f093abc77dff8d5f7ff25c343b2

SHA256
c2a81077da2201d180bd5496129ea6bcfc5930d8a6d256babdb9a552b1a597d2

SHA512
13e934786445067be1c9eca38587dc55e294b2df6e1a16d13c584dc3c031126314047c007ecbc4548aa9bbe1f1021f19cd6b639fc66f43ef9465f4c4c10df049

Download Submit
\??\c:\f4a22d103f410b0db49b663373\install.res.1041.dll

Filesize
79KB

MD5
0fcc2f2bf7c18392514413a3c2a5ec5a

SHA1
bf7f494336589b8763b0936f0558749dbb407c4b

SHA256
11c111b3f24ba7d197007fb572b9f77e7d6f58c290de239a08f287c2aeb3b89d

SHA512
c704d1264fd2a106487baf87f6db054862bb31576b0716fe1570eca46ba90519c23c3246852c6b33ec1cf1fc6ff1529b163ff38ec9d32c5eb588585545fcb596

Download Submit
\??\c:\f4a22d103f410b0db49b663373\install.res.1042.dll

Filesize
78KB

MD5
d276d0c01bf44cb781ff5d293676674b

SHA1
f96e3a9bbac867b4dd9b24312845a852a5b44ed4

SHA256
d6f45cb0308e3790b0d819cae9d87e61d79468414ce7f78bd41e7289fc832945

SHA512
46100a058157b8435633bf0fc6a2c92086d74c60e480e0faa016e7aaba848e16c2431e48b83e738c28e3a393592ff6cc27b7a2c2a55ff6d94494cf83686175c7

Download Submit
\??\c:\f4a22d103f410b0db49b663373\install.res.1049.dll

Filesize
91KB

MD5
2e57ae4186f17be4148077ffe8212a27

SHA1
edad955ab3deef258c354d134b5a3443369f85f8

SHA256
ac9ef02d54eb87a5bc2bc8c77a6497853072ff37e7e82495ef8d79f6a5af07e3

SHA512
b2f239253866aab26cb1ab8a90f89ff90553cdb5897bba2ebf0e08eefb5a975c68bf7904f15b09e33777718478e3cc1a074dff8d8ddacc8a56b675adf125443b

Download Submit
\??\c:\f4a22d103f410b0db49b663373\install.res.2052.dll

Filesize
74KB

MD5
4b8d230ccfadf8a2d3ea4b1512238292

SHA1
53793dde6106277c33367de5cf361f79a52692c2

SHA256
8fec53f664217f624ec8229425abde74225eccf6b55e41d4c12c9d9789f4159c

SHA512
10993d5ca2b40060ba5925e8d7c008d028c06d909cb3b3a8f8da6a289e2cd45b95227114115e7ab6bed7fc91601d94c5b3c1a9d44e08850dc3048e4e9d51423d

Download Submit
\??\c:\f4a22d103f410b0db49b663373\install.res.3082.dll

Filesize
94KB

MD5
55a9b25fa0d768fb902842439d041b1f

SHA1
da103afd92af9b6f89b604191db2805a015a8c38

SHA256
8f826dba565fc464395ed24219da946f55692705de9f61f501dcfebf338970a3

SHA512
dc1b1dc345cb0e2e7e055abc07fc1374abbf773afae64fc27db292c5b97a166bfe4eaa69188d6831a91bfa2913c2238277a860a098ee9606b4112cba55067f7d

Download Submit
\??\c:\f4a22d103f410b0db49b663373\vc_red.msi

Filesize
227KB

MD5
6e17361f8e53b47656bcf0ed90ade095

SHA1
bce290a700e31579356f7122fb38ce3be452628a

SHA256
8811e5fe167223d906701bc8deb789de0a731e888e285834bcae164b03d43c96

SHA512
a566fc8bbb4d354db32f13de2fde73a1210c61b1c30a1be22b16c7e98b8d51c673259c57a924b04035cb9f0bf4a087a3e8b32221e7ff87032cddc840ffe3ed2f

Download Submit
\??\c:\f4a22d103f410b0db49b663373\vcredist.bmp

Filesize
5KB

MD5
06fba95313f26e300917c6cea4480890

SHA1
31beee44776f114078fc403e405eaa5936c4bc3b

SHA256
594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1

SHA512
7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd

Download Submit