Overview
overview
7Static
static
3Microsoft ...up.dll
windows7-x64
4Microsoft ...up.dll
windows10-2004-x64
4Microsoft ...32.dll
windows7-x64
4Microsoft ...32.dll
windows10-2004-x64
4Microsoft ...te.dll
windows7-x64
3Microsoft ...te.dll
windows10-2004-x64
3Microsoft ...up.exe
windows7-x64
7Microsoft ...up.exe
windows10-2004-x64
7Microsoft ...ll.bat
windows7-x64
7Microsoft ...ll.bat
windows10-2004-x64
7Microsoft ...64.exe
windows7-x64
7Microsoft ...64.exe
windows10-2004-x64
7Microsoft ...86.exe
windows7-x64
3Microsoft ...86.exe
windows10-2004-x64
3Microsoft ...64.exe
windows7-x64
7Microsoft ...64.exe
windows10-2004-x64
7Microsoft ...86.exe
windows7-x64
7Microsoft ...86.exe
windows10-2004-x64
7Microsoft ...64.exe
windows7-x64
7Microsoft ...64.exe
windows10-2004-x64
7Microsoft ...86.exe
windows7-x64
7Microsoft ...86.exe
windows10-2004-x64
7Microsoft ...64.exe
windows7-x64
7Microsoft ...64.exe
windows10-2004-x64
7Microsoft ...86.exe
windows7-x64
7Microsoft ...86.exe
windows10-2004-x64
7Microsoft ...64.exe
windows7-x64
7Microsoft ...64.exe
windows10-2004-x64
7Microsoft ...86.exe
windows7-x64
7Microsoft ...86.exe
windows10-2004-x64
7Microsoft ...64.exe
windows7-x64
7Microsoft ...64.exe
windows10-2004-x64
7Analysis
-
max time kernel
92s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2024 12:14
Static task
static1
Behavioral task
behavioral1
Sample
Microsoft DirectX/dsetup.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Microsoft DirectX/dsetup.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Microsoft DirectX/dsetup32.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Microsoft DirectX/dsetup32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Microsoft DirectX/dxupdate.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Microsoft DirectX/dxupdate.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Microsoft DirectX/dxwsetup.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Microsoft DirectX/dxwsetup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Microsoft Visual C++/install_all.bat
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Microsoft Visual C++/install_all.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Microsoft Visual C++/vcredist2005_x64.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
Microsoft Visual C++/vcredist2005_x64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Microsoft Visual C++/vcredist2005_x86.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Microsoft Visual C++/vcredist2005_x86.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Microsoft Visual C++/vcredist2008_x64.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
Microsoft Visual C++/vcredist2008_x64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Microsoft Visual C++/vcredist2008_x86.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
Microsoft Visual C++/vcredist2008_x86.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Microsoft Visual C++/vcredist2010_x64.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Microsoft Visual C++/vcredist2010_x64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Microsoft Visual C++/vcredist2010_x86.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
Microsoft Visual C++/vcredist2010_x86.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Microsoft Visual C++/vcredist2012_x64.exe
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
Microsoft Visual C++/vcredist2012_x64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Microsoft Visual C++/vcredist2012_x86.exe
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Microsoft Visual C++/vcredist2012_x86.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Microsoft Visual C++/vcredist2013_x64.exe
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
Microsoft Visual C++/vcredist2013_x64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Microsoft Visual C++/vcredist2013_x86.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Microsoft Visual C++/vcredist2013_x86.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Microsoft Visual C++/vcredist2015_x64.exe
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
Microsoft Visual C++/vcredist2015_x64.exe
Resource
win10v2004-20240802-en
General
-
Target
Microsoft Visual C++/install_all.bat
-
Size
952B
-
MD5
d9ea81387ab9eda9ca3d6b5abc617877
-
SHA1
6d0a1ed13d2e7e14bce51993e6e59e433ad58e86
-
SHA256
84e57c95fb1c5364cff4444fac99629d9c780b4cbbb693878ca559c697e85715
-
SHA512
94ede29821e7c4da1b46cb879c552fd7bb57b04cc010022d7b1a55ef313e2cfd528cbcde614097c48864fd540b8f06172da35ac19ae4d057ea5c071742398720
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
Processes:
VCREDI~2.EXEinstall.exeinstall.exeSetup.exeSetup.exevcredist2015_x86.exevcredist2015_x64.exepid process 4668 VCREDI~2.EXE 3420 install.exe 4676 install.exe 3000 Setup.exe 692 Setup.exe 3044 vcredist2015_x86.exe 4884 vcredist2015_x64.exe -
Loads dropped DLL 23 IoCs
Processes:
MsiExec.exeMsiExec.exeinstall.exeinstall.exeSetup.exeSetup.exevcredist2012_x86.exevcredist2012_x64.exevcredist2013_x86.exevcredist_x86.exevcredist2013_x64.exevcredist_x64.exevcredist2015_x86.exevcredist2015_x64.exepid process 3048 MsiExec.exe 1044 MsiExec.exe 1044 MsiExec.exe 3420 install.exe 4676 install.exe 3000 Setup.exe 3000 Setup.exe 3000 Setup.exe 3000 Setup.exe 3000 Setup.exe 692 Setup.exe 692 Setup.exe 692 Setup.exe 692 Setup.exe 692 Setup.exe 1856 vcredist2012_x86.exe 3812 vcredist2012_x64.exe 636 vcredist2013_x86.exe 3016 vcredist_x86.exe 4492 vcredist2013_x64.exe 3964 vcredist_x64.exe 3044 vcredist2015_x86.exe 4884 vcredist2015_x64.exe -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
VCREDI~2.EXEvcredist2012_x86.exevcredist2012_x64.exevcredist2013_x86.exevcredist2013_x64.exevcredist2005_x86.exevcredist2005_x64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" VCREDI~2.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} = "\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_x86_20240805121717.log\" /passive /norestart ignored /burn.runonce" vcredist2012_x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20240805121718.log\" /passive /norestart ignored /burn.runonce" vcredist2012_x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece} = "\"C:\\ProgramData\\Package Cache\\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\\vcredist_x86.exe\" /burn.runonce" vcredist2013_x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7} = "\"C:\\ProgramData\\Package Cache\\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\\vcredist_x64.exe\" /burn.runonce" vcredist2013_x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Drops file in System32 directory 64 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\SysWOW64\mfc100cht.dll msiexec.exe File opened for modification C:\Windows\system32\mfc100jpn.dll msiexec.exe File created C:\Windows\system32\msvcp120.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc120kor.dll msiexec.exe File created C:\Windows\system32\vcomp120.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm120.dll msiexec.exe File created C:\Windows\SysWOW64\mfc120ita.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm120.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc120cht.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120chs.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100ita.dll msiexec.exe File opened for modification C:\Windows\system32\atl100.dll msiexec.exe File opened for modification C:\Windows\system32\vcomp120.dll msiexec.exe File created C:\Windows\system32\mfc120fra.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\atl100.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100esn.dll msiexec.exe File opened for modification C:\Windows\system32\mfc100deu.dll msiexec.exe File created C:\Windows\system32\msvcr120.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120.dll msiexec.exe File created C:\Windows\system32\mfc120enu.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100chs.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100fra.dll msiexec.exe File opened for modification C:\Windows\system32\mfc100cht.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc120jpn.dll msiexec.exe File created C:\Windows\SysWOW64\mfc120.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120esn.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm120u.dll msiexec.exe File created C:\Windows\system32\mfc120esn.dll msiexec.exe File created C:\Windows\system32\mfc120rus.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp120.dll msiexec.exe File opened for modification C:\Windows\system32\mfc100u.dll msiexec.exe File created C:\Windows\SysWOW64\vccorlib120.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc120esn.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc120ita.dll msiexec.exe File opened for modification C:\Windows\system32\msvcr120.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp100.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100rus.dll msiexec.exe File opened for modification C:\Windows\system32\mfc100enu.dll msiexec.exe File created C:\Windows\SysWOW64\vcamp120.dll msiexec.exe File opened for modification C:\Windows\system32\vccorlib120.dll msiexec.exe File created C:\Windows\system32\mfc120ita.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100deu.dll msiexec.exe File opened for modification C:\Windows\system32\mfc100.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc120.dll msiexec.exe File created C:\Windows\SysWOW64\mfc120esn.dll msiexec.exe File created C:\Windows\SysWOW64\mfc120fra.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120rus.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vccorlib120.dll msiexec.exe File created C:\Windows\SysWOW64\mfc120rus.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120ita.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc120deu.dll msiexec.exe File created C:\Windows\SysWOW64\mfc120u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc100chs.dll msiexec.exe File created C:\Windows\SysWOW64\vcomp120.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp100.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcr120.dll msiexec.exe File opened for modification C:\Windows\system32\vcamp120.dll msiexec.exe File created C:\Windows\system32\vcamp120.dll msiexec.exe File created C:\Windows\system32\mfc120kor.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm100.dll msiexec.exe File opened for modification C:\Windows\system32\vcomp100.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120enu.dll msiexec.exe -
Drops file in Program Files directory 5 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll msiexec.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll msiexec.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll msiexec.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll msiexec.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll msiexec.exe -
Drops file in Windows directory 64 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120fra_x86 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120ita_x86 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121646210.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658319.0\mfc80CHS.dll msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\CacheSize.txt msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vccorlib120_x64 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfcm120u_x64 msiexec.exe File opened for modification C:\Windows\Installer\MSI2BA2.tmp msiexec.exe File created C:\Windows\Installer\e57f0b9.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658163.0\mfcm80.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240805121658444.1 msiexec.exe File opened for modification C:\Windows\Installer\MSI63DD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9BEC.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658444.0\8.0.50727.42.policy msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120jpn_x86 msiexec.exe File created C:\Windows\Installer\e57f09d.msi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120enu_x64 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121646053.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.manifest msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240805121646366.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658460.0\8.0.50727.42.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658475.0\8.0.50727.42.cat msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_msvcr120_x86 msiexec.exe File opened for modification C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121646022.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121646116.0\mfc80u.dll msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_msvcr120_x86 msiexec.exe File created C:\Windows\Installer\e57f06f.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120deu_x86 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121646053.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121646335.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658319.0\mfc80KOR.dll msiexec.exe File opened for modification C:\Windows\Installer\MSI6051.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcp120_x64 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121646210.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121646382.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\Installer\e57f040.msi msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240805121646382.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658413.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_40f01e47.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240805121658319.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658460.0\8.0.50727.42.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658475.1\8.0.50727.42.cat msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120_x64 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658007.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_a08a3e21.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658319.0\mfc80FRA.dll msiexec.exe File created C:\Windows\Installer\SourceHash{8122DAB1-ED4D-3676-BB0A-CA368196543E} msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120jpn_x86 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120chs_x64 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120enu_x64 msiexec.exe File opened for modification C:\Windows\Installer\e57f03c.msi msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240805121646335.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658475.1\8.0.50727.42.policy msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120deu_x86 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120enu_x86 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658163.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658319.0\mfc80CHT.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121658444.0\8.0.50727.42.cat msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\CacheSize.txt msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121646116.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240805121646350.0\8.0.50727.6195.policy msiexec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 2 IoCs
Processes:
msiexec.exemsiexec.exepid process 3536 msiexec.exe 3968 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 30 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Setup.exevcredist2013_x86.exemsiexec.exevcredist2005_x64.exemsiexec.exeMsiExec.exevcredist2012_x64.exevcredist2008_x64.exeSetup.exevcredist2010_x64.exevcredist2012_x86.exevcredist2008_x86.exevcredist2012_x64.exevcredist_x86.exevcredist_x86.exeMsiExec.exevcredist2013_x64.exevcredist2015_x86.exevcredist2015_x64.exevcredist2005_x86.exevcredist2010_x86.exevcredist2013_x86.exevcredist2015_x64.exevcredist2013_x64.exevcredist_x64.exeVCREDI~2.EXEvcredist2012_x86.exevcredist_x64.exevcredist2015_x86.exeinstall.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2013_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2005_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2012_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2008_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2010_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2012_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2008_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2012_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2013_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2015_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2015_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2005_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2010_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2013_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2015_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2013_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCREDI~2.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2012_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2015_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language install.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000096fabf83e47a2dea0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000096fabf830000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090096fabf83000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d96fabf83000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000096fabf8300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Setup.exeSetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe -
Modifies data under HKEY_USERS 33 IoCs
Processes:
msiexec.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31 msiexec.exe -
Modifies registry class 64 IoCs
Processes:
vcredist2013_x86.exemsiexec.exevcredist2013_x64.exevcredist_x86.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\Version = "12.0.40664.0" vcredist2013_x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\SourceList\Media\1 = ";" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE6380BC270BD863282B3D74B09F7570\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\Dependents\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7} vcredist2013_x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C05586832351A613E9FF58906A9EF297 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.OpenMP,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800360034003e0061005b0046005f0031006a0048006a005d003300680065005f004f005400590026006b003f00400000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\LastUsedSource = "n;2;f:\\c514e581744b69ae95854086252f\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\VCRedist_x86_enu msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1BAD2218D4DE6763BBA0AC63186945E3\Servicing_Key msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\Language = "1033" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12 vcredist2013_x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_ATL_x86 = "VC_Redist_12222_x86_enu" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net\2 = "f:\\c514e581744b69ae95854086252f\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\Assignment = "1" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\Assignment = "1" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 3d004e00400055004b002d0024004c00640041004f003f00430033005900210035004d0040004a00560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\Net\2 = "f:\\f1cdabcdb98f265cc718\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\ProductName = "Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V12\DEPENDENTS\{61087A79-AC85-455C-934D-1FA22CC64F36} vcredist_x86.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e004e002e004b004300300068004d0064007b00340060006d002b00380039004f002e002e003100540000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFCLOC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800380036003e0027002a005b0069005b00320062006e004100340070006b0046005d006b004b0057007e005800300000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e00690060003700480050004400240062002400350035007e004a007b00730074007e0029006200780000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList\LastUsedSource = "n;2;f:\\a6bfaae0f39d21ea883ce1782e3ad8\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12B8D03ED28D112328CCF0A0D541598E\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FC00402C7EDE723A94E0F3FD809588F\4396FC35D89A48D31964CFE4FDD36514 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Version = "167812379" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12\ = "{010792BA-551A-3AC0-A7EF-0FAB4156C382}" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\KB2565063 = "Servicing_Key" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D169104D02A37CA349B316935DDB94A0 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{61087a79-ac85-455c-934d-1fa22cc64f36}\Dependents vcredist_x86.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44DB0475D85BA123FA0CD6D35465DDC6\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E58E8E6B4EC5FF4197F4099C9F9EAA6\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\FT_VC_Redist_ATL_x64 = "VC_Redist_12222_amd64_enu" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\FT_VCRedist_x64_KB2565063_Detection msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\ProductName = "Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40664" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\SourceList\PackageName = "vc_runtimeMinimum_x86.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12\DisplayName = "Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\DisplayName = "Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40664" vcredist2013_x86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\Dependents\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece} vcredist2013_x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D169104D02A37CA349B316935DDB94A0\Servicing_Key msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12\Version = "12.0.40664" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\VC_Redist_12222_amd64_enu msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e004b00520050005200400047006b006e005d0033003d002b004c00380047003600210061002e00490000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e006f006f0063007b006200340036003f004500380042006a005f0079005d005d007e004f006f002c0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004300520054005f007800360034003e002c007d0050004e002c00320065006e007a003300270070005b00550021006c004900720021006e0000000000 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
msiexec.exeSetup.exeSetup.exepid process 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 3000 Setup.exe 3000 Setup.exe 3000 Setup.exe 3000 Setup.exe 3000 Setup.exe 3000 Setup.exe 3000 Setup.exe 3000 Setup.exe 3000 Setup.exe 3000 Setup.exe 3000 Setup.exe 3000 Setup.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 692 Setup.exe 692 Setup.exe 692 Setup.exe 692 Setup.exe 692 Setup.exe 692 Setup.exe 692 Setup.exe 692 Setup.exe 692 Setup.exe 692 Setup.exe 692 Setup.exe 692 Setup.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe 2880 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exedescription pid process Token: SeShutdownPrivilege 3536 msiexec.exe Token: SeIncreaseQuotaPrivilege 3536 msiexec.exe Token: SeSecurityPrivilege 2880 msiexec.exe Token: SeCreateTokenPrivilege 3536 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3536 msiexec.exe Token: SeLockMemoryPrivilege 3536 msiexec.exe Token: SeIncreaseQuotaPrivilege 3536 msiexec.exe Token: SeMachineAccountPrivilege 3536 msiexec.exe Token: SeTcbPrivilege 3536 msiexec.exe Token: SeSecurityPrivilege 3536 msiexec.exe Token: SeTakeOwnershipPrivilege 3536 msiexec.exe Token: SeLoadDriverPrivilege 3536 msiexec.exe Token: SeSystemProfilePrivilege 3536 msiexec.exe Token: SeSystemtimePrivilege 3536 msiexec.exe Token: SeProfSingleProcessPrivilege 3536 msiexec.exe Token: SeIncBasePriorityPrivilege 3536 msiexec.exe Token: SeCreatePagefilePrivilege 3536 msiexec.exe Token: SeCreatePermanentPrivilege 3536 msiexec.exe Token: SeBackupPrivilege 3536 msiexec.exe Token: SeRestorePrivilege 3536 msiexec.exe Token: SeShutdownPrivilege 3536 msiexec.exe Token: SeDebugPrivilege 3536 msiexec.exe Token: SeAuditPrivilege 3536 msiexec.exe Token: SeSystemEnvironmentPrivilege 3536 msiexec.exe Token: SeChangeNotifyPrivilege 3536 msiexec.exe Token: SeRemoteShutdownPrivilege 3536 msiexec.exe Token: SeUndockPrivilege 3536 msiexec.exe Token: SeSyncAgentPrivilege 3536 msiexec.exe Token: SeEnableDelegationPrivilege 3536 msiexec.exe Token: SeManageVolumePrivilege 3536 msiexec.exe Token: SeImpersonatePrivilege 3536 msiexec.exe Token: SeCreateGlobalPrivilege 3536 msiexec.exe Token: SeBackupPrivilege 1076 vssvc.exe Token: SeRestorePrivilege 1076 vssvc.exe Token: SeAuditPrivilege 1076 vssvc.exe Token: SeBackupPrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe Token: SeTakeOwnershipPrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe Token: SeTakeOwnershipPrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe Token: SeTakeOwnershipPrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe Token: SeTakeOwnershipPrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe Token: SeTakeOwnershipPrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe Token: SeTakeOwnershipPrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe Token: SeTakeOwnershipPrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe Token: SeTakeOwnershipPrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe Token: SeTakeOwnershipPrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe Token: SeTakeOwnershipPrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe Token: SeTakeOwnershipPrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe Token: SeTakeOwnershipPrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe Token: SeTakeOwnershipPrivilege 2880 msiexec.exe Token: SeRestorePrivilege 2880 msiexec.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
Processes:
msiexec.exemsiexec.exeinstall.exeinstall.exevcredist2012_x86.exevcredist2012_x64.exevcredist2013_x86.exevcredist2013_x64.exepid process 3536 msiexec.exe 3536 msiexec.exe 3968 msiexec.exe 3968 msiexec.exe 3420 install.exe 3420 install.exe 4676 install.exe 4676 install.exe 1856 vcredist2012_x86.exe 3812 vcredist2012_x64.exe 636 vcredist2013_x86.exe 4492 vcredist2013_x64.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exevcredist2005_x86.exemsiexec.exevcredist2005_x64.exeVCREDI~2.EXEvcredist2008_x86.exevcredist2008_x64.exevcredist2010_x86.exevcredist2010_x64.exevcredist2012_x86.exevcredist2012_x64.exevcredist2013_x86.exedescription pid process target process PID 4108 wrote to memory of 3468 4108 cmd.exe vcredist2005_x86.exe PID 4108 wrote to memory of 3468 4108 cmd.exe vcredist2005_x86.exe PID 4108 wrote to memory of 3468 4108 cmd.exe vcredist2005_x86.exe PID 3468 wrote to memory of 3536 3468 vcredist2005_x86.exe msiexec.exe PID 3468 wrote to memory of 3536 3468 vcredist2005_x86.exe msiexec.exe PID 3468 wrote to memory of 3536 3468 vcredist2005_x86.exe msiexec.exe PID 2880 wrote to memory of 2584 2880 msiexec.exe srtasks.exe PID 2880 wrote to memory of 2584 2880 msiexec.exe srtasks.exe PID 2880 wrote to memory of 3048 2880 msiexec.exe MsiExec.exe PID 2880 wrote to memory of 3048 2880 msiexec.exe MsiExec.exe PID 2880 wrote to memory of 3048 2880 msiexec.exe MsiExec.exe PID 4108 wrote to memory of 2140 4108 cmd.exe vcredist2005_x64.exe PID 4108 wrote to memory of 2140 4108 cmd.exe vcredist2005_x64.exe PID 4108 wrote to memory of 2140 4108 cmd.exe vcredist2005_x64.exe PID 2140 wrote to memory of 4668 2140 vcredist2005_x64.exe VCREDI~2.EXE PID 2140 wrote to memory of 4668 2140 vcredist2005_x64.exe VCREDI~2.EXE PID 2140 wrote to memory of 4668 2140 vcredist2005_x64.exe VCREDI~2.EXE PID 4668 wrote to memory of 3968 4668 VCREDI~2.EXE msiexec.exe PID 4668 wrote to memory of 3968 4668 VCREDI~2.EXE msiexec.exe PID 4668 wrote to memory of 3968 4668 VCREDI~2.EXE msiexec.exe PID 2880 wrote to memory of 1044 2880 msiexec.exe MsiExec.exe PID 2880 wrote to memory of 1044 2880 msiexec.exe MsiExec.exe PID 2880 wrote to memory of 1044 2880 msiexec.exe MsiExec.exe PID 4108 wrote to memory of 3688 4108 cmd.exe vcredist2008_x86.exe PID 4108 wrote to memory of 3688 4108 cmd.exe vcredist2008_x86.exe PID 4108 wrote to memory of 3688 4108 cmd.exe vcredist2008_x86.exe PID 3688 wrote to memory of 3420 3688 vcredist2008_x86.exe install.exe PID 3688 wrote to memory of 3420 3688 vcredist2008_x86.exe install.exe PID 3688 wrote to memory of 3420 3688 vcredist2008_x86.exe install.exe PID 4108 wrote to memory of 676 4108 cmd.exe vcredist2008_x64.exe PID 4108 wrote to memory of 676 4108 cmd.exe vcredist2008_x64.exe PID 4108 wrote to memory of 676 4108 cmd.exe vcredist2008_x64.exe PID 676 wrote to memory of 4676 676 vcredist2008_x64.exe install.exe PID 676 wrote to memory of 4676 676 vcredist2008_x64.exe install.exe PID 4108 wrote to memory of 3604 4108 cmd.exe vcredist2010_x86.exe PID 4108 wrote to memory of 3604 4108 cmd.exe vcredist2010_x86.exe PID 4108 wrote to memory of 3604 4108 cmd.exe vcredist2010_x86.exe PID 3604 wrote to memory of 3000 3604 vcredist2010_x86.exe Setup.exe PID 3604 wrote to memory of 3000 3604 vcredist2010_x86.exe Setup.exe PID 3604 wrote to memory of 3000 3604 vcredist2010_x86.exe Setup.exe PID 4108 wrote to memory of 4388 4108 cmd.exe vcredist2010_x64.exe PID 4108 wrote to memory of 4388 4108 cmd.exe vcredist2010_x64.exe PID 4108 wrote to memory of 4388 4108 cmd.exe vcredist2010_x64.exe PID 4388 wrote to memory of 692 4388 vcredist2010_x64.exe Setup.exe PID 4388 wrote to memory of 692 4388 vcredist2010_x64.exe Setup.exe PID 4388 wrote to memory of 692 4388 vcredist2010_x64.exe Setup.exe PID 4108 wrote to memory of 4772 4108 cmd.exe vcredist2012_x86.exe PID 4108 wrote to memory of 4772 4108 cmd.exe vcredist2012_x86.exe PID 4108 wrote to memory of 4772 4108 cmd.exe vcredist2012_x86.exe PID 4772 wrote to memory of 1856 4772 vcredist2012_x86.exe vcredist2012_x86.exe PID 4772 wrote to memory of 1856 4772 vcredist2012_x86.exe vcredist2012_x86.exe PID 4772 wrote to memory of 1856 4772 vcredist2012_x86.exe vcredist2012_x86.exe PID 4108 wrote to memory of 1348 4108 cmd.exe vcredist2012_x64.exe PID 4108 wrote to memory of 1348 4108 cmd.exe vcredist2012_x64.exe PID 4108 wrote to memory of 1348 4108 cmd.exe vcredist2012_x64.exe PID 1348 wrote to memory of 3812 1348 vcredist2012_x64.exe vcredist2012_x64.exe PID 1348 wrote to memory of 3812 1348 vcredist2012_x64.exe vcredist2012_x64.exe PID 1348 wrote to memory of 3812 1348 vcredist2012_x64.exe vcredist2012_x64.exe PID 4108 wrote to memory of 4904 4108 cmd.exe vcredist2013_x86.exe PID 4108 wrote to memory of 4904 4108 cmd.exe vcredist2013_x86.exe PID 4108 wrote to memory of 4904 4108 cmd.exe vcredist2013_x86.exe PID 4904 wrote to memory of 636 4904 vcredist2013_x86.exe vcredist2013_x86.exe PID 4904 wrote to memory of 636 4904 vcredist2013_x86.exe vcredist2013_x86.exe PID 4904 wrote to memory of 636 4904 vcredist2013_x86.exe vcredist2013_x86.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\install_all.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2005_x86.exevcredist2005_x86.exe /q2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi3⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2005_x64.exevcredist2005_x64.exe /q2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2008_x86.exevcredist2008_x86.exe /qb2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\f:\c514e581744b69ae95854086252f\install.exef:\c514e581744b69ae95854086252f\.\install.exe /qb3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2008_x64.exevcredist2008_x64.exe /qb2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:676 -
\??\f:\f1cdabcdb98f265cc718\install.exef:\f1cdabcdb98f265cc718\.\install.exe /qb3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2010_x86.exevcredist2010_x86.exe /passive /norestart2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\f:\a6bfaae0f39d21ea883ce1782e3ad8\Setup.exef:\a6bfaae0f39d21ea883ce1782e3ad8\Setup.exe /passive /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2010_x64.exevcredist2010_x64.exe /passive /norestart2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\f:\e7772670fb980861f8da67623d374a3c\Setup.exef:\e7772670fb980861f8da67623d374a3c\Setup.exe /passive /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:692 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2012_x86.exevcredist2012_x86.exe /passive /norestart2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2012_x86.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2012_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{644B7778-5F7A-4F2C-A022-FCEAB62F70CE} {669EB84B-E841-46BE-80C8-B38FAA05DBAD} 47723⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2012_x64.exevcredist2012_x64.exe /passive /norestart2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2012_x64.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2012_x64.exe" /passive /norestart -burn.unelevated BurnPipe.{02F6BB31-6230-4A36-BF1D-2A825E5F4F82} {74D1594A-3E23-483D-8662-D73AEECC5466} 13483⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2013_x86.exevcredist2013_x86.exe /passive /norestart2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2013_x86.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2013_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{B56A64A8-2B67-4D49-9302-3F76E0D34CB9} {A07C90D1-EB31-460B-A66D-2A6B8E6CC45B} 49043⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:636 -
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={9dff3540-fc85-4ed5-ac84-9e3c7fd8bece} -burn.embedded BurnPipe.{D0D12719-FF37-44EB-A9B1-09070398773B} {26379148-1886-4ECC-B2C7-C9B1920788DB} 49043⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4464 -
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={9dff3540-fc85-4ed5-ac84-9e3c7fd8bece} -burn.embedded BurnPipe.{D0D12719-FF37-44EB-A9B1-09070398773B} {26379148-1886-4ECC-B2C7-C9B1920788DB} 4904 -burn.unelevated BurnPipe.{49F8C2F4-9E62-4AD0-A03B-66E8F9EEB277} {13E8FEC0-E11C-44AA-8758-025A857EA0B3} 44644⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2013_x64.exevcredist2013_x64.exe /passive /norestart2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2013_x64.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2013_x64.exe" /passive /norestart -burn.unelevated BurnPipe.{0E4822C6-E2C5-497B-B5DD-C4982A2256EE} {F69A283C-6B6D-41A0-BF04-F23C188EEE89} 23563⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4492 -
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{4B7AE4C2-BC37-4B05-A8FA-723689E3427C} {72F9B8C3-ED19-4C3A-8C97-9F0FA4FF0705} 23563⤵
- System Location Discovery: System Language Discovery
PID:4772 -
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{4B7AE4C2-BC37-4B05-A8FA-723689E3427C} {72F9B8C3-ED19-4C3A-8C97-9F0FA4FF0705} 2356 -burn.unelevated BurnPipe.{78AF7E08-A3E8-4C2E-AE9B-F655A0D0A7B1} {C76B0577-6D25-4403-ABF2-92A850E30E60} 47724⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2015_x86.exevcredist2015_x86.exe /passive /norestart2⤵
- System Location Discovery: System Language Discovery
PID:4476 -
C:\Windows\Temp\{99D24F12-4FEF-4FF0-9CFD-0870CD90191F}\.cr\vcredist2015_x86.exe"C:\Windows\Temp\{99D24F12-4FEF-4FF0-9CFD-0870CD90191F}\.cr\vcredist2015_x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2015_x86.exe" -burn.filehandle.attached=700 -burn.filehandle.self=704 /passive /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2015_x64.exevcredist2015_x64.exe /passive /norestart2⤵
- System Location Discovery: System Language Discovery
PID:4312 -
C:\Windows\Temp\{09A2C196-3CCB-4F66-8713-988E3E402BCC}\.cr\vcredist2015_x64.exe"C:\Windows\Temp\{09A2C196-3CCB-4F66-8713-988E3E402BCC}\.cr\vcredist2015_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2015_x64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=560 /passive /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4884
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2584
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D0353B622B4AB205F75D1E355792952B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3048 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AA420D347E41B769CBE82A0D9AAC7EF82⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1044
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1076
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD5dd3c731f9b9517dfff9da2a18d4ee26e
SHA1450f880169368492453eeb3b77da116b617a93cd
SHA256a2386728950b22ed004e7a62d0a0478d9b30cf6a135ff07b2c8305adbbc95283
SHA512a5a7b5aae664e168bdc15a40a38846a6a959c0973b47d3f246c068ea4f4ce13604bf77610f75db1944f04ba3eadc157b816d15d621407cf9d76be96e775e903c
-
Filesize
30KB
MD5badc8aae5bf64893059a2caf885bf88b
SHA1acbf0f888ae0c9e570ce7942d219b26397eace67
SHA256238bcb5b582d7abb4325911e4e2a9b91d9979a292937d51a944145c25a2df2d0
SHA5123954bb95b7eb523ab9dd80b5565ce27f70e175b57e92685dfbee4298f8bd06b84ae488ce6ee2ccef3a373cb59eb53e19d3d8fc3b9a733a75a12991d1bd48890b
-
Filesize
4KB
MD5fae3ebb1e89a0b0e6d521a6c110c496d
SHA12d861c582efd3d213732ff458be9897455c6cb4e
SHA256f7b1db1c8c06596d7bff33e8eaa2ac6790037d5ba22ac08c0164f2432466d10e
SHA51210d91088171762176d5123638aff49d9e368d8accb0d0c2ef18f7f1097fa7b68c40608dab09c71fd27e8677df7c27ecf5f609d01720cb9af1dae398e567b3ae3
-
Filesize
31KB
MD5bfdd3af5d8fbc2cf00b9c28c33d7c3da
SHA110660173d328809ac5650119375ba659289d11fc
SHA25667dc69357d2cab816bb8125a7b5f153a6e83965bf1e9a23f02fceb7026a5d00e
SHA51224cd3ff14b382ed0da728425a4123558c5b540eca7035e0e98379788fbff64e9127742bb0667191e7c5ee514ee3427ba2774dfa4655ce978c371ef945ef8928f
-
Filesize
4KB
MD573799119b4d19a4b5f98a5a66b5ab1f5
SHA1ad3723dcff2d3ff5a92c0e25b6e743f4a2fe2fba
SHA256fcdac9ea162e8daa4e11e446e802b6c1f8d6e168e850cdef6f575d7fbcbcb441
SHA512c1b199085e46cb9b3db37cce2ff0957f0ef3b7456f32d88f7815dc221d09d60fcae17f5558a5072c4bc027474ccb58344dd4935b8246e1f42137baa22987d5d7
-
Filesize
31KB
MD5c766dedbd06146e5f8510a605997ee60
SHA15d2d5dae07784b722da84face0d90704e755fe58
SHA2564c5cfb7345930c0adcbfc2de2f8429c4688a644d7f8580c8469dda8d1fd9926c
SHA51213b58833e3b222e4d657d49128a927149b472f3e5979b5b61d488953e3dfc57bef8144889d967411cd1ac06880ffd4b6094c71251edf9890e1eecb0731427952
-
Filesize
17KB
MD56560dbb1c4f28156d2fe7a14b0248583
SHA14232396c98892fc98d82790e37b626c1e4cc8836
SHA2568eb9cebf416c1af3030ea682d8654d099e0758aa3169cfa0d5f71bb70f844efd
SHA512acb8cbf3b813164e11b218af7869d50b48619ab120c2e716fb1fa0460c5ea4fc3a273ff727290546843f9c034e1e47deff16ec327df93a24ab30a3915a98bf1b
-
Filesize
13KB
MD5e8343193bf35ca0fd89d63e5d1447bc4
SHA1be4d8df51bfb5442043901f8a86afc9ade43ee32
SHA25658c54cdaf37f9065e11269de955d84af4916710aa60c4bdd245c3257a99461cb
SHA5128e9e9e26b9b7bf61a9ad6e437f5a34c1184ca2ea9ce196c8cec6060e8afd66a16c2b8af3fe00a27c37768b751bca802014b784f906d7eb4594e912ec78f3ac07
-
Filesize
444KB
MD5a883c95684eff25e71c3b644912c73a5
SHA13f541023690680d002a22f64153ea4e000e5561b
SHA256d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb
SHA5125a47c138d50690828303b1a01b28e6ef67cfe48215d16ed8a70f2bc8dbb4a73a42c37d02ccae416dc5bd12b7ed14ff692369bc294259b46dbf02dc1073f0cb52
-
Filesize
948KB
MD52fb20c782c237f8b23df112326048479
SHA1b2d5a8b5c0fd735038267914b5080aab57b78243
SHA256e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa
SHA5124c1a67da2a56bc910436f9e339203d939f0bf854b589e26d3f4086277f2bec3dfce8b1f60193418c2544ef0c55713c90f6997df2bfb43f1429f3d00ba46b39b0
-
Filesize
331KB
MD569004e08c1eb19fcf709908103c002fd
SHA1d59459f9a18b2e9a06e5af2b88f4fecb0ce690d5
SHA256c1b61dd24dc2dd5efd5cd548c0cd74fac112358e9e580df4d780d2c125474dad
SHA5123fc67a5fccb252a67285e19d62057fb4e3c63e702f4be91e552f93d9827cc746b8fb43b4a3b24b7fd5c48832d18a1dae26c1bd237f40b7b88618d402fdac1a76
-
Filesize
242KB
MD5c7739dd4212d084d299df68f0a0debc3
SHA1cba81d847d91bfea5c03279c0ca03fb1aacd4ae9
SHA2561d67a8464991a03fc190d87b43591764f231d7a7a71a72ffc51d982b26691153
SHA5125b8e98e6764460f9afbfa6dd34c12ad59284003eea99997c9e1db9b4a85ba30ac8b6a699b2888388dc424c547918137d42984bf040ac3d292e612bc433368fb3
-
Filesize
117KB
MD590419039c035404fb1dc38c3fb406f65
SHA167884b612d143aa08a307110cee7069bddb989a0
SHA25662287589fc0b577398005f7ac07256d9fe671cdd3e5369faf74b9f64cb572317
SHA512e632c78c941861e61fbec68e333e6549cd4bec683593db92c2522e162176bd64160dba37d4226c1599cfe1d77b36d5d4c452dd2f453c291a15310dfb607f3414
-
Filesize
3B
MD521438ef4b9ad4fc266b6129a2f60de29
SHA15eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA25613bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA51237436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
-
Filesize
26KB
MD51dfaaea72872d4c204c65c708306cbe4
SHA16fa4ad74a955774a0374a54fa0dbf0818de7e993
SHA2567763871236156460d48dfd70ae912c0dbdbdd7240d7626e292f149d054c5af89
SHA512ab2ddecf562af8bf853fd47e823f071019748e3ba54f6a3bc0dc95086d3c988a0ddc76ae055cf88da053176e539729b7dc84046c28c43fc2686acd783f5e3ca8
-
Filesize
22KB
MD54b8e0cbea01b807bd9ea64774a6aaa9d
SHA100cfdcb38d0e67a31c43fa3539a622b29eaf0eac
SHA256202871c469866d0ada2724096993563a0e4df6caf748fddea4b103fb126ab073
SHA51248fc1ba62cd64028c8b64895e73821f49a7aeae33a7e6cfb7277e4170af49af60e4f61747161e67f51abd08aa8d695b44ee52e8e3d24250884e5372bad32c6a0
-
Filesize
45KB
MD52f7c88c43a8966882ca89ce4981e3cde
SHA1588bdeae6eab1f447771bd6963b5b3329196e686
SHA2565e7331a6adeb9d4252531ade800d47b8ddf020b97cfedc58de85386b3ae64e76
SHA5123f2eca126fc821e36aaf4430a0f41af1a060396f52cfb2efd1c3be2ab9d69cfac870121c646776c8b15e8561938ac30367bc5687bb9a79f0c19156c3b56249a7
-
Filesize
45KB
MD570bbafa7c8b0aeba0e25e27c440a6038
SHA144a5e06229ae4f6ce6d3b2b57cb3b6050667def2
SHA2569eec79bd4af04bba1e11fc24c64d94f30c22985c8ebbce3e0b411a61a1edbabe
SHA5122e9b8696c1b4ab8e721fa07b6c81fe30613f0d188250991c573af95263688b7db6e25ebc4c030825724248c9713d9c5b772f199369785ac615ad2d2fdf527f8a
-
Filesize
73KB
MD509936f1f2ad5ae9d0663b6e8709527c7
SHA1f0e5945663e65405d94c394db83880f713295104
SHA256550f6c9f16fe85a8338b04f1bec43de3babeac60ff257197625f2802907007b8
SHA5123e95e1e3f2043e1f0a4baf1267e82f912bcd5830ae6c5abc750a38a0666b1a6b9e1169dadb58bc2eafae00a2e11bcf574ea805f3a1f07f77d5450d1265e8e7f6
-
Filesize
63KB
MD59becefa155c8c9f5ef5bf9d537c0a258
SHA14f33f6d08685d50ce799df6369cb5efc51673e12
SHA256d1dbc7677010f9af7b680ea2efa28c964154997bddbf6c8d9d65ea225a5ec613
SHA5125e9972cfe26c0fc6a0ea38643c644b5ac33e4ddfc1cff5b25017c81f3121ec7732565554f43c1916e9f8e2b1d84226aacd2cc4d6805425c2f1f1e7683e506ff4
-
Filesize
72KB
MD530281f2891b6deae8c0deb122b5906c7
SHA143ed0c7bf45839ba07501c1013ba74c97b4d0beb
SHA25687e5c496e038c337ca1acee52c145d8f4bdb3e74261b13e1feb740c4e2124e0a
SHA512cb0e3f3cf89af55e4b849b3f4f883d8348fc8f806690db4fff238ee54bc5f80a34e53c7e8a22dd9d1dc57c1a60c69d3e25ad9cc52ac66628613cdf358e7aa537
-
Filesize
73KB
MD5b41aa9a167ac3d6c11b5c2e1e183c11b
SHA1ac8efa5f7b8211e4dc0d0d0e6bc7717f88d2c0ac
SHA256b098ed9a5f44052b9ab5ceee82ab4cea5c6d9a14a61816882ef996a0599838b2
SHA512de667f1fe0bcb0ddf8f59054a2d5c516ec47ab59f7e78e29ec8a2cc756c72aae65bb73ea03701c67c978166649d69278fb0269e9588d968f630165bcfa6f40f8
-
Filesize
71KB
MD52bcf9a28e5fe7a3fefd16a9c03d35dbb
SHA17c1446d8ca4d2c6890d62c02308daccb8be5475f
SHA256271abe43d14cbd8c80b85ec804787272522bc06c45b7f93244b718ab0c08a289
SHA512445ef027eeecda4361834334706079053ce9a735cbeeadaec37f28c4f9a485b07ba156178c2cdb1f012d1760d0495d041deceb6372921eb94d18241eb304eafa
-
Filesize
52KB
MD534b5ae129703de4a4bb5f52f4306fdf6
SHA1601ba6cc73cbbe6d7014519a885fde2c9e9c2fba
SHA25643cd9fdf714b7dfca4b2a8f54bc25ceeddc7a6212ba59233d89a03c650053407
SHA512016dae93356e42a19f4fb4d34efa04e93f802e5de3157c29ce940d9637d697d2b7a4f61b705b5b5df271b97d942cb81265d0fe7c9561c0ef3c46c249b8b7fb9c
-
Filesize
52KB
MD5f89147c034de186e3ab79326523888b8
SHA1d3e6c00363a429eae066953f7c187e33c687ec6b
SHA25632dfe0f26b5024ec900a31f0dde736ca62769dc5de48238b485f4322cd367e7d
SHA512d7842681f67b46f67233ad0f7c57c7155f152dc25ef546a08fb91914ee54984b87f9ccbd8da3e40d012b251fffade838f2d779681afa84c383ea7982f0ad1cfe
-
Filesize
69KB
MD5d7f2e87512d19d01328840187fc7cb04
SHA17a312b677b76d7303e01da6064f1a5e0fb26c604
SHA2561154c537bd700ebbda599a5c2923e73d098c3eaa930fd0f4d415583ff90eea67
SHA5128a00cae2dc0d59e530cd43bf84f33301f53ccdd96477787805b487ffdf6869223621414cf180a1aafb6b8910ba19684c02c60226a651d051eacc4cac1fbd8c2b
-
Filesize
4.2MB
MD5293002e4332f01c74c2a843b5c638a90
SHA12e412f945ac4353b4908c87e31b847415b3ec19b
SHA2566130ad7d21a492cd3f3924bed43d954f80b6b6920374934b9eed057f27130e15
SHA51249eaf5633debad535ffc6584c8383e21c99f7a3a81a0b3496943af0e79853399649706ceda9da9990c259d605ab163c22c08f641b91e80c8a14d519837a595ce
-
Filesize
4.2MB
MD5e1629a36f15824346bb54a9ebe9b622f
SHA1ee5d55315ffb351e24b7c918c82e6ce4ec17a645
SHA25668df186e26151313a0df2adb0ef5f3a45ebba3cb02229bd8723a29dee60e278d
SHA5120301ed7ad473015478f32afd3e41dafd045eab26ad42080bad6030324564a7ed09a7516b8d362b5cb2201d087eb25f2bb7ac5fc809a387f49f893ac3df8814bb
-
Filesize
81KB
MD536ca9bc41425660ad80f23933e6e9f1f
SHA13206186f932cd5948062a837b5fc2094ddb1c8b7
SHA2568c82f149507c3415250e52bf4c7fe937946a60d51f07492a1e36ab3e14482187
SHA512a58eee2824bad90ea0790bdf55c5b58a6eec5f3e87bebf5a941a6dbcb8106c6d96b7eee0a022c4a16f35d80e38501fed54d88127f30de0e9fdd22e4df8fa2ea5
-
Filesize
81KB
MD59b73043d5646be7b544e3ac3d49b7744
SHA1a3eecb1a85c244d5428a012041eee947462e7a09
SHA256d6d2ba4ac1606e825216a25ab401d26d77c4300299e957cfadab3b0b945d065a
SHA5128f339c23f8d1e8eed1bd055a31c027e5da03d916769468394ba1befe7b4f2586e67e8dcf29326ff40abb0d879a45f886398d5d733c988c507860d1ece16ed83a
-
Filesize
18KB
MD57cc0c868a36079bbb3bdd85dd87bcba6
SHA18c2fb2c204dd628fd749c593f7e1efaeb2bfdfef
SHA2560605c2d84a9ba908d64613adb55fdbdc8b1ff4b4f6e5524826e9757488626964
SHA5129253aae10bf46ff381eab549b3dd056c7fd91e2e93563dadb503c4a3ff8d27d6b6ed1c274ff99b99f586def27aff9894caa19d6f0696d14403a0d9e48802548a
-
Filesize
14KB
MD52558455f0d2ae4fb9215fd2df7808993
SHA18dc6b2f520ca94a0640b23734a0cddd56e69b997
SHA25691b39eb96e34bd78fbf2260a729ac412a5986b44d4c296fe393ee6e7ed50f095
SHA5125eb18b3e8a704c407f86847335d74e21cbc0f02b2889114f63fdc7b4d0efa3f9b68f4cf8f728d469b12e8d2114fdf22b96b6b7ffff12127d98bb123eb3b69d18
-
Filesize
644KB
MD5edef53778eaafe476ee523be5c2ab67f
SHA158c416508913045f99cdf559f31e71f88626f6de
SHA25692faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
SHA5127fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8
-
Filesize
940KB
MD5aeb29ccc27e16c4fd223a00189b44524
SHA145a6671c64f353c79c0060bdafea0ceb5ad889be
SHA256d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
SHA5122ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006
-
Filesize
470KB
MD5f0ec8a3ddf8e0534983a05a52bce8924
SHA15f6d0265273f00ffe8e30cf507f0d05d330ff296
SHA25688a5ed51a7be4ff7ebded0c107fafda6ace3801877216c0bb6cbb458ae054a7b
SHA512d7b084d7f20de29ff16341df2756861bb7ac22eab0711869b3e77a84d841fb76a898d7459ca1be62eed522caa1f022c891a7d30c94bf0fff1bb4d016be8aa9bb
-
Filesize
348KB
MD5ea1e99dec990691d41f938085f68bcc7
SHA15fdcbcd777e10e765d593994dc66f930c1377b0e
SHA2561b296bd172332d3b2253bdcb6ecac46afef883f75c13c361632ff40fec743fcc
SHA512e90a40bd8e20bbca3c6188a78ad75578e51d88aa638e0bbfed4f6f6efdd0917e92b08ef4b0ccc2dee08774f08658b189e25234270e8ce1ca60a7e0ec8e3fbcf8
-
Filesize
134KB
MD5d7dbc7c92177837431ae2fd7fb569e2c
SHA1c26140204a6db421842ad36599326a5369fd1b5d
SHA25622d14e004ba4b78a9143257399dc40ef4d0e8f2cdb9127e1ba2638f54cce5c70
SHA5124f2b197ea912b5ea1a82ac84e1c15ca8e3787460cd79a32733ea920dcf3b1db5cf0507ad7c94f4e4ccab9dfc6773a9d05a8eeaa7bd7c61b63d780b69ed7ae0d8
-
Filesize
27KB
MD56816533dfe36afdfbade6423034beb9f
SHA18345e5b4a2aa400c5c1463a623d394c482b4c057
SHA256b689640a8c1e867faba248480004f97a33da19a5679ff1df126850abc07fe877
SHA51266d2afbf4a9c9bc0edd521f716b5a54479770efe0d3ad5e469d552bd08f0baaf00b51f6727cc06a2e13472216cecef975e86dc1f9aba43e0b01f868f7f872e22
-
Filesize
22KB
MD5d6ebfe472d8bbbe4cf888e47d1dc6684
SHA1a9d29b57a3d5f1ce8bf2ec15fb7a1c2002da45df
SHA2566180892e9895f511510aa78b5026a149700e7e85be14ec6a8d0fd5e2e0223edf
SHA5120185d22e40af69d93f290ba962dc220550aa9b18c9774bfde7dbc3898d45320ef39b59190b19c0f2b8da4d186f11fbd495b9c2a2ce21c7da7d8c760fe17534cd
-
Filesize
45KB
MD5f96a9a88487a27de7b3e15c733cf1fe1
SHA10a4157f064349b0370b8ee3f244f44debd04b4c0
SHA256cb531679be2881677a93d11067c71274ec30b30aadf1cdcf1543dddd6b1d7b61
SHA512df5390b235157e65efa3a9385a7ffd6d5f4f2471306625f01370ed463c65b81c4274370f93b5b0d04d44175c57322d2f2fb1cdd2bcbc123997f4ae4ae9557f0b
-
Filesize
45KB
MD56a5e17d5a4b24e5c2b947a343a182949
SHA1ddf5ed505953e073f09b17e8e2bdecf2766c6a4b
SHA2560301c5dc6e762788891356987e9c8cd0d40b262df06e8384bf5796b1f20f083e
SHA5128a383192f9f6e6c4fab24645cf7c30fa927881451f0e65175b724717151cca6fcc49ed3394cc689407f19a7b1afd6b462688bccb898912762b804eeeb7cd8d97
-
Filesize
73KB
MD5bfc853c578252e29698ff6b770794e6a
SHA11091dced7b18bdd7eda2be4d095ac43cfd342b7d
SHA25680e0f29ff6b7ada892f23927f17021783575ad80f9f6c8a268a6c2a7ce35e5d6
SHA512306445384614b48d3182a91c8adf8d8206c36efd88abf23753800566f9650518af382164ca1a17ed000888e6a99c175478ad621d0a0d46c9bc7d5359113e05fb
-
Filesize
63KB
MD519b7b852ac2dec695e6a52801e59c421
SHA1cd72265e1a6a64c761984980895d92cb93bc61b7
SHA256e463f38fa6b6157398ad224a462538bd8e36b75031fa711e567c5505a9092df6
SHA512d0fd9f75820d3dbdc4001ed6262a940f062655ebb5f31f3d45d984e38b1bae2e5a958665b79b5b4aeb899e39348ba987c82148bfd85477e69249d3a59a076017
-
Filesize
72KB
MD59ef2dc352d20b615a556be53b449b17c
SHA1933b2a39f3d730c6b5d437558d0db68c5d2c22b7
SHA256db4fc3652d24224d5375d1a5696144ac8881332cc20f5992ed1488236e64c120
SHA5128031a4d0e44beb290c48292a0987108ed6d6f56950dfb17ee4671e692407fcbb8dc652d82907d8f98db2f841689f9480aee6fbce60cf2bfa1d0d6294c3f6da91
-
Filesize
73KB
MD506473191b67c8b3d1a26b76474c5daeb
SHA194c72bb597c365cb77f621e6e2cf3920954df2d7
SHA256e7cb6c2818ca27c864bda635d5b5d9f7bdb308f4b5d4bbc206ee1e135b7dbbf7
SHA512237c144cd3cd78c4a4eeb5c6a22043a8e604bdbd7182b89bacb81135b1e3de08780061dfa3664508cfbdc01e918fa2610e317f9441b10c4df8def1ca444de4eb
-
Filesize
71KB
MD5713e30e13c1998e035cf4ace66b03230
SHA12d244e01c2bd9f3f17dfa0b74c19ce6bc512e1b5
SHA2569cfc5985440df4e70b57869b32c8ee69eb6fc570a98cc94a53141a0dc7535e10
SHA5128a2581aaa125eb45543e679e58be7040d151cfcfe0625f6e62dccc3fcf87872d3504b30082036d5219dc4c8493600838d31b2ddfde3ba0bc1b2b6ef97078e29a
-
Filesize
52KB
MD5689b5f0061a67ac95f59a64744702186
SHA152227dd2c8a66c0528bff28475846faf7036340f
SHA25683fb72fd2142d54bff6280e7c4d4ff22d43c3a81fa4ff8881003abbe5e21ec3b
SHA51230b4e01d20c6c3ac1b799dd4d23fda3ca988eadb59356f84aff0a0760572b5c4119ef21467494e47a7d74dd6b136633a6ae40f45ec051d5cacbe44b5d6255d42
-
Filesize
52KB
MD57d03ffc6a8fb686abd660efdc3aaf223
SHA13d04c53971a525cc3255ff1eab05ff0cbad75bb7
SHA256b2c7fc2c95b13bac36316d298c94d842dd2574f78e9c22e4d4e4af1c3fcc0fd9
SHA512b5d41294630e342f2242a91c9dcf9085cddbd2389860e14c741147cb695425971cf79339b523d28fd3189589e5f948115359b89f59a03186e3c6a103f854f4e1
-
Filesize
69KB
MD5a99ad214ccd1e7bc1f609b972467b0ca
SHA19ee79954fdb2338026c3c81da00ab6e7e6c2e1ff
SHA2563238676035d9c1595248ef65ef5b044384b473ab9bdfe8d1077e10e4fe7bc983
SHA512da1f8a4dd82559635ea53dfeac1817a9ced1d247a170a8153a54c05c371fc80aa2fa958bc5c515c026815c505f70fb374178f8ccf94836b66c4a7e23dab1c083
-
Filesize
5.4MB
MD5ee4af4ceb4b7fded7cdda37faef69704
SHA15ab8f2ace2f4a1892ea4a2a26df5ee7e9cd497b2
SHA25675497de4aec4b5f0f258164672db2eb55eef5138c028317860e05f11030f7b7c
SHA5124f807157e6bd57ac37bd1d8a52ffdc38e330e517101a1ea603096d8728b04c9c2ae96e510b961c87536e957587ce169fdece6bc3ed5e5025aa87c0f276da0ece
-
Filesize
5.3MB
MD5a6d08e8e290c80822842015cd877d405
SHA12ee9d28e20a73facff20be87092e482b562dad41
SHA256950ff7746d747de51cc09c1aaaf88fbc2fc97c59865f574cc3fb10243ae7b906
SHA512b6dfc3d0ef4f57c116d44b201fae187c9427d4fe7cad969f50f9408af40071d811e88698134491f479923b259a47d0b528e7ea23790248314e902ee24d0b93a2
-
Filesize
89KB
MD543aae7bfb0c911e7e98003e2b45667e6
SHA10c6c7d96cd0eca734e425b1ddef178c3ab6c31ce
SHA256a78e7988c9f99bcbe02d29441b0dcbdebafa616d2a4652aad867b81f554a0476
SHA51233d1293a7905ee9ec58b9a7744981006d6dadafb75ef64769723de02ba273f344a20e20d206d64d2453746549fe471328a035e2b5cc8e485e7cfd2c2fbc7c6a9
-
Filesize
89KB
MD50d5451a0050f7acc970ca02459c63d9a
SHA12de9febca0b1d48014081907e835237c832c65b0
SHA256864958960b8dd2890d47f2774ba836954f2c4f5ad6e4d529b13138caefcce73e
SHA5124d0b3d3d494c1774ae4575eb945f3c0742b723d6583d98dd36cc51a1d099b8f1a090d4b18c54897d1d58a67381b800604724cb609447860105bc2e0e8d5094a8
-
Filesize
4.1MB
MD545109081338654c25e42aea404b7d40c
SHA17474003f1dffb4439381cb628ded660d28a41bdd
SHA25600fbdecf2f47d72cdd20a60d685d5d0f56e1f5ec571a7e43eebe1b178285eb76
SHA512cb89ea354aacf4560ab59ccbf1ae5f9d4913b0b4b6130bdaeb6f8eced7844c416875d0303e0f141165ca1681f6b9728d46a96fa44b3a2eb45616d904658179e2
-
Filesize
247KB
MD5cc064d4b81619991de8131a86ad77681
SHA188d80d86cc20c27d7d2a872af719300bd2bb73f9
SHA256913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
SHA5125aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25
-
Filesize
2.6MB
MD5b20bbeb818222b657df49a9cfe4fed79
SHA13f6508e880b86502773a3275bc9527f046d45502
SHA25691bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
SHA512f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4
-
Filesize
309KB
MD51f759e1b809cc291bbea00b43c6e9f74
SHA14038059d53fd925a9142642bbfd800e196ed888f
SHA256044969556a9ff7bfeb95cf1cc30fee41e57417814192749a6e7b2820ea1803c8
SHA51223682155c290c46c4673a80b6775f9e92ba1c855c4609454ed258d23f7a97cd5adff3a709a7348759755aeb941b71f4f13c7cd7288be4270aa772ef679774fdf
-
Filesize
3.8MB
MD5fa135204bb6146fca799cf06d30c444c
SHA1774b9fd7ca76502ae6c732432377d71dfd75a15a
SHA256cd7eb3fe76c008e2af85cab033f620e04e22af941797083a5fb51e269bb8fcbb
SHA512b2c20573b92766353db601a31d4409397fd5de3a32f9bde4b3e627b48c5b859d33c93f96ecb0c177eb16768f5dd744394857a078a7302fdf0f0e4f5d2543b73a
-
Filesize
16KB
MD5bbb6da44d8362fd537c23341fb6273c6
SHA1caa9bf037f0425eb387f1ed31e98f775cbd852d9
SHA256084e414012b8e540be08c7f290bc069081292e94dad7c48c7861f7b363d249a7
SHA5129efcff4620d7b1ddc9aa1157d750d91cb6f157bf722ae943947053b17122c6aabcc76f4b1af111674d1e4c510fe1f36af9338131b974ed898b72afeb0547963d
-
Filesize
392B
MD5d0a5054d40731088904cefca1b565138
SHA17401d6e2d6f7c6830bb0c4c81dc242b5472a4f2c
SHA2562ed06b333c8671ae4e53c587c4c9a87a47ae0dfb24a32b087505188ffb5aeaf2
SHA512e16900567b254a823e25b001c8b5c647e9e1c4c95587384771a7e61a0898d895619f4c7b4bb6659e3eadc431e1ca9a78b0014e09a5bfe97f54c38ed83b816f56
-
Filesize
2KB
MD5bf5d8aa7c3afbd357a421f6c7ab829df
SHA1aac10da1c2b4fc7acdfa9c9d0c25461603a946bd
SHA2567149a2c196440e2a695abc23f65d601cc5191717acbf4cb43cf55c6d942baac1
SHA512040a93787f5bb2065cdb8bbeb8ae3648c230c7a0ecdc06e1127fcc1206ee5d54973e6c096819d7499777a174cdf79a5701a9d932f04dbba5b702e9fd2d053aa7
-
Filesize
2KB
MD58c771f976d54dc8c8ac678887724cfb2
SHA1f9d6394784d4c57c05f743bda1595f6f70e95790
SHA25681842dbb4fc12ed0f1045c03ce9d9fb1ca1da1fc9ede02b29b9652c1793e5df5
SHA5121f309f576f5331edde6494e156a3faa7c509ff6b3e3ced26c0f08f8ac007ffcf7673c79d874aabd669a92a3454acf458c4fd104389dc3300c3487b34e28e5f34
-
Filesize
6KB
MD51e47ee7b71b22488068343df4ce30534
SHA1deaee13f21ab70b57f44f0aa3128ec7ad9e3816a
SHA2568518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
SHA512c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
117KB
MD5a52e5220efb60813b31a82d101a97dcb
SHA156e16e4df0944cb07e73a01301886644f062d79b
SHA256e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
SHA512d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
-
Filesize
2KB
MD5fbfcbc4dacc566a3c426f43ce10907b6
SHA163c45f9a771161740e100faf710f30eed017d723
SHA25670400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
SHA512063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
-
Filesize
5KB
MD50056f10a42638ea8b4befc614741ddd6
SHA161d488cfbea063e028a947cb1610ee372d873c9f
SHA2566b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
SHA5125764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e
-
Filesize
24KB
MD57bfa56d222ecc4267e10c01462c6d0d9
SHA19b3236a45673ff3bb89df3e690784b673ae02038
SHA2566eeb255e1d5333a7b4f1b62e36afa1bea5cfd6c7e32058bb3a9efebc4d9f2ad6
SHA51210cec6bfd08a8b7cac1acbc3627cb014554ba71f44eb4bfe5b1471b81d6d292fd83a352d553af0de75fc1668a1f13d7f6f6c7bf1c6524117f363a3a7fc9b09e9
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
140KB
MD589d36fccb34b319b60d1850863e0560b
SHA1f356410e3946063b85750f54998582510b9672c8
SHA25660714fcdac0a7cbfc45e6ed9bc6d4b7f8536947f630016e5faca5cce1745adcf
SHA51224e167d0305811409e433c8d78716e9b3af4bce4b3f372276f4730ae7c802b8be8f193a70ac0d44ad6e083a35f03fcfdb2faaae4a9975c9e2ef1254285b0309f
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
547KB
MD54138c31964fbcb3b7418e086933324c3
SHA197cc6f58fb064ab6c4a2f02fb665fef77d30532f
SHA256b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29
SHA51240cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557
-
Filesize
834KB
MD5f0995d5ebde916fa146f51d324cf410c
SHA16a03e96a663051683b82601b5c7be72d72ecdb1c
SHA256f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b
SHA5128a2ca604c06077a1c5a7ac9782ff6815a4ea1b152502707120cf5a8edddcda7c8d1a71e16c80305a3fa098acb6ecf158c770e6d0a9cb2e57a9d875fb935664b8
-
Filesize
23.7MB
MD5ed4bc22138d19d1c4f9c545cced426c3
SHA1773ca2de988a260e2c627172f5b75b8624dc3b7e
SHA256bd25b512d7072e97e30bc1a615c966816e7c9acc1895e5951d5706e08a99ae86
SHA5126965781eb42f51808909774c1b46904815697ec5baf45fb3f48806494af28ec10e7a7d5724d038b2647e086e82780a55907c44f3294640b8edf09e9da499ec05
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\Volume{83bffa96-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{89c6e840-3afa-4fd6-ad0c-409be0c4f68a}_OnDiskSnapshotProp
Filesize6KB
MD51c95eaae3c6ba6f81523d695e4043591
SHA108c9a1ec2c9c47b67c63f7cca800146e6c360b74
SHA25676d4cb577dac7b638eb653cafccce8c4e58add17872192c7f89a30f802b7637d
SHA512732c925ebcad7a4a3db38bf6a14e0cb5c2f519b92585a192aa372f1ccf9356b1b4122cf238bd9d10a0f95fca7b628f7190b8d2747063d0f77d0cf0324743bb84
-
Filesize
3.7MB
MD50ee84ab717bc400c5e96c8d9d329fbb0
SHA1be4ba7bbb068c7256b70f4fd7634eaeb2ad04d0a
SHA256461d575bc1a07f64c14f1da885d2f310bd282cbbedcd0a5cf8ffa7057411805d
SHA5124a6b0619f471a51df09fb6c1eff4ed166cdb7ef57f79ffdf709fa952a7c2a176c338084689c8ace1a94024a24579e9ee0ab6d411c25a1b42b0f517c57749d1a2
-
Filesize
3KB
MD5f187c4924020065b61ec9ef8eb482415
SHA1280fc99fb90f10a41461a8ee33dbfba5f02d059d
SHA256cfa4f2c6c2a8f86896c5a6f9a16e81932734136c3dfde6b4ed44735e9c8115c2
SHA5121d5a8e80fb6805577258f87c4efd7c26a9ac1c69f7dea1553d6f26bcc462d2d9c01d4b94077f70110a33b39648c9aa3bb685e10534f19ba832d475e9ee6aa743
-
Filesize
15KB
MD53168ed3b48c1dc8d373c2abc036574cf
SHA17ffbcfb6cd9b262a0e9a55853d76055693f60c60
SHA2563e4d78fcc11eecb23af12a4eaa316114bb36d39561f6062a3921c08a43261321
SHA5129465640705c382bb736e468a2ffb303ecfb2637c55ddca759d1fb190279b98103def64a8c599deaa1439e58c41d7b2c2809332c2a5f18945e9ee3d6c046a5197
-
Filesize
9KB
MD5162fc8231b1bd62f1d24024bb70140d5
SHA17fa4601390f1a69b4824ee1334bee772c2941a24
SHA256c68a0fd93e8c64139a42af4fcd4670c6faea3a5d5d1e9dd35b197f7d5268d92b
SHA512a707b5ef0e914ba61e815be5224831441922ed8d933f7a2ffe8aecf41f5a1790a1e45981f19d86aa5eab5ea73d03b0c8e2ab6b9f398ab0154d1c828da6f6beda
-
Filesize
11KB
MD5c360851dfdf51b6ddc9cfcc62c584898
SHA1f8fbe6b98039d01700dc49eb454bb1c1d8cc4aa6
SHA2563456ebc9c6decef8b27b10d97f7f6d30a73b5da0024e1b8a0657e3b9a1cc93d9
SHA512a340a7d98b4b6f925a803805224e733433e76230a36c4ab17e28f9d5951b81280d776153414701b29bb05b496b726932683e35fb603587d7ff5b716a88fece8d
-
Filesize
13KB
MD504b833156f39fcc4cee4ae7a0e7224a1
SHA12ffa9577a21962532c26819f9f1e8cd71ab396bd
SHA256ebafaeb37464ed00e579dab5b573908e026cd0e3444079f398aada13fa9a6f66
SHA5128d3f6a900ebd63a3af74ab41ac54d3041de5fe47331a5e0d442d1707f72a8f557d93d2f527bbb857fb1c67dd8332961fd69acc87de81ba4f2006c37b575f9608
-
Filesize
5KB
MD5031fab3fb14a85334e7e49d62a5179fe
SHA112370185ef938a791609602245372e3e70db31be
SHA256467773ddffdb3f31027595313b70d1ea934c828b124d1063a4aa4dbe90f15961
SHA5127424a52bbb18a006816ee544d47f660e086557d13bb587d765631307da96aba56d8b9cd3d4e7d50c2a791815273910cef95ebe928bc03dd9c540b97ac7a86447
-
Filesize
5KB
MD56fcd6b5ef928a75655d6be51555288c7
SHA1eafdcc178343780b83f1280dad9d517aaedab9e4
SHA2563d45f022996cd6d9ebb659a202fbfd099795f9a39ed4e6bbd62ac6f6ed5f8c7b
SHA512635ba44d8d8ecfbdb83a88688126f68c9c607e452e67d19247dfe7c307c341dad9b1d2dc3eae56311c4b3e9617ab1ee2bd2a908570df632af6de1e1fa08bf905
-
Filesize
13KB
MD5bc3a8865b60ec692293679e3e400fd58
SHA12b43b69e6158f307fb60c47a70a606cd7e295341
SHA256f82bca639841fa7387ae9bbf9eca33295fab20fade57496e458152068c06f8a3
SHA5120d9820416802623e7cd5539d75871447f665481b81758c08f392f412bc0fd2ef12008be0960c108d1c1ce6f26422f1b16161705104d7a582df6a1006b0d1b610
-
Filesize
3KB
MD5ec4b365a67e7d7db46f095f1b3dcb046
SHA1d4506530b132ef4aad51fcbc0315dadc110c9b81
SHA256744275c515354ece1a997dd510f0b3ea607147bbf2b7d73f8fca61839675ba27
SHA5125e5d1e196fc6ac194589bc6c6ab24e259aed8cbd856999390495fd5ec4211f212c6898e1b63538bfbb4401a5b4da08f3a2e09bca1cfb2e9c2cee38e63190b2a2
-
Filesize
12KB
MD5c2d1221cd1c783b5d58b150f2d51aebf
SHA13bc9b6419a5f9dcf9064ae9ef3a76c699e750a60
SHA256c79ff7b9e67aed57f939343a3d5fd4fb01aa7412530693464571148b893b7132
SHA512c4ec596814b408e3c0aaf98864e2769c6175dba020f3014dd79f0190d81812020c932afca449e6b8b35233f36f2ab2efad0dc8d0d68dccdb40f6715fb1d050b4
-
Filesize
1KB
MD50a6b586fabd072bd7382b5e24194eac7
SHA160e3c7215c1a40fbfb3016d52c2de44592f8ca95
SHA2567912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
SHA512b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
-
Filesize
841B
MD5f8f6c0e030cb622f065fe47d61da91d7
SHA1cf6fa99747de8f35c6aea52df234c9c57583baa3
SHA256c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d
SHA512b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde
-
Filesize
71KB
MD58c2c1df03574e935277addc6e151bdbe
SHA133f7eae718d6704ea99d7c7803207dbe0d1ea3a0
SHA2561074252f76e72e59a9da9d7e109c80ab131d53554c49cb3d69a180729bffc18e
SHA512735c438da7fd3e4e0e4738ac11c87a73ce3cacbaa24b21994ec76868e70fc485469337eb6e067e20bb92210995ffb3c385677fcc986c4c34f24bfde6b91ba0c8
-
Filesize
90KB
MD56f22a8ecc5a917c61f1478ef4ad53949
SHA1180c370698091e53f203d23eb6c839467deebfb9
SHA2562c5fa53e6eb07bddc22c7c5203ff7bbe707c4cf8803f144ceb031384b59831aa
SHA5128513f09da143983d436368c6067a62f1829d5d66776a168026f7562f8337d8e1bc8df2ff9ab421f4cc7d75757a0e9b8a75f3761c9e8aba7d0785d2fcb1b00a93
-
Filesize
85KB
MD5ff6003014eefc9c30abe20e3e1f5fbe8
SHA14a5bd05f94545f01efc10232385b8fecad300678
SHA256a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067
SHA5123adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2
-
Filesize
91KB
MD54d431f94a7d0945f4a7f13b7988632aa
SHA161461b14b57382eebb3bf4621b7dadb0cb2475b3
SHA256cb38381c0afdcb3465f71699addad7534ffd72702907b017708eba463dbc68b6
SHA512e4197801c20dfce7dc14d5d74aa572de18954dceaaca77a75bf989427c6ff7d5889085e5c325376a993ad290ee43ab25e0f6bea074fed3d5158e0fd4c785aeca
-
Filesize
89KB
MD5ef1ccfe8572cdaaefb1940efbbff6d80
SHA1b1d587c8fdb3ca82c320d08379ca7bd781253e3f
SHA256709ab0139c643b78c2dace7a35b9801e1a4b4e4c4e176c0d00f1b55a2a71d7a8
SHA51298538c82d56b6e0e9f0ca7cf47a6ce57e0acd18b2a64b90304a95a3c7270920efb835731272200afa16e45dfd461df94f95da04f39c2436915dc6969a4a0ebce
-
Filesize
76KB
MD56bfb58958d58bf38e9242b2056392b8c
SHA1f4c4653e061eb903ddae29f0d6a798db6ab5bdf4
SHA256f74006aaa2a19777fb0c3b81321aabf00d87107dc23ba0d2282092502e5cd332
SHA512672727552812c7d7b775896096d556851d6990b2d9c24c0e2c728f6c720b47c156d2ec2ce7ef23126fd222178969aff848f06568f695d154d6f7836ecf222d88
-
Filesize
74KB
MD5ba91e387d54b94689644ebd23ff264ba
SHA1267b0af1774b6440cac00fad6524f277fde09457
SHA25616fed8f279b0240f63dd90925150cd37782e9395af32a2693bdc0533c0809767
SHA51279e818ffc57880a9881d771c0ea607d64a2cbdad29b28a270138d4d03edb8b026e7536e89396968c8454c56c740d198e67a75cac3e2447ca120b7cffefa4c0bd
-
Filesize
87KB
MD59aac6ce2ad6c7aee5481e46ddb0ad0dd
SHA1dabd5e299a4595b1341f47313ac26c663d79a7c4
SHA2563de25f7b3fd91a8d5b7f7dd8eccf44e24b33b66133fc89519d21a426b489374e
SHA51297e00a50d3e8c8954854cc44f36049d63d8f1860e547a511feccf4214ff0560079b5512053aea4c2a40769d58738934d69c1a45186092ff11af1b907395dd126
-
Filesize
70KB
MD5208f1260b7145b19434a8c95ff7c0474
SHA16a0a74affdc8f988873841b7073f428056a8aa5d
SHA256f6d949f493cb9b1ba5ee053acc7363bc9675b9e8b3f25258080092001036e6f4
SHA5122e9cf1ed7944a6246a2f3febee99d0a36759191664e83aee3c14424b64785a134fe9c50e9e5deaaab1095ae298a2f49aac2037f64a127d250af973a077a7e03a
-
Filesize
90KB
MD5dbbe392a7536c76ec60a21e211eb3210
SHA1e1cead8b1e0fd41e9ed79f4921c5e40c2d739dda
SHA2568de447ae460de91144ec92381c8315a125b25020ac7601bbb721d56a92d0fd0f
SHA512f725bc786076947874cc58b9591445064b3f133c75865bb1d661e95f29f1a9556447ee3f385a38f9438561e35e6cfa8208dbc938d3304c415cc25ed85c29f15d
-
Filesize
222KB
MD57e641e6a0b456271745c20c3bb8a18f9
SHA1ae6cedcb81dc443611a310140ae4671789dbbf3a
SHA25634c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d
SHA512f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903
-
Filesize
5KB
MD506fba95313f26e300917c6cea4480890
SHA131beee44776f114078fc403e405eaa5936c4bc3b
SHA256594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1
SHA5127dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd
-
Filesize
70KB
MD5d75cebdd99c3c2562ae2cbbb6a8b62e0
SHA10dcc32820df90db71429e6e91f962d94584313c4
SHA2563b603f4847c32f21b4dfc949052ebadb0b191f6caac373e4936e47b27b96cd7a
SHA512aad9ce212700b0135f230f4f8b48c2abf2516502b01c2a428f8e4177df1dbbd77e904892202fd257a9c8f97039c1caedb6f72103089ce2402a7868465729f58f
-
Filesize
89KB
MD5f937d452e3f75ea9c9983b5674793275
SHA12d6e30b23ccec84f0754cfc4c90ae909768f14bd
SHA256a2b2334a1dcfd2eefdda5a1c357ca0a256c55c92a94f84204f8e2d6ca4e0bd82
SHA51265a0753be4dc25be41eebcf3d55dfdae1dc8d69132d8c02bd0d5cea2c8e963e3bfdc562b6182f8ddadb72801bfb5d911314a292a47269e9c51ec2d7bb34abbfc
-
Filesize
84KB
MD5e8ed5b7797472df6f5e1dae87c123e5e
SHA171e203899c3faf5e9eb5543bfd0eb748b78da566
SHA2566ad479dd35201c74092068cccd6d12fd84a45d2c04e927b39901a9126f9e06dd
SHA512dfdd6bba404753f6afbc804551550bdc771eccc034c01f4c5149beb6d98424cf7b86fc63aac361a1840df9bc8365c726baab672055534620db70ca2c0e2e1b3e
-
Filesize
90KB
MD5b129551419e06befddaa3c38354ffc2a
SHA19896b9d778911e6f8bf5896160a5ce322b1e7b62
SHA25687700397b469cb0ea59ae6534370218c42c9b9fba636741612a5300dd72ff530
SHA51215de906c4a70b47bbcc0bcd5ab9dab9eabd746207b40957c00cba4fe328a310672d04868672a9e70986befe00f393e4b21420ea2cbccd1c18e1fa97a3d74b9b5
-
Filesize
88KB
MD521b98229cf651ae83f213b6bf55f9660
SHA13a1a5e800194bf0889a2fb73f9f08f815d036556
SHA256128b2be768e20129142af7f319cf7a761ead35ff311623d128a7b372033b9122
SHA5120a1b8ca0469e322b9fdc0dbe4de8bb45ced13ff97ef156d3c84787cfbcb6264ccb46ef26fd135bfb848425aa77e3430a91b8753c8e1af1778880eddc3ff0b0fc
-
Filesize
75KB
MD57cec13259a3b49959bef5856c3985458
SHA142f7a813a9175a4ea7e64800affc3a2043f1c201
SHA25658a7d64dd55d6057e19c039abb1508920f6a33940f4612ac55a90fb74dfca28a
SHA51213b272a062173f76a5c8b4c193abe67cb1c066e8a7f030177f4b26043c8f3824ba6da9c2cd9bb779330fc72c535d893f668fa186bf395864f1fcc021ae3f9dc8
-
Filesize
73KB
MD537723237b2d38c4a4c996a91fd2da0a5
SHA1b6f267299e309d0a39b359c19296598e4c23f93c
SHA25605e79bf81fe87ba3db89950cea02ae78e3b7b1c2d6575f19df47c4f5d7888566
SHA5129c4ac383f60829a56c1e2fc77b92db0325658b048271269eea7bf5a552a21222757852776b79b17b190d2961c0306ee2f9d8ad3a51aa58d1daca842ea6975d8c
-
Filesize
86KB
MD59536e2675dde8f2d6ea8c8e26b232f23
SHA14efa83f14458e3514a3ac3b1cdc2ae388bc78430
SHA256386f3b2c5b6316963f353cf2bb3dba69ff6e82e2166c010a87813dd54637a49c
SHA512e31ea9444263833ceedcc9f036cff5eab88f710716b7ddf2d25c98aa088454258c3f34fc664b39da084b2650aade89ff1369e240d1935697bb6949af828a5542
-
Filesize
69KB
MD5d442fdaee21df6d1f8d3f5b37fce69a3
SHA1978b32638c9a88f47b55ca6b52f510ed7babc1d6
SHA2568eb88b40484b34fc712fae8a31a5e35042712ae57c9dddefd1e5746d949d5a03
SHA512bbe32be6853400a9afb649a536b0a16524b06fdd6d8e5455ec387e3eced02172a9f5494b431deb90feb16ce73e67d3c11b56b43148c2936ed39e35077eb0bd15
-
Filesize
89KB
MD5cc0e0618dcd3275de406316091806f77
SHA11ee7e9c4515ff276e2e91777b61e10d7fd74b6b3
SHA256847bb5d0992fdbcfb90e00ba66fbe8992926d5d5b9b03f3cf1888ee8af600cf8
SHA512140684e5e7541e40384441917f3d727f4385b5b4552821ed2e766b7abe4660c9c94084a0a1da1aa95afac83ca1b465b1363640eaef0e905a402aad88f09f8072
-
Filesize
230KB
MD54aa5bbddbf6b2d1cf509c566312f1203
SHA10557e25cf4c2aa1bcb170707cd282ae864d93d17
SHA256017e62a7a046acf00f5565e60f8eed4c5f409913e7ddc2f431d4236bbfdabab8
SHA512e32fad32aefb70592eec56c55eaf65d6a6ed33939a6cabe7ff0ec33f91c4687001a41575ccfcac448c4739b2af4e309c2ec9e526104fb292d04aa8746dfad8f9