11bf7c54256c89405c7afd1a73baff4d42afd0dfb7e8bb9279c910e12db7acdd

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

C++/install_all.bat
Size

1016B
MD5

b0bf1e90c7cf6d8271a0f367f0712540
SHA1

1ff6235e15cb9ffef8f70add81b79ff517c79a5a
SHA256

26fdb6604becf2812300ff71c220033f0ebab088c7408a6538b768b254d6508f
SHA512

74d76ea4d4896e70b486b237bb3d921a3e5acbcd49b672046665d2c87970c1bbd10dd278efb59a65942a30f7ca9c5c7c3f40a54954643190171a3dd10c8a64c1

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Executes dropped EXE 6 IoCs

Processes:

VCREDI~3.EXEVCREDI~2.EXEinstall.exeinstall.exeSetup.exeSetup.exe

pid process

1948 VCREDI~3.EXE
2460 VCREDI~2.EXE
3044 install.exe
2920 install.exe
748 Setup.exe
2348 Setup.exe

pid	process
1948	VCREDI~3.EXE
2460	VCREDI~2.EXE
3044	install.exe
2920	install.exe
748	Setup.exe
2348	Setup.exe

Loads dropped DLL 64 IoCs

Processes:

vcredist2005_x86.exeVCREDI~3.EXEMsiExec.exevcredist2005_x64.exeVCREDI~2.EXEMsiExec.exemsiexec.exe

pid	process
2440	vcredist2005_x86.exe
1948	VCREDI~3.EXE
1948	VCREDI~3.EXE
1948	VCREDI~3.EXE
2804	MsiExec.exe
568	vcredist2005_x64.exe
2460	VCREDI~2.EXE
2460	VCREDI~2.EXE
2460	VCREDI~2.EXE
852	MsiExec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vcredist2005_x86.exeVCREDI~3.EXEvcredist2005_x64.exeVCREDI~2.EXEvcredist2012_x86.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	vcredist2005_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	VCREDI~3.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	vcredist2005_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	VCREDI~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} = "\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_x86_20240813222723.log\" /passive /norestart ignored /burn.runonce"	vcredist2012_x86.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in System32 directory 36 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\atl100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\atl100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100enu.dll	msiexec.exe

Drops file in Program Files directory 6 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exevcredist2012_x86.exeDrvInst.exeDrvInst.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\WinSxS\InstallTemp\20240813222711242.0\mfc80KOR.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\f76c408.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222655486.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\Installer\f76c3f1.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711242.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\Installer\f76c405.msp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222655813.1\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711242.0\mfc80CHS.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CBC.tmp	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	vcredist2012_x86.exe
File created	C:\Windows\Installer\f76c3ee.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711242.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_3ed5eb6c.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711242.0\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711304.0\8.0.50727.4053.cat	msiexec.exe
File created	\??\c:\Windows\Installer\f76c3fe.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222655688.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711242.0\mfc80DEU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711288.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_19a62d03.manifest	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240813222711320.1	msiexec.exe
File created	C:\Windows\Installer\f76c40e.msp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI802.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711195.0\mfc80u.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\f76c405.msp	msiexec.exe
File created	\??\c:\Windows\Installer\f76c40c.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3BB0.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222655486.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e.cat	msiexec.exe
File created	C:\Windows\Installer\f76c3f4.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711195.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e986d26e.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711242.0\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711070.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_79404cdd.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711164.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_18a05f69.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711288.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_19a62d03.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240813222711351.0	msiexec.exe
File created	\??\c:\Windows\Installer\f76c3f9.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711242.0\mfc80JPN.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\f76c3f4.ipi	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\f76c3fe.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76c411.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI2069.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711304.0\8.0.50727.4053.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222655486.0\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222655782.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e79c4723.cat	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\f76c3f9.ipi	msiexec.exe
File created	\??\c:\Windows\Installer\f76c403.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222655688.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222655813.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711195.0\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711320.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\Installer\f76c408.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC65D.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222655486.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e.manifest	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240813222711335.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3095.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222655829.0\8.0.50727.4053.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\f76c3ee.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711351.0\8.0.50727.4053.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222655486.0\mfc80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240813222711164.0\msvcp80.dll	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe

Event Triggered Execution: Installer Packages 2 TTPs 2 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exemsiexec.exe

pid process

3044 msiexec.exe
744 msiexec.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2548 2068 WerFault.exe vcredist2012_x86.exe

pid	pid_target	process	target process
2548	2068	WerFault.exe	vcredist2012_x86.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

vcredist2008_x86.exevcredist2010_x86.exevcredist2010_x64.exeSetup.exeMsiExec.exeMsiExec.exeVCREDI~2.EXEvcredist2012_x86.exeVCREDI~3.EXEvcredist2005_x64.exevcredist2012_x86.exeinstall.exevcredist2008_x64.exemsiexec.exeSetup.exevcredist2005_x86.exemsiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist2008_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist2010_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist2010_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VCREDI~2.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist2012_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VCREDI~3.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist2005_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist2012_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist2008_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist2005_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exeSetup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exeDrvInst.exemsiexec.exeDrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\33	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\35\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35\52C64B7E	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\35\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\33	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\35\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\PackageCode = "83DB259064B8669479679DCD441743AC"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_ATL_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches\2D0058F6F08A743309184BE1178C95B2 = ":SP1.1;:#SP1.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\KB2565063 = "Servicing_Key"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\Version = "167812379"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Version = "134276920"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\KB2565063 = "Servicing_Key"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e006f006f0063007b006200340036003f004500380042006a005f0079005d005d007e004f006f002c0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\4D54076CED4F5BA32BBD3E5FAD1CD4C9\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004d00460043005f007800380036003e005500410049003f00470048002e007b005d0037006a005a003f0034005d0041006e0062002400420000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.OpenMP,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800360034003e0061005b0046005f0031006a0048006a005d003300680065005f004f005400590026006b003f00400000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\FT_VC_Redist_CRT_x64 = "VC_Redist_12222_amd64_enu"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches\Patches = 3200440030003000350038004600360046003000380041003700340033003300300039003100380034004200450031003100370038004300390035004200320000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f004f007700390052005a004800670055003f005d004a004b0073002700780077005a0043003200560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\KB2544655 = "Servicing_Key"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\VC_RED_enu_amd64_net_SETUP	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004300520054005f007800360034003e0028002e006f0034002e0054004c005e00690033005a00760060007d00610026003f0049002900260000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800360034003e007900700040005500210076003f005400490037006c007a004c00450075005a003d005a003100730000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e00550029004600250024002a0025005a00370038002c005d007b002d007400430064004f003700310000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004d00460043005f007800380036003e00660074005a003f002800770035002b002e0034002c007e007b0044004700380037002b007800260000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_MFCLOC_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFCLOC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800360034003e0077006e002e005a006000290063004000760034003d004b002c0044004f00360056007e0028006e0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\LastUsedSource = "n;2;f:\\22742ff52a9d7ff4945e43\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\Net\2 = "f:\\63d6867ed4be8917fad0fcdd\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\VCRedist_x86_enu	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\KB2524860 = "Servicing_Key"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\3e43b73803c7c394f8a6b2f0402e19c2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf\VC_Redist	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3e43b73803c7c394f8a6b2f0402e19c2\Servicing_Key	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f004f007700390052005a004800670055003f005d004a004b0073002700780077005a0043003200560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\ProductName = "Microsoft Visual C++ 2005 Redistributable"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\Assignment = "1"	msiexec.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 7 IoCs

Processes:

vcredist2005_x86.exevcredist2005_x64.exevcredist2008_x86.exevcredist2008_x64.exevcredist2010_x86.exevcredist2010_x64.exevcredist2012_x86.exe

pid	process
2440	vcredist2005_x86.exe
568	vcredist2005_x64.exe
2092	vcredist2008_x86.exe
2132	vcredist2008_x64.exe
2500	vcredist2010_x86.exe
1696	vcredist2010_x64.exe
1944	vcredist2012_x86.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

msiexec.exeSetup.exeSetup.exe

pid	process
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
748	Setup.exe
748	Setup.exe
748	Setup.exe
748	Setup.exe
748	Setup.exe
748	Setup.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
2348	Setup.exe
2348	Setup.exe
2348	Setup.exe
2348	Setup.exe
2348	Setup.exe
2348	Setup.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe
1660	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	3044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3044	msiexec.exe
Token: SeRestorePrivilege	1660	msiexec.exe
Token: SeTakeOwnershipPrivilege	1660	msiexec.exe
Token: SeSecurityPrivilege	1660	msiexec.exe
Token: SeCreateTokenPrivilege	3044	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3044	msiexec.exe
Token: SeLockMemoryPrivilege	3044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3044	msiexec.exe
Token: SeMachineAccountPrivilege	3044	msiexec.exe
Token: SeTcbPrivilege	3044	msiexec.exe
Token: SeSecurityPrivilege	3044	msiexec.exe
Token: SeTakeOwnershipPrivilege	3044	msiexec.exe
Token: SeLoadDriverPrivilege	3044	msiexec.exe
Token: SeSystemProfilePrivilege	3044	msiexec.exe
Token: SeSystemtimePrivilege	3044	msiexec.exe
Token: SeProfSingleProcessPrivilege	3044	msiexec.exe
Token: SeIncBasePriorityPrivilege	3044	msiexec.exe
Token: SeCreatePagefilePrivilege	3044	msiexec.exe
Token: SeCreatePermanentPrivilege	3044	msiexec.exe
Token: SeBackupPrivilege	3044	msiexec.exe
Token: SeRestorePrivilege	3044	msiexec.exe
Token: SeShutdownPrivilege	3044	msiexec.exe
Token: SeDebugPrivilege	3044	msiexec.exe
Token: SeAuditPrivilege	3044	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3044	msiexec.exe
Token: SeChangeNotifyPrivilege	3044	msiexec.exe
Token: SeRemoteShutdownPrivilege	3044	msiexec.exe
Token: SeUndockPrivilege	3044	msiexec.exe
Token: SeSyncAgentPrivilege	3044	msiexec.exe
Token: SeEnableDelegationPrivilege	3044	msiexec.exe
Token: SeManageVolumePrivilege	3044	msiexec.exe
Token: SeImpersonatePrivilege	3044	msiexec.exe
Token: SeCreateGlobalPrivilege	3044	msiexec.exe
Token: SeBackupPrivilege	2192	vssvc.exe
Token: SeRestorePrivilege	2192	vssvc.exe
Token: SeAuditPrivilege	2192	vssvc.exe
Token: SeBackupPrivilege	1660	msiexec.exe
Token: SeRestorePrivilege	1660	msiexec.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeLoadDriverPrivilege	2728	DrvInst.exe
Token: SeLoadDriverPrivilege	2728	DrvInst.exe
Token: SeLoadDriverPrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	1660	msiexec.exe
Token: SeTakeOwnershipPrivilege	1660	msiexec.exe
Token: SeRestorePrivilege	1660	msiexec.exe
Token: SeTakeOwnershipPrivilege	1660	msiexec.exe
Token: SeRestorePrivilege	1660	msiexec.exe
Token: SeTakeOwnershipPrivilege	1660	msiexec.exe
Token: SeRestorePrivilege	1660	msiexec.exe
Token: SeTakeOwnershipPrivilege	1660	msiexec.exe
Token: SeRestorePrivilege	1660	msiexec.exe
Token: SeTakeOwnershipPrivilege	1660	msiexec.exe
Token: SeRestorePrivilege	1660	msiexec.exe
Token: SeTakeOwnershipPrivilege	1660	msiexec.exe
Token: SeRestorePrivilege	1660	msiexec.exe
Token: SeTakeOwnershipPrivilege	1660	msiexec.exe
Token: SeRestorePrivilege	1660	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

msiexec.exemsiexec.exeinstall.exeinstall.exevcredist2012_x86.exe

pid	process
3044	msiexec.exe
3044	msiexec.exe
744	msiexec.exe
744	msiexec.exe
3044	install.exe
3044	install.exe
2920	install.exe
2920	install.exe
2068	vcredist2012_x86.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exevcredist2005_x86.exeVCREDI~3.EXEmsiexec.exevcredist2005_x64.exeVCREDI~2.EXEvcredist2008_x86.exe

description	pid	process	target process
PID 2408 wrote to memory of 2440	2408	cmd.exe	vcredist2005_x86.exe
PID 2408 wrote to memory of 2440	2408	cmd.exe	vcredist2005_x86.exe
PID 2408 wrote to memory of 2440	2408	cmd.exe	vcredist2005_x86.exe
PID 2408 wrote to memory of 2440	2408	cmd.exe	vcredist2005_x86.exe
PID 2408 wrote to memory of 2440	2408	cmd.exe	vcredist2005_x86.exe
PID 2408 wrote to memory of 2440	2408	cmd.exe	vcredist2005_x86.exe
PID 2408 wrote to memory of 2440	2408	cmd.exe	vcredist2005_x86.exe
PID 2440 wrote to memory of 1948	2440	vcredist2005_x86.exe	VCREDI~3.EXE
PID 2440 wrote to memory of 1948	2440	vcredist2005_x86.exe	VCREDI~3.EXE
PID 2440 wrote to memory of 1948	2440	vcredist2005_x86.exe	VCREDI~3.EXE
PID 2440 wrote to memory of 1948	2440	vcredist2005_x86.exe	VCREDI~3.EXE
PID 2440 wrote to memory of 1948	2440	vcredist2005_x86.exe	VCREDI~3.EXE
PID 2440 wrote to memory of 1948	2440	vcredist2005_x86.exe	VCREDI~3.EXE
PID 2440 wrote to memory of 1948	2440	vcredist2005_x86.exe	VCREDI~3.EXE
PID 1948 wrote to memory of 3044	1948	VCREDI~3.EXE	msiexec.exe
PID 1948 wrote to memory of 3044	1948	VCREDI~3.EXE	msiexec.exe
PID 1948 wrote to memory of 3044	1948	VCREDI~3.EXE	msiexec.exe
PID 1948 wrote to memory of 3044	1948	VCREDI~3.EXE	msiexec.exe
PID 1948 wrote to memory of 3044	1948	VCREDI~3.EXE	msiexec.exe
PID 1948 wrote to memory of 3044	1948	VCREDI~3.EXE	msiexec.exe
PID 1948 wrote to memory of 3044	1948	VCREDI~3.EXE	msiexec.exe
PID 1660 wrote to memory of 2804	1660	msiexec.exe	MsiExec.exe
PID 1660 wrote to memory of 2804	1660	msiexec.exe	MsiExec.exe
PID 1660 wrote to memory of 2804	1660	msiexec.exe	MsiExec.exe
PID 1660 wrote to memory of 2804	1660	msiexec.exe	MsiExec.exe
PID 1660 wrote to memory of 2804	1660	msiexec.exe	MsiExec.exe
PID 1660 wrote to memory of 2804	1660	msiexec.exe	MsiExec.exe
PID 1660 wrote to memory of 2804	1660	msiexec.exe	MsiExec.exe
PID 2408 wrote to memory of 568	2408	cmd.exe	vcredist2005_x64.exe
PID 2408 wrote to memory of 568	2408	cmd.exe	vcredist2005_x64.exe
PID 2408 wrote to memory of 568	2408	cmd.exe	vcredist2005_x64.exe
PID 2408 wrote to memory of 568	2408	cmd.exe	vcredist2005_x64.exe
PID 2408 wrote to memory of 568	2408	cmd.exe	vcredist2005_x64.exe
PID 2408 wrote to memory of 568	2408	cmd.exe	vcredist2005_x64.exe
PID 2408 wrote to memory of 568	2408	cmd.exe	vcredist2005_x64.exe
PID 568 wrote to memory of 2460	568	vcredist2005_x64.exe	VCREDI~2.EXE
PID 568 wrote to memory of 2460	568	vcredist2005_x64.exe	VCREDI~2.EXE
PID 568 wrote to memory of 2460	568	vcredist2005_x64.exe	VCREDI~2.EXE
PID 568 wrote to memory of 2460	568	vcredist2005_x64.exe	VCREDI~2.EXE
PID 568 wrote to memory of 2460	568	vcredist2005_x64.exe	VCREDI~2.EXE
PID 568 wrote to memory of 2460	568	vcredist2005_x64.exe	VCREDI~2.EXE
PID 568 wrote to memory of 2460	568	vcredist2005_x64.exe	VCREDI~2.EXE
PID 2460 wrote to memory of 744	2460	VCREDI~2.EXE	msiexec.exe
PID 2460 wrote to memory of 744	2460	VCREDI~2.EXE	msiexec.exe
PID 2460 wrote to memory of 744	2460	VCREDI~2.EXE	msiexec.exe
PID 2460 wrote to memory of 744	2460	VCREDI~2.EXE	msiexec.exe
PID 2460 wrote to memory of 744	2460	VCREDI~2.EXE	msiexec.exe
PID 2460 wrote to memory of 744	2460	VCREDI~2.EXE	msiexec.exe
PID 2460 wrote to memory of 744	2460	VCREDI~2.EXE	msiexec.exe
PID 1660 wrote to memory of 852	1660	msiexec.exe	MsiExec.exe
PID 1660 wrote to memory of 852	1660	msiexec.exe	MsiExec.exe
PID 1660 wrote to memory of 852	1660	msiexec.exe	MsiExec.exe
PID 1660 wrote to memory of 852	1660	msiexec.exe	MsiExec.exe
PID 1660 wrote to memory of 852	1660	msiexec.exe	MsiExec.exe
PID 1660 wrote to memory of 852	1660	msiexec.exe	MsiExec.exe
PID 1660 wrote to memory of 852	1660	msiexec.exe	MsiExec.exe
PID 2408 wrote to memory of 2092	2408	cmd.exe	vcredist2008_x86.exe
PID 2408 wrote to memory of 2092	2408	cmd.exe	vcredist2008_x86.exe
PID 2408 wrote to memory of 2092	2408	cmd.exe	vcredist2008_x86.exe
PID 2408 wrote to memory of 2092	2408	cmd.exe	vcredist2008_x86.exe
PID 2408 wrote to memory of 2092	2408	cmd.exe	vcredist2008_x86.exe
PID 2408 wrote to memory of 2092	2408	cmd.exe	vcredist2008_x86.exe
PID 2408 wrote to memory of 2092	2408	cmd.exe	vcredist2008_x86.exe
PID 2092 wrote to memory of 3044	2092	vcredist2008_x86.exe	install.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\C++\install_all.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408

C:\Users\Admin\AppData\Local\Temp\C++\vcredist2005_x86.exe
vcredist2005_x86.exe /q
2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2440

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\msiexec.exe
msiexec /i vcredist.msi
4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3044

C:\Users\Admin\AppData\Local\Temp\C++\vcredist2005_x64.exe
vcredist2005_x64.exe /q
2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:568

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\SysWOW64\msiexec.exe
msiexec /i vcredist.msi
4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:744

C:\Users\Admin\AppData\Local\Temp\C++\vcredist2008_x86.exe
vcredist2008_x86.exe /qb
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2092

\??\f:\0a5f283501281acf4721ce\install.exe
f:\0a5f283501281acf4721ce\.\install.exe /qb
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3044

C:\Users\Admin\AppData\Local\Temp\C++\vcredist2008_x64.exe
vcredist2008_x64.exe /qb
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2132

\??\f:\22742ff52a9d7ff4945e43\install.exe
f:\22742ff52a9d7ff4945e43\.\install.exe /qb
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:2920

C:\Users\Admin\AppData\Local\Temp\C++\vcredist2010_x86.exe
vcredist2010_x86.exe /passive /norestart
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2500

\??\f:\63d6867ed4be8917fad0fcdd\Setup.exe
f:\63d6867ed4be8917fad0fcdd\Setup.exe /passive /norestart
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:748

C:\Users\Admin\AppData\Local\Temp\C++\vcredist2010_x64.exe
vcredist2010_x64.exe /passive /norestart
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1696

\??\f:\b0bf7302c57fd8e47b\Setup.exe
f:\b0bf7302c57fd8e47b\Setup.exe /passive /norestart
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2348

C:\Users\Admin\AppData\Local\Temp\C++\vcredist2012_x86.exe
vcredist2012_x86.exe /passive /norestart
2⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1944

C:\Users\Admin\AppData\Local\Temp\C++\vcredist2012_x86.exe
"C:\Users\Admin\AppData\Local\Temp\C++\vcredist2012_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{0D11C9D6-6F6E-48C6-A36C-2E9532250AC0} {985E72E2-2B4F-4BF0-A326-A0247D9AB664} 1944
3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 344
4⤵
- Program crash
PID:2548

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7DFC15B2E986DBCFDEADF5D9275C9F27
2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2804

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 56B612D4BB5E4705D9D2B3DDEC6EDC24
2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:852

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005C8" "00000000000003D4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot20" "" "" "65dbac317" "0000000000000000" "0000000000000300" "00000000000005D8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2180

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot21" "" "" "6f9bf5bcb" "0000000000000000" "00000000000005D8" "0000000000000300"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1416

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76c3fa.rbs
Filesize
29KB

MD5
9f66e6d8839004132c19e1cc071ade1d

SHA1
a29abb5d787dfa43fc072edcf54c41b59e5d15e8

SHA256
d63e356d42788614101984760fd14710328cd2d9c44985bfd966136e6c5ce390

SHA512
e85162e131571fbab68222356030fdbaefdfe85b760789ebc0cb3a917a5b77b7651b1671e5e0439b361c9eb21a29fc6780a7b637f05ca082bf091cbd1009f420

Download Submit
C:\Config.Msi\f76c3ff.rbs
Filesize
29KB

MD5
be172b2107037d90628ecbcafa38a9e5

SHA1
4024b30570ae65ee20435b6d7042c781a5b61c59

SHA256
158317ac6036d075cb2118cf2bbcc22ff7069c76e115c34af5a80df548101fea

SHA512
ff3df6b89211e8613c56c37a9d9cce6dd3ed17d26f57a3dc178a648ddafee9e4a6ec06446ddcc08269ca47a54a17fe6454237fb0e78710cda0c0f5fd3caadcdf

Download Submit
C:\Config.Msi\f76c404.rbs
Filesize
4KB

MD5
af0c93997fada6fdb1ff29deab3215ba

SHA1
473584468dcef1bcf15ff20d12f1e600d200b087

SHA256
dd1f68a03838b0d76ff7c8bf4211537d93e0afd736b2b9525e375fa89fe7f467

SHA512
ee0dd6e80291d08181bffd93d009622f59d2900200df784ca401fc37426bdf3f5ff3c35dd7edc6c1fea1c3e89e53291d40d97ced59545dd2a317754cce6a3e8a

Download Submit
C:\Config.Msi\f76c409.rbs
Filesize
29KB

MD5
bbbb564534d318c5a6404b4b7ea501b7

SHA1
490903f858325aeaf55c9c694b200d504dedbb24

SHA256
bcb9d45f51ef1ddf3e74a343ad2da2d664aa0730dc694fc4c84943aa49a8d7f1

SHA512
dda0de86c301a8d1129c3be95f2295cd5e92fa1756c23f152a8efb7cae7a0972259f5d72df12e760877900f90f3e4f78b1d1a234217de2f09364d1a4a4192677

Download Submit
C:\Config.Msi\f76c40d.rbs
Filesize
4KB

MD5
703786f7122268794c0e3260034b88b7

SHA1
f79891fdd68bed935249b533ee2c830e2375824a

SHA256
4eb13bd6e0ce8246f36de4fdd4fd9995784121d65bb0c0064c3d2f93c4fc70a1

SHA512
a462be8f88c5f42ea4fd3dd06ab2c2ff019c06c7e14a3acc899aeced23a391ccf7c20e158ea7e5280f659e5106979dc0fca14539db93b4151dd1c2cc19910b96

Download Submit
C:\Config.Msi\f76c412.rbs
Filesize
28KB

MD5
30d969705c4364e5a0f9eb6ae3719ba8

SHA1
30a715b565bceae386c954d1dc0a276c6f946e75

SHA256
0d5001d0db70f086d45b6d852e31f7797bb8a868267ecf8ed721f08321badaf7

SHA512
098287299b3eec9f61c92057583d4d78bb15c682cca94078f3e05058d930092453e9967d37f27d0db269717dcf4f4778cbe25c391bce31418278416e65038641

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC439.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HFI254D.tmp.html
Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab
Filesize
247KB

MD5
d5dd8a90812067e0ccb23a7299f82562

SHA1
5787391891cef8295666bce637d10e992d021d81

SHA256
71a4560b0eb5e45c385ce3aef154d97fa944b762f9aff3b3b9364d42bd1d5afd

SHA512
d38d3bcb8a640538a3a1b4052727d8d291d8d17218ba1abcaab1dca615bd83d3317a4bed89e495fadfbe6d20791562e5a8032284ae1cfeadc0020337ea0fe673

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab
Filesize
312KB

MD5
0aa0da68a91e9133715d9cde2a180ffb

SHA1
892e941bed49b3404dad2aa33cd36b708e1443a9

SHA256
64570910e03c337d4e1f8ab1b9fb8e4dc46fdccb93857a1e9c73b296c6850fe0

SHA512
247dc48b39844fcfbfd46ef8eb1c72375b183f2d54361f5fe857d3a1b7275145cd0a9be8f287e037b46912a496a39a8855c20a63a8c663b60fc620b0b35e2313

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi
Filesize
2.6MB

MD5
f194e681c552647c95441877b5552415

SHA1
285c6b1dbbc2d1525c9b1c276a4901b98d49b202

SHA256
6d4f42d5856384c2566ed79bdc587993208013640b035b04540de9f05ee597d6

SHA512
8ed21ce7829a1cb6c2dd4eff2e3701171aeba5b7e4337eaf0ddff86ea3fda812198a2e3fb4f1873b129944bdc8ddb09ebbd78e5c2b9811900cb853ef2afdab8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi
Filesize
3.0MB

MD5
391dddd564a9e8a20576fe05e5e1f25b

SHA1
84f17830075abea6e6a369dee6b93ac16a71f025

SHA256
a9a8dac04e3b38c2f8d33ee7cf6d658fa4ea089bbf9f4014eb61b9d5de7dc6a2

SHA512
10358d52620178296c9033b257db960d3bf9b1219fa5b6f02f1173234686930616da708c5ac051b0c0c8892b3b66164093fc64698de43e56cf3b6f1d875e418f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF0F5.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\VWL23F5.tmp
Filesize
392B

MD5
503345ec2f86d4870fb0c8ad2051e9cb

SHA1
2927f7432cbcff9d9dd14ba186c76cbbeb63a784

SHA256
8a80494adc8d347f8421bd8ba0ddb1de367bdec7bd1bb7f761e34ea579c83856

SHA512
3585365ef4c98c1b2d9cc35a7927f7e6cc6988f71d1fa5521d49b7c3d200b9a910f1cab07ee4664eb0481091e27ce084771d11ead91a8f5c10c8fea803136f30

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI4C20.txt
Filesize
2KB

MD5
3f347ca2556f3ffa0c6c78a98c9c894f

SHA1
daeba82b2d70573341b490f65747f0542472ec16

SHA256
c0dc46949afdae7c6a1bd93f09acc24d9df1a6b856f1cc44b733c61d173938d8

SHA512
9bb12b4d3d7198615f2c1ceb844ae430dd875d2b6e7be5743961456a1f6e735585c92dae985a40e67bb780221aabb92199dba9a7b6f048bb9974320921fbf63b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI4C23.txt
Filesize
2KB

MD5
1d92da163f54a8f96454e029196cc1c0

SHA1
38a5c096c24a7ae27d1e5cdf4241bccd051ada36

SHA256
18599b62ff9b8c8fbc796c3b551d8527836cc6532b8a4b1b598309af53b044a0

SHA512
ff8be19916e2d380bd9d292edc62d52342b8c356005c873e7bdc4e828f4dee4f192035847a39f478f216ab7a6ce74db5f8c99ce5af998538c00041247c52d743

Download Submit
C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Installer\MSIC65D.tmp
Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
F:\0a5f283501281acf4721ce\install.exe
Filesize
547KB

MD5
4138c31964fbcb3b7418e086933324c3

SHA1
97cc6f58fb064ab6c4a2f02fb665fef77d30532f

SHA256
b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29

SHA512
40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557

Download Submit
F:\22742ff52a9d7ff4945e43\install.exe
Filesize
834KB

MD5
f0995d5ebde916fa146f51d324cf410c

SHA1
6a03e96a663051683b82601b5c7be72d72ecdb1c

SHA256
f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b

SHA512
8a2ca604c06077a1c5a7ac9782ff6815a4ea1b152502707120cf5a8edddcda7c8d1a71e16c80305a3fa098acb6ecf158c770e6d0a9cb2e57a9d875fb935664b8

Download Submit
F:\63d6867ed4be8917fad0fcdd\Setup.exe
Filesize
76KB

MD5
2af2c1a78542975b12282aca4300d515

SHA1
3216c853ed82e41dfbeb6ca48855fdcd41478507

SHA256
531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7

SHA512
4a70bd4b542f6001e46f827f341676c34af1ea216c50ad981dd04f547cd67f73aaa420fcbed379dc05dab199bf5ba00d899c49ff75da577613209f96226227eb

Download Submit
\??\f:\0a5f283501281acf4721ce\globdata.ini
Filesize
1KB

MD5
0a6b586fabd072bd7382b5e24194eac7

SHA1
60e3c7215c1a40fbfb3016d52c2de44592f8ca95

SHA256
7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

SHA512
b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

Download Submit
\??\f:\0a5f283501281acf4721ce\install.ini
Filesize
841B

MD5
f8f6c0e030cb622f065fe47d61da91d7

SHA1
cf6fa99747de8f35c6aea52df234c9c57583baa3

SHA256
c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d

SHA512
b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde

Download Submit
\??\f:\0a5f283501281acf4721ce\install.res.1033.dll
Filesize
85KB

MD5
ff6003014eefc9c30abe20e3e1f5fbe8

SHA1
4a5bd05f94545f01efc10232385b8fecad300678

SHA256
a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067

SHA512
3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2

Download Submit
\??\f:\0a5f283501281acf4721ce\vc_red.cab
Filesize
3.7MB

MD5
0ee84ab717bc400c5e96c8d9d329fbb0

SHA1
be4ba7bbb068c7256b70f4fd7634eaeb2ad04d0a

SHA256
461d575bc1a07f64c14f1da885d2f310bd282cbbedcd0a5cf8ffa7057411805d

SHA512
4a6b0619f471a51df09fb6c1eff4ed166cdb7ef57f79ffdf709fa952a7c2a176c338084689c8ace1a94024a24579e9ee0ab6d411c25a1b42b0f517c57749d1a2

Download Submit
\??\f:\0a5f283501281acf4721ce\vc_red.msi
Filesize
222KB

MD5
7e641e6a0b456271745c20c3bb8a18f9

SHA1
ae6cedcb81dc443611a310140ae4671789dbbf3a

SHA256
34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d

SHA512
f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903

Download Submit
\??\f:\22742ff52a9d7ff4945e43\install.res.1033.dll
Filesize
84KB

MD5
e8ed5b7797472df6f5e1dae87c123e5e

SHA1
71e203899c3faf5e9eb5543bfd0eb748b78da566

SHA256
6ad479dd35201c74092068cccd6d12fd84a45d2c04e927b39901a9126f9e06dd

SHA512
dfdd6bba404753f6afbc804551550bdc771eccc034c01f4c5149beb6d98424cf7b86fc63aac361a1840df9bc8365c726baab672055534620db70ca2c0e2e1b3e

Download Submit
\??\f:\22742ff52a9d7ff4945e43\vc_red.cab
Filesize
4.3MB

MD5
5cad07d592a2a43905d6b656b79a7abd

SHA1
9168413a66fe4e41ddd506a68e7f5e5feebf9d6b

SHA256
9f218cefe505a28a589b10f4e7c28ac479eca159e438012a9666e6f709bcf82f

SHA512
546065881b32421ba36076dd6848d98e444d89def7a4bfd3d7299d6de6f6f746a2abea2a00e24b02ba5ba2bde816a70529eb8ca48972ccc2d03f3ccb12df4261

Download Submit
\??\f:\22742ff52a9d7ff4945e43\vc_red.msi
Filesize
230KB

MD5
4aa5bbddbf6b2d1cf509c566312f1203

SHA1
0557e25cf4c2aa1bcb170707cd282ae864d93d17

SHA256
017e62a7a046acf00f5565e60f8eed4c5f409913e7ddc2f431d4236bbfdabab8

SHA512
e32fad32aefb70592eec56c55eaf65d6a6ed33939a6cabe7ff0ec33f91c4687001a41575ccfcac448c4739b2af4e309c2ec9e526104fb292d04aa8746dfad8f9

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\1028\LocalizedData.xml
Filesize
29KB

MD5
7fc06a77d9aafca9fb19fafa0f919100

SHA1
e565740e7d582cd73f8d3b12de2f4579ff18bb41

SHA256
a27f809211ea1a2d5224cd01101aa3a59bf7853168e45de28a16ef7ed6acd46a

SHA512
466dcc6a5fb015be1619f5725fa62ca46eb0fb428e11f93fd9d82e5df61c3950b3fb62d4db7746cc4a2be199e5e69eaa30b6f3354e0017cfa14d127fad52f8cf

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\1031\LocalizedData.xml
Filesize
40KB

MD5
b83c3803712e61811c438f6e98790369

SHA1
61a0bc59388786ced045acd82621bee8578cae5a

SHA256
2aa6e8d402e44d9ee895b18195f46bf90259de1b6f44efd46a7075b110f2dcd6

SHA512
e020f93e3a082476087e690ad051f1feb210e0915924bb4548cc9f53a7ee2760211890eb6036ce9e5e4a311abc0300e89e25efbbb894c2a621ffbc9d64cc8a38

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\1033\LocalizedData.xml
Filesize
38KB

MD5
d642e322d1e8b739510ca540f8e779f9

SHA1
36279c76d9f34c09ebddc84fd33fcc7d4b9a896c

SHA256
5d90345ff74e177f6da8fb6459c1cfcac080e698215ca75feb130d0d1f2a76b9

SHA512
e1e16ae14bc7cc1608e1a08d3c92b6d0518b5fabd27f2c0eb514c87afc3d6192bf7a793a583afc65f1899f03dc419263b29174456e1ec9ab0f0110e0258e0f0d

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\1033\SetupResources.dll
Filesize
16KB

MD5
0b4e76baf52d580f657f91972196cd91

SHA1
e6ac8f80ab8ade18ac7e834ac6d0536bb483988c

SHA256
74a7767d8893dcc1a745522d5a509561162f95bc9e8bcc3056f37a367dba64a4

SHA512
ed53292c549d09da9118e944a646aa5dc0a6231811eafcda4258c892b218bcf3e0363a2c974868d2d2722155983c5dc8e29bed36d58e566e1695e23ce07fea87

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\1036\LocalizedData.xml
Filesize
40KB

MD5
e382abc19294f779d2833287242e7bc6

SHA1
1ceae32d6b24a3832f9244f5791382865b668a72

SHA256
43f913ff28d677316f560a0f45221f35f27cfaf5fc5bd645974a82dca589edbf

SHA512
06054c8048cade36a3af54f9a07fd8fa5eb4f3228790996d2abea7ee1ee7eb563d46bd54ff97441f9610e778194082c44e66c5f566c9c50a042aba9eb9cae25e

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\1040\LocalizedData.xml
Filesize
39KB

MD5
0af948fe4142e34092f9dd47a4b8c275

SHA1
b3d6dd5c126280398d9055f90e2c2c26dbae4eaa

SHA256
c4c7c0ddaa6d6a3a1dc260e9c5a24bdfaa98c427c69e8a65427dd7cac0a4b248

SHA512
d97b5fe2553ca78a3019d53e33d2db80c9fa1cf1d8d2501d9ddf0576c7e6ea38dab754fe4712123abf34b97e10b18fb4bbd1c76d3dacb87b4682e501f93423d9

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\1041\LocalizedData.xml
Filesize
33KB

MD5
7fcfbc308b0c42dcbd8365ba62bada05

SHA1
18a0f0e89b36818c94de0ad795cc593d0e3e29a9

SHA256
01e7d24dd8e00b5c333e96d1bb83813e02e96f89aad0c2f28f84551d28abbbe2

SHA512
cd6f912a037e86d9e1982c73f0f8b3c4d5a9a6b5b108a7b89a46e6691e430a7cb55718de9a0c05650bb194c8d4a2e309ad6221d638cfca8e16aa5920881ba649

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\1042\LocalizedData.xml
Filesize
32KB

MD5
71dfd70ae141f1d5c1366cb661b354b2

SHA1
c4b22590e6f6dd5d39e5158b831ae217ce17a776

SHA256
cccda55294aeb4af166a8c0449bca2189ddf5aa9a43d5e939dd3803e61738331

SHA512
5000d62f3de41c3fb0ed8a8e9c37dbf4eb427c4f1e3ad3823d4716c6fe62250bac11b7987a302b8a45d91aabcf332457f7aff7d99f15edeffe540639e9440e8a

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\1049\LocalizedData.xml
Filesize
39KB

MD5
0eeb554d0b9f9fcdb22401e2532e9cd0

SHA1
08799520b72a1ef92ac5b94a33509d1eddf6caf8

SHA256
beef0631c17a4fb1ff0b625c50c6cb6c8ce90a1ae62c5e60e14bf3d915ad509c

SHA512
2180e46a5a2ea1f59c879b729806ca02a232c66660f29c338c1fa7fbee2afa4b13d8777d1f7b63cf831eb42f3e55282d70aa8e53f40616b8a6e4d695c36e313d

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\2052\LocalizedData.xml
Filesize
30KB

MD5
52b1dc12ce4153aa759fb3bbe04d01fc

SHA1
bf21f8591c473d1fce68a9faf1e5942f486f6eba

SHA256
d1735c8cfd8e10ba019d70818c19fa865e7c72f30ab6421a3748408f85fb96c3

SHA512
418903ae9a7baebf73d055e4774ff1917fbaab9ee7ed8c120c34bb10e7303f6dd7b7dae701596d4626387a30ae1b4d329a9af49b8718b360e2ff619c56c19623

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\3082\LocalizedData.xml
Filesize
39KB

MD5
5397a12d466d55d566b4209e0e4f92d3

SHA1
fcffd8961fb487995543fc173521fdf5df6e243b

SHA256
f124d318138ff084b6484deb354cca0f72296e1341bf01169792b3e060c89e89

SHA512
7708f5a2ad3e4c90c4c216600435af87a1557f60caf880a3dd9b5f482e17399af9f0b9de03ff1dbdd210583e0fec5b466e35794ac24d6d37f9bbc094e52fc77b

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\ParameterInfo.xml
Filesize
21KB

MD5
13f8768c289476fdd103ff689d73cd2d

SHA1
ddebcecc02c6b1b996423d62d0def8760f031f58

SHA256
4eae293ca91b31aaa206e5a1c655714f0fe84e39f9331cb759d2236cdb915523

SHA512
c72998f30ebff8f4a757248639cf0351d03f5502be475b4cb8f02b09ad800dbbe2f9a82c7d9bde6d7bd748e0ee6e61b86e369192773fe726421a564e793a0139

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\SetupEngine.dll
Filesize
789KB

MD5
63e7901d4fa7ac7766076720272060d0

SHA1
72dec0e4e12255d98ccd49937923c7b5590bbfac

SHA256
a5116ccb17b242713e5645c2374abf5827c0d2752b31553e3540c9123812e952

SHA512
de2e63bc090121484191cbf23194361d761b01c0fd332f35f0dfdfd0b11431b529e5c7f542031a0e7e26f31497d94b8baacfbf1c84c6493e66ac2ab76c11d0a0

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\SetupUi.dll
Filesize
288KB

MD5
0d214ced87bf0b55883359160a68dacb

SHA1
a60526505d56d447c6bbde03da980db67062c4c6

SHA256
29cf99d7e67b4c54bafd109577a385387a39301bcdec8ae4ba1a8a0044306713

SHA512
d9004ebd42d4aa7d13343b3746cf454ca1a5144f7b0f437f1a31639cc6bd90c5dd3385612df926bf53c3ef85cfe33756c067cb757fff257d674a10d638fc03c5

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\SetupUi.xsd
Filesize
29KB

MD5
2fadd9e618eff8175f2a6e8b95c0cacc

SHA1
9ab1710a217d15b192188b19467932d947b0a4f8

SHA256
222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093

SHA512
a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\Strings.xml
Filesize
13KB

MD5
332adf643747297b9bfa9527eaefe084

SHA1
670f933d778eca39938a515a39106551185205e9

SHA256
e49545feeae22198728ad04236e31e02035af7cc4d68e10cbecffd08669cbeca

SHA512
bea95ce35c4c37b4b2e36cc1e81fc297cc4a8e17b93f10423a02b015ddb593064541b5eb7003560fbeee512ed52869a113a6fb439c1133af01f884a0db0344b0

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\UiInfo.xml
Filesize
35KB

MD5
4f90fcef3836f5fc49426ad9938a1c60

SHA1
89eba3b81982d5d5c457ffa7a7096284a10de64a

SHA256
66a0299ce7ee12dd9fc2cfead3c3211e59bfb54d6c0627d044d44cef6e70367b

SHA512
4ce2731c1d32d7ca3a4f644f4b3111f06223de96c1e241fcc86f5fe665f4db18c8a241dae4e8a7e278d6afbf91b235a2c3517a40d4d22d9866880e19a7221160

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\graphics\print.ico
Filesize
1KB

MD5
7e55ddc6d611176e697d01c90a1212cf

SHA1
e2620da05b8e4e2360da579a7be32c1b225deb1b

SHA256
ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed

SHA512
283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\graphics\save.ico
Filesize
1KB

MD5
7d62e82d960a938c98da02b1d5201bd5

SHA1
194e96b0440bf8631887e5e9d3cc485f8e90fbf5

SHA256
ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5

SHA512
ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\graphics\setup.ico
Filesize
35KB

MD5
3d25d679e0ff0b8c94273dcd8b07049d

SHA1
a517fc5e96bc68a02a44093673ee7e076ad57308

SHA256
288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f

SHA512
3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\header.bmp
Filesize
7KB

MD5
3ad1a8c3b96993bcdf45244be2c00eef

SHA1
308f98e199f74a43d325115a8e7072d5f2c6202d

SHA256
133b86a4f1c67a159167489fdaeab765bfa1050c23a7ae6d5c517188fb45f94a

SHA512
133442c4a65269f817675adf01adcf622e509aa7ec7583bca8cd9a7eb6018d2aab56066054f75657038efb947cd3b3e5dc4fe7f0863c8b3b1770a8fa4fe2e658

Download Submit
\??\f:\63d6867ed4be8917fad0fcdd\sqmapi.dll
Filesize
141KB

MD5
3f0363b40376047eff6a9b97d633b750

SHA1
4eaf6650eca5ce931ee771181b04263c536a948b

SHA256
bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c

SHA512
537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8

Download Submit
\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll
Filesize
835KB

MD5
b370bef39a3665a33bd82b614ffbf361

SHA1
ac4608231fce95c4036dc04e1b0cf56ae813df03

SHA256
a9f818f65074355e9376f9519b6846333b395d9b2d884d8d15f8d2f4991b860a

SHA512
66ebf1275d86c07f5c86244b10187453ef40a550d74b9eb24ac3fbf51419786b87fdefe84812d85dc269cb49377e1b51732b697ae089cfbf35123ea90932fdb8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE
Filesize
2.6MB

MD5
c5c698758bd9da02cc2ef94dcf1b4637

SHA1
1d6773537b0baba779090c7fa29be43d2130c3dd

SHA256
e1df4fda1f4f6a5d9faa94cc53e77458a53c56a87df4f1062708095150c86dbf

SHA512
c238860204de3933c7c41ba5f621f957d602286fa3a19a1bf4b6b272d8b417a20f5351ccf6ae5b46dde6ae938c7158e0f11d610e7a76a3530ba6825a96c9196b

Download Submit
memory/748-602-0x0000000074510000-0x0000000074534000-memory.dmp

Filesize
144KB

Download
memory/748-601-0x0000000074850000-0x0000000074918000-memory.dmp

Filesize
800KB

Download
memory/2348-741-0x0000000074510000-0x0000000074534000-memory.dmp

Filesize
144KB

Download
memory/2348-740-0x0000000074870000-0x0000000074938000-memory.dmp

Filesize
800KB

Download
memory/2920-442-0x000007FEF5D60000-0x000007FEF5D78000-memory.dmp

Filesize
96KB

Download
memory/3044-356-0x0000000074A10000-0x0000000074A27000-memory.dmp

Filesize
92KB

Download