2c36e82daa8f9be5f013d92b8461f67038d2bf5d26a12b3f881cf6ddead1823c

Analysis

max time kernel
150s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
03/02/2024, 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VisualCppRedist_AIO_x86_x64.exe
Size

27.6MB
MD5

d1899aea6e78fbff0563c7001f2a60f1
SHA1

6cf5ba822d4646ffa72805872c56087ebbc132c9
SHA256

68ab06ae1d19045d1ea9ec87fe67c2102c8b09aca2c7ff3de897aebe7fe80f11
SHA512

c68489c5aba8b04490920791030e80056ca213d2dcd3fc8ffcbc5b89db58fc3aec06994a3f8ff7017e7ddafd1d665969bfb7a534a7e7b028771b9c046ad3b4c1
SSDEEP

786432:Yu6L5wHk/+1neYo7XDbTWX9GdJnQhGkF/ovDHHeuS68fAv:YlLAk/+1npo7TM9GdJQSnoA

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
4220	vcredist_x86.exe
5056	vcredist_x64.exe
5000	vcredist_x86.exe
3408	vcredist_x64.exe
1620	VC_redist.x86.exe
4536	VC_redist.x64.exe
2440	MsiExec.exe
2440	MsiExec.exe
2440	MsiExec.exe
2440	MsiExec.exe
2440	MsiExec.exe
2440	MsiExec.exe
2440	MsiExec.exe
2440	MsiExec.exe
2440	MsiExec.exe
2440	MsiExec.exe
2440	MsiExec.exe
2440	MsiExec.exe
2440	MsiExec.exe
2484	MsiExec.exe
2484	MsiExec.exe
2484	MsiExec.exe
2484	MsiExec.exe
2484	MsiExec.exe
2484	MsiExec.exe
2484	MsiExec.exe
2484	MsiExec.exe
2484	MsiExec.exe
2484	MsiExec.exe
2484	MsiExec.exe
2484	MsiExec.exe
2484	MsiExec.exe
3044	MsiExec.exe
3044	MsiExec.exe
3044	MsiExec.exe
3044	MsiExec.exe
3044	MsiExec.exe
3044	MsiExec.exe
3044	MsiExec.exe
3044	MsiExec.exe
3044	MsiExec.exe
3044	MsiExec.exe
3044	MsiExec.exe
3044	MsiExec.exe
3044	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
3824	MsiExec.exe
4728	MsiExec.exe
4940	MsiExec.exe
832	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe

Registers COM server for autorun 1 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{83081C08-382C-4ED4-ACCF-DCBECA021010}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{83081C08-382C-4ED4-ACCF-DCBECA021010}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3133A7FE-BC5F-4D81-BF02-184ECC88D66E}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{99E0D1EC-0A0D-4E50-B8A1-82A8B6ECE5CB}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A37BBB42-E8C1-4E09-B9CA-F009CE620C08}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{64654B35-A024-4807-89D3-C6FDB5A260C7}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{64654B35-A024-4807-89D3-C6FDB5A260C7}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{83081C08-382C-4ED4-ACCF-DCBECA021010}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99D651D7-5F7C-470E-8A3B-774D5D9536AC}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3133A7FE-BC5F-4D81-BF02-184ECC88D66E}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E0D1EC-0A0D-4E50-B8A1-82A8B6ECE5CB}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F09D237B-3FD1-4900-BEF2-3471CA68142D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E3C66D5-58D4-491E-A7D4-64AF99AF6E8B}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{760681E7-B985-41CE-BCBE-2985A1DFC61C}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A249E9F6-5B28-4ED1-8AF0-C9B9C5195486}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{4E3C66D5-58D4-491E-A7D4-64AF99AF6E8B}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{760681E7-B985-41CE-BCBE-2985A1DFC61C}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{274C2936-A842-45f3-A457-FB4BA4ED1BA2}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{760681E7-B985-41CE-BCBE-2985A1DFC61C}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A249E9F6-5B28-4ED1-8AF0-C9B9C5195486}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{64654B35-A024-4807-89D3-C6FDB5A260C7}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F09D237B-3FD1-4900-BEF2-3471CA68142D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3133A7FE-BC5F-4D81-BF02-184ECC88D66E}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{274C2936-A842-45f3-A457-FB4BA4ED1BA2}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F09D237B-3FD1-4900-BEF2-3471CA68142D}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99D651D7-5F7C-470E-8A3B-774D5D9536AC}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E3C66D5-58D4-491E-A7D4-64AF99AF6E8B}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E0D1EC-0A0D-4E50-B8A1-82A8B6ECE5CB}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{99D651D7-5F7C-470E-8A3B-774D5D9536AC}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{274C2936-A842-45f3-A457-FB4BA4ED1BA2}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A37BBB42-E8C1-4E09-B9CA-F009CE620C08}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A249E9F6-5B28-4ED1-8AF0-C9B9C5195486}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll"	msiexec.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} = "\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_x86_20240203062327.log\" /uninstall /passive /norestart ignored /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20240203062347.log\" /uninstall /passive /norestart ignored /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp110.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\mfcm100.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\msvcp110.dll	msiexec.exe
File created	C:\Windows\system32\atl100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc110chs.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp110.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100chs.dll	msiexec.exe
File created	C:\Windows\system32\msvcr100.dll	msiexec.exe
File created	C:\Windows\system32\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp110.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfcm100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc110.dll	msiexec.exe
File created	C:\Windows\system32\mfcm110u.dll	msiexec.exe
File created	C:\Windows\system32\vcomp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc120rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100ita.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110cht.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp100.dll	msiexec.exe
File created	C:\Windows\system32\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\vcomp100.dll	msiexec.exe
File created	C:\Windows\system32\mfc110enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc100cht.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\ActionsPane3.xsd	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\VSTOFiles.cat	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	addinutil.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\PipelineSegments.store	addinutil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_atl100_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100esn_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9686.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240203062439915.0\8.0.50727.6229.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\e57f679.msi	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240203062439649.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240203062449321.0\atl90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240203062449431.0\9.0.30729.7523.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240203062449400.0\9.0.30729.7523.policy	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI451C.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\FEL5OYIF\Microsoft.Office.Tools.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\SystemTemp\~DF6B8A05B03C994C3A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF835A182BD3937ED6.TMP	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240203062439555.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240203062449369.0\mfc90kor.dll	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB970F6F6CCC61C92.TMP	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI3DD7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8DA7D58C30D1D661.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9346.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57f66f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20240203062539188.0\vcomp.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240203062539251.0\8.0.50727.6229.cat	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20240203062538985.0\msvcr80.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240203062539220.0	msiexec.exe
File created	C:\Windows\SystemTemp\~DF945578F03FA8872B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CD5.tmp	msiexec.exe
File created	C:\Windows\Installer\e57f659.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240203062439649.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20240203062539188.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_45a306ec.cat	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\SystemTemp\~DF70E2E1F3020BFF7F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6932.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\0OM311CS\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\JQURSWAQ\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\MSI6A7F.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240203062439743.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_9cdcab35.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240203062449369.0\mfc90jpn.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20240203062538985.0\msvcp80.dll	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f3fdb5e6b36120f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800000f3fdb5e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809000f3fdb5e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d0f3fdb5e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000f3fdb5e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}\CLSID = "{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}\CLSID = "{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}"	msiexec.exe

Modifies data under HKEY_USERS 53 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\39	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\38	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\PackageName = "vc_red.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v11\DisplayName = "Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61135"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{AAB9C2AA-6036-4AE1-A41C-A40AB7F39520}\a.0\FLAGS	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0,version="10.0.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="10.0.60912.0",culture="neutral" = 360054002e006e002800320055006f00790035003100590039005a0047005300340065004800710056005300540041005f00520075006e00740069006d0065005f0043004c005200330035003e0046002800450066007300290079006e0049003d006b0048005a0062002a0052004d0026006600330000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bootstrap.vsto.1\DocObject\ = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\772761216604AD738BCFA426F32D731E\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.ATL,version="9.0.30729.7523",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f00410054004c005f007800360034003e0026007d00720054005000390035006d00270038002a0030005200530072007b006e0046007700550000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,version="9.0.30729.7523",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004300520054005f007800360034003e0027002c006c00640062005f006c004000300037005300620046003f007800300070007e004700380000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\ = "{53CF6934-A98D-3D84-9146-FC4EDF3D5641}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{83081C08-382C-4ED4-ACCF-DCBECA021010}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3AEB2FCAE628F23AAB933F1E743AB79	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bootstrap.vsto\CLSID\ = "{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{64654B35-A024-4807-89D3-C6FDB5A260C7}\Control	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{4E3C66D5-58D4-491E-A7D4-64AF99AF6E8B}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\772761216604AD738BCFA426F32D731E\VSTO_Runtime_CLR40	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v11\Version = "11.0.61135"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\c:\|Program Files (x86)\|Common Files\|Microsoft Shared\|VSTA\|AppInfoDocument\|Microsoft.VisualStudio.Tools.Office.AppInfoDocument\|Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll\Microsoft.Vis = 360054002e006e002800320055006f00790035003100590039005a004700530034006500480071005600530054004f005f00520075006e00740069006d0065005f0043004c005200330035003e007000250054003f00450061004300440074003f007400580062003700520029002c006a002900290000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3AEB2FCAE628F23AAB933F1E743AB79\ProductName = "Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61135"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C9F8B73BF303523781852719CD9C700\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{274C2936-A842-45f3-A457-FB4BA4ED1BA2}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Version = "134278914"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\Version = "12.0.40664"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A37BBB42-E8C1-4E09-B9CA-F009CE620C08}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\c:\|Program Files (x86)\|Common Files\|Microsoft Shared\|VSTA\|Pipeline.v10.0\|Contracts\|Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll\Microsoft.VisualStudio.Tools.Office.Contract.v10.0,version="10 = 360054002e006e002800320055006f00790035003100590039005a004700530034006500480071005600530054004f005f00520075006e00740069006d0065005f0043004c005200330035003e0050005f005a00740066002c00540040005e0039006700410059006f003000520066004b006300430000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3AEB2FCAE628F23AAB933F1E743AB79\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44DB0475D85BA123FA0CD6D35465DDC6	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{83081C08-382C-4ED4-ACCF-DCBECA021010}\ = "VSTO Accessor class"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v12\Dependents	vcredist_x86.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.vsto\bootstrap	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.VSTOCTPHostX.4\ = "VSTOCTPHostX"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\772761216604AD738BCFA426F32D731E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\vstor\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A37BBB42-E8C1-4E09-B9CA-F009CE620C08}\Version\ = "9.0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FDD54ADF71E8F6333ADE53B6B7C786A8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\Version = "151025673"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3AEB2FCAE628F23AAB933F1E743AB79\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BA8C0AA792764D40A9D8090F65EE964\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2022\\x64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3AEB2FCAE628F23AAB933F1E743AB79\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4396FC35D89A48D31964CFE4FDD36514\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C9F8B73BF303523781852719CD9C700\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2012\\x64\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3AEB2FCAE628F23AAB933F1E743AB79\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E985809A-84A6-4F35-86D6-9B52119AB9D7}\9.0\HELPDIR\	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.VisualStudio.Tools.Applications.Hosting,version="10.0.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="10.0.60912.0",culture="neutral" = 360054002e006e002800320055006f00790035003100590039005a004700530034006500480071005600530054004f005f00520075006e00740069006d0065005f0043004c005200340030003e00710044006d005f0065005b006b005000480040007400600045006f0071006f003d004f0024002e0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Common Files\|Microsoft Shared\|VSTA\|Pipeline.v10.0\|AddInSideAdapters\|Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V11\DEPENDENTS\{33D1FD90-4274-48A1-9BC1-97E33D9C2D6F}	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3AEB2FCAE628F23AAB933F1E743AB79\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2012\\x64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E985809A-84A6-4F35-86D6-9B52119AB9D7}\9.0\0\win32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A37BBB42-E8C1-4E09-B9CA-F009CE620C08}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C025571B2A687A53689168CD7369889B\SourceList	msiexec.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
4012	reg.exe
1556	reg.exe
4724	reg.exe
3796	reg.exe
900	reg.exe
4772	reg.exe
4760	reg.exe
4656	reg.exe
3520	reg.exe
1812	reg.exe
3440	reg.exe
2124	reg.exe
3008	reg.exe
1156	reg.exe
4724	reg.exe
3616	reg.exe
4920	reg.exe
5080	reg.exe
4892	reg.exe
3484	reg.exe
4732	reg.exe
3192	reg.exe
4896	reg.exe
4620	reg.exe
1732	reg.exe
4124	reg.exe
4116	reg.exe
3564	reg.exe
3092	reg.exe
2096	reg.exe
1908	reg.exe
2216	reg.exe
1156	reg.exe
2996	reg.exe
4580	reg.exe
4728	reg.exe
2588	reg.exe
1360	reg.exe
3368	reg.exe
2012	reg.exe
4432	reg.exe
2096	reg.exe
2812	reg.exe
1772	reg.exe
4380	reg.exe
5000	reg.exe
484	reg.exe
4888	reg.exe
4660	reg.exe
3540	reg.exe
3108	reg.exe
4300	reg.exe
1632	reg.exe
872	reg.exe
1364	reg.exe
4172	reg.exe
1000	reg.exe
1596	reg.exe
4840	reg.exe
3564	reg.exe
2620	reg.exe
876	reg.exe
2468	reg.exe
3344	reg.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe
1868	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1860	WMIC.exe
Token: SeSecurityPrivilege	1860	WMIC.exe
Token: SeTakeOwnershipPrivilege	1860	WMIC.exe
Token: SeLoadDriverPrivilege	1860	WMIC.exe
Token: SeSystemProfilePrivilege	1860	WMIC.exe
Token: SeSystemtimePrivilege	1860	WMIC.exe
Token: SeProfSingleProcessPrivilege	1860	WMIC.exe
Token: SeIncBasePriorityPrivilege	1860	WMIC.exe
Token: SeCreatePagefilePrivilege	1860	WMIC.exe
Token: SeBackupPrivilege	1860	WMIC.exe
Token: SeRestorePrivilege	1860	WMIC.exe
Token: SeShutdownPrivilege	1860	WMIC.exe
Token: SeDebugPrivilege	1860	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1860	WMIC.exe
Token: SeRemoteShutdownPrivilege	1860	WMIC.exe
Token: SeUndockPrivilege	1860	WMIC.exe
Token: SeManageVolumePrivilege	1860	WMIC.exe
Token: 33	1860	WMIC.exe
Token: 34	1860	WMIC.exe
Token: 35	1860	WMIC.exe
Token: 36	1860	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1860	WMIC.exe
Token: SeSecurityPrivilege	1860	WMIC.exe
Token: SeTakeOwnershipPrivilege	1860	WMIC.exe
Token: SeLoadDriverPrivilege	1860	WMIC.exe
Token: SeSystemProfilePrivilege	1860	WMIC.exe
Token: SeSystemtimePrivilege	1860	WMIC.exe
Token: SeProfSingleProcessPrivilege	1860	WMIC.exe
Token: SeIncBasePriorityPrivilege	1860	WMIC.exe
Token: SeCreatePagefilePrivilege	1860	WMIC.exe
Token: SeBackupPrivilege	1860	WMIC.exe
Token: SeRestorePrivilege	1860	WMIC.exe
Token: SeShutdownPrivilege	1860	WMIC.exe
Token: SeDebugPrivilege	1860	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1860	WMIC.exe
Token: SeRemoteShutdownPrivilege	1860	WMIC.exe
Token: SeUndockPrivilege	1860	WMIC.exe
Token: SeManageVolumePrivilege	1860	WMIC.exe
Token: 33	1860	WMIC.exe
Token: 34	1860	WMIC.exe
Token: 35	1860	WMIC.exe
Token: 36	1860	WMIC.exe
Token: SeBackupPrivilege	4640	vssvc.exe
Token: SeRestorePrivilege	4640	vssvc.exe
Token: SeAuditPrivilege	4640	vssvc.exe
Token: SeShutdownPrivilege	3796	vcredist_x86.exe
Token: SeIncreaseQuotaPrivilege	3796	vcredist_x86.exe
Token: SeSecurityPrivilege	1868	msiexec.exe
Token: SeCreateTokenPrivilege	3796	vcredist_x86.exe
Token: SeAssignPrimaryTokenPrivilege	3796	vcredist_x86.exe
Token: SeLockMemoryPrivilege	3796	vcredist_x86.exe
Token: SeIncreaseQuotaPrivilege	3796	vcredist_x86.exe
Token: SeMachineAccountPrivilege	3796	vcredist_x86.exe
Token: SeTcbPrivilege	3796	vcredist_x86.exe
Token: SeSecurityPrivilege	3796	vcredist_x86.exe
Token: SeTakeOwnershipPrivilege	3796	vcredist_x86.exe
Token: SeLoadDriverPrivilege	3796	vcredist_x86.exe
Token: SeSystemProfilePrivilege	3796	vcredist_x86.exe
Token: SeSystemtimePrivilege	3796	vcredist_x86.exe
Token: SeProfSingleProcessPrivilege	3796	vcredist_x86.exe
Token: SeIncBasePriorityPrivilege	3796	vcredist_x86.exe
Token: SeCreatePagefilePrivilege	3796	vcredist_x86.exe
Token: SeCreatePermanentPrivilege	3796	vcredist_x86.exe
Token: SeBackupPrivilege	3796	vcredist_x86.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1416	VisualCppRedist_AIO_x86_x64.exe
4220	vcredist_x86.exe
5056	vcredist_x64.exe
5000	vcredist_x86.exe
3408	vcredist_x64.exe
1620	VC_redist.x86.exe
4536	VC_redist.x64.exe
4308	msiexec.exe
4308	msiexec.exe
4980	msiexec.exe
4980	msiexec.exe
1976	msiexec.exe
1976	msiexec.exe
3848	msiexec.exe
3848	msiexec.exe
4900	msiexec.exe
4900	msiexec.exe
2440	msiexec.exe
2440	msiexec.exe
2288	msiexec.exe
2288	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
1428	msiexec.exe
1428	msiexec.exe
912	msiexec.exe
912	msiexec.exe
908	msiexec.exe
908	msiexec.exe
3536	msiexec.exe
3536	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
4900	msiexec.exe
4900	msiexec.exe
2936	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 3248	1416	VisualCppRedist_AIO_x86_x64.exe	80
PID 1416 wrote to memory of 3248	1416	VisualCppRedist_AIO_x86_x64.exe	80
PID 1416 wrote to memory of 3248	1416	VisualCppRedist_AIO_x86_x64.exe	80
PID 3248 wrote to memory of 1960	3248	cmd.exe	82
PID 3248 wrote to memory of 1960	3248	cmd.exe	82
PID 3248 wrote to memory of 1960	3248	cmd.exe	82
PID 1960 wrote to memory of 756	1960	cmd.exe	83
PID 1960 wrote to memory of 756	1960	cmd.exe	83
PID 3248 wrote to memory of 4780	3248	cmd.exe	84
PID 3248 wrote to memory of 4780	3248	cmd.exe	84
PID 3248 wrote to memory of 4780	3248	cmd.exe	84
PID 3248 wrote to memory of 896	3248	cmd.exe	85
PID 3248 wrote to memory of 896	3248	cmd.exe	85
PID 3248 wrote to memory of 4500	3248	cmd.exe	86
PID 3248 wrote to memory of 4500	3248	cmd.exe	86
PID 3248 wrote to memory of 4500	3248	cmd.exe	86
PID 3248 wrote to memory of 2604	3248	cmd.exe	87
PID 3248 wrote to memory of 2604	3248	cmd.exe	87
PID 3248 wrote to memory of 1860	3248	cmd.exe	88
PID 3248 wrote to memory of 1860	3248	cmd.exe	88
PID 3248 wrote to memory of 1868	3248	cmd.exe	89
PID 3248 wrote to memory of 1868	3248	cmd.exe	89
PID 3248 wrote to memory of 2116	3248	cmd.exe	91
PID 3248 wrote to memory of 2116	3248	cmd.exe	91
PID 3248 wrote to memory of 2116	3248	cmd.exe	91
PID 2116 wrote to memory of 2292	2116	cmd.exe	92
PID 2116 wrote to memory of 2292	2116	cmd.exe	92
PID 3248 wrote to memory of 1640	3248	cmd.exe	93
PID 3248 wrote to memory of 1640	3248	cmd.exe	93
PID 3248 wrote to memory of 1640	3248	cmd.exe	93
PID 1640 wrote to memory of 916	1640	cmd.exe	94
PID 1640 wrote to memory of 916	1640	cmd.exe	94
PID 3248 wrote to memory of 4664	3248	cmd.exe	95
PID 3248 wrote to memory of 4664	3248	cmd.exe	95
PID 3248 wrote to memory of 4664	3248	cmd.exe	95
PID 4664 wrote to memory of 3980	4664	cmd.exe	96
PID 4664 wrote to memory of 3980	4664	cmd.exe	96
PID 3248 wrote to memory of 3128	3248	cmd.exe	98
PID 3248 wrote to memory of 3128	3248	cmd.exe	98
PID 3248 wrote to memory of 5068	3248	cmd.exe	97
PID 3248 wrote to memory of 5068	3248	cmd.exe	97
PID 3248 wrote to memory of 3884	3248	cmd.exe	99
PID 3248 wrote to memory of 3884	3248	cmd.exe	99
PID 3248 wrote to memory of 3896	3248	cmd.exe	100
PID 3248 wrote to memory of 3896	3248	cmd.exe	100
PID 3248 wrote to memory of 872	3248	cmd.exe	103
PID 3248 wrote to memory of 872	3248	cmd.exe	103
PID 3248 wrote to memory of 4684	3248	cmd.exe	102
PID 3248 wrote to memory of 4684	3248	cmd.exe	102
PID 3248 wrote to memory of 2740	3248	cmd.exe	101
PID 3248 wrote to memory of 2740	3248	cmd.exe	101
PID 3248 wrote to memory of 2096	3248	cmd.exe	104
PID 3248 wrote to memory of 2096	3248	cmd.exe	104
PID 3248 wrote to memory of 2256	3248	cmd.exe	105
PID 3248 wrote to memory of 2256	3248	cmd.exe	105
PID 3248 wrote to memory of 1136	3248	cmd.exe	106
PID 3248 wrote to memory of 1136	3248	cmd.exe	106
PID 3248 wrote to memory of 2216	3248	cmd.exe	107
PID 3248 wrote to memory of 2216	3248	cmd.exe	107
PID 3248 wrote to memory of 3424	3248	cmd.exe	108
PID 3248 wrote to memory of 3424	3248	cmd.exe	108
PID 3248 wrote to memory of 1932	3248	cmd.exe	109
PID 3248 wrote to memory of 1932	3248	cmd.exe	109
PID 3248 wrote to memory of 3564	3248	cmd.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe
"C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\system32\reg.exe
      reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver"
    3⤵
    PID:4780
- - C:\Windows\system32\findstr.exe
    findstr /c:" 5."
    3⤵
    PID:896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    PID:4500
- - C:\Windows\system32\reg.exe
    reg query "HKU\S-1-5-19"
    3⤵
    PID:2604
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- - C:\Windows\system32\find.exe
    find /i "ComputerSystem"
    3⤵
    PID:1868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
      4⤵
      PID:2292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
      4⤵
      PID:916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
      4⤵
      PID:3980
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:5068
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:3128
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:3884
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:3896
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2740
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4684
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:872
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2096
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2256
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1136
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2216
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3424
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1932
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3564
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3556
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:328
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
    3⤵
    PID:3132
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:964
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3016
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1364
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3948
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4976
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3520
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3432
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:648
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4724
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4496
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:240
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4732
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2052
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4608
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4728
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4012
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4940
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:5000
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1100
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:564
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:484
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4660
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4816
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4116
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5016
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4744
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2812
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5088
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3192
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1812
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3492
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1612
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
    3⤵
    PID:900
- - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
  - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{887AF918-7D2E-4CAB-B41F-8C447BD39B51} {9AA345C2-A328-4814-AB76-EBEA3E0367A7} 3796
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:4220
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
    3⤵
    - Modifies registry key
    PID:2588
- - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    PID:3564
  - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{CC519FD4-3EA8-4D3A-895B-2F1F9FD3C9EE} {95C0D8A4-60E5-4F34-BA1C-DAB37403C698} 3564
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:5056
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f
    3⤵
    - Modifies registry key
    PID:4012
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - Modifies registry class
    PID:3992
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{6192E138-E9AE-4316-9F90-918202682A86} {50C597C6-03FA-4558-85F6-2A32B2BD15DE} 3992
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:5000
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
    3⤵
    - Modifies registry key
    PID:1556
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    PID:1540
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{66C5E8F7-7881-493D-B097-924C16600734} {A745EF4A-3EAB-4840-803B-EE67B5B212FB} 1540
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:3408
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f
    3⤵
    - Modifies registry key
    PID:4172
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart
    3⤵
    PID:2096
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=560 -burn.filehandle.self=572 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:1620
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{94F28BC3-9987-461B-A516-6A63800E5D28} {800CBE98-1E8A-4D7D-9F79-153728D02F86} 1620
        5⤵
        Adds Run key to start application
        Modifies registry class
        
        PID:3948
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f
    3⤵
    - Modifies registry key
    PID:3092
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart
    3⤵
    PID:5016
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=580 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:4536
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BD34C51B-96BF-4830-8993-3BC041D15806} {06EE2987-087F-4AF5-9860-914C18BC3CF6} 4536
        5⤵
        Adds Run key to start application
        Modifies registry class
        
        PID:3288
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f
    3⤵
    - Modifies registry key
    PID:4892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
    3⤵
    PID:2652
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
      4⤵
      PID:3696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    PID:3732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
    3⤵
    PID:2108
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
      4⤵
      PID:3224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.61135.400
    3⤵
    PID:3344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
    3⤵
    PID:3424
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
      4⤵
      PID:2948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40664.0
    3⤵
    PID:3508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
    3⤵
    PID:4632
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
      4⤵
      PID:4124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 38.33135.0
    3⤵
    PID:3128
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1772
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2588
- - C:\Windows\system32\findstr.exe
    findstr /i /v {710f4c1c-cc18-4c49-8cbf-51240c89a1a2}
    3⤵
    PID:2076
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2460
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1000
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4372
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2760
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1156
- - C:\Windows\system32\findstr.exe
    findstr /i /v {9BE518E6-ECC6-35A9-88E4-87755C07200F}
    3⤵
    PID:3432
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4364
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:772
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4724
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1004
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2052
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x86 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3484
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:640
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1568
- - C:\Windows\system32\findstr.exe
    findstr /i /v {F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}
    3⤵
    PID:5004
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x86 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4888
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4884
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4940
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3796
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3512
- - C:\Windows\system32\findstr.exe
    findstr /i /v {B175520C-86A2-35A7-8619-86DC379688B9}
    3⤵
    PID:1708
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3564
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1240
- - C:\Windows\system32\findstr.exe
    findstr /i /v {BD95A8CD-1D9F-35AD-981A-3E7925026EBB}
    3⤵
    PID:5108
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2996
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4204
- - C:\Windows\system32\findstr.exe
    findstr /i /v {D401961D-3A20-3AC7-943B-6139D5BD490A}
    3⤵
    PID:1680
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:2096
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1352
- - C:\Windows\system32\findstr.exe
    findstr /i /v {8122DAB1-ED4D-3676-BB0A-CA368196543E}
    3⤵
    PID:1620
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3192
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:656
- - C:\Windows\system32\findstr.exe
    findstr /i /v {9C19C103-7DB1-44D1-A039-2C076A633A38}
    3⤵
    PID:1908
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1360
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2316
- - C:\Windows\system32\findstr.exe
    findstr /i /v {286DC39B-5FB7-4AFF-9DD4-22DB47664CD7}
    3⤵
    PID:3988
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2620
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1576
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:876
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4916
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3616
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3992
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3184
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:2468
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4896
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2112
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4620
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2324
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1596
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3060
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:900
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4920
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:916
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4308
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f
    3⤵
    - Modifies registry key
    PID:1732
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4980
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f
    3⤵
    - Modifies registry key
    PID:4772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
    3⤵
    PID:4824
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
      4⤵
      PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.60912.0
    3⤵
    PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
    3⤵
    PID:1136
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
      4⤵
      PID:992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    PID:5088
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3368
- - C:\Windows\system32\findstr.exe
    findstr /i /v {ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}
    3⤵
    PID:3064
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2372
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1856
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1908
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2928
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4460
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4660
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4816
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2620
- - C:\Windows\system32\findstr.exe
    findstr /i /v {5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}
    3⤵
    PID:1576
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3440
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1556
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1428
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x64 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4760
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3704
- - C:\Windows\system32\findstr.exe
    findstr /i /v {1D8E6291-B0D5-35EC-8441-6616F567A0F7}
    3⤵
    PID:2988
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3228
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x64 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2012
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3252
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4800
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4840
- - C:\Windows\system32\findstr.exe
    findstr /i /v {37B8F9C7-03FB-3253-8781-2517C99D7C00}
    3⤵
    PID:3060
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1596
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4920
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5068
- - C:\Windows\system32\findstr.exe
    findstr /i /v {CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}
    3⤵
    PID:2376
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:5080
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1088
- - C:\Windows\system32\findstr.exe
    findstr /i /v {010792BA-551A-3AC0-A7EF-0FAB4156C382}
    3⤵
    PID:2832
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3540
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3744
- - C:\Windows\system32\findstr.exe
    findstr /i /v {53CF6934-A98D-3D84-9146-FC4EDF3D5641}
    3⤵
    PID:396
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4432
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4804
- - C:\Windows\system32\findstr.exe
    findstr /i /v {19AFE054-CA83-45D5-A9DB-4108EF4BD391}
    3⤵
    PID:1480
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3344
- - C:\Windows\system32\findstr.exe
    findstr /i /v {AA0C8AB5-7297-4D46-A0D9-08096FE59E46}
    3⤵
    PID:3924
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3224
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3108
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2216
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:2124
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1820
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4124
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3896
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4656
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2588
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4300
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1992
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3008
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2440
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4380
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:416
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1156
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4364
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:2052
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:1976
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f
    3⤵
    - Modifies registry key
    PID:4580
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:3848
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f
    3⤵
    - Modifies registry key
    PID:1632
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:4900
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2440
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:2288
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3988
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:1428
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:912
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:908
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3536
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:1296
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\vstor40_x64.msi" /qb
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4900
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2936

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2032

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 6D09E870912A3752C3616E883E646F13
  2⤵
  - Loads dropped DLL
  PID:2440
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding D3D0D32EA4030017DF6958326892B81B
  2⤵
  - Loads dropped DLL
  PID:2484
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 0AE0ECB098E0DA0F2A49E7C45C84B306
  2⤵
  - Loads dropped DLL
  PID:3044
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding EB648090D92CF066AC61CC7ADE1B7C57
  2⤵
  - Loads dropped DLL
  PID:1680
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7AF42E87DA1B34F11D83367450CA15AA
  2⤵
  - Loads dropped DLL
  PID:3824
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 417D5F3C07DCFABF317D5E811EB69238
  2⤵
  - Loads dropped DLL
  PID:4728
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CCF80FED56028C9B55CB33397F2B64EA
  2⤵
  - Loads dropped DLL
  PID:4940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D8CC81D44CEA00806ACBA9344EFD687A M Global\MSI0000
  2⤵
  - Modifies registry class
  PID:2468
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CECD85569F06191E35147C360CCC64A4 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:832
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild
    3⤵
    - Drops file in Program Files directory
    PID:4060
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild
    3⤵
    - Drops file in Program Files directory
    PID:1360
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6E5DFBF0A778F0544D8341F56E6A9BEB E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:764
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4036
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5104
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1240
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:5064
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4456
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4200
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3040
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4732
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4700
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4116
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1308
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3532
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4896
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2140
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2252
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:736
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2268
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3096
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2836
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3344
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2216
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2124
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3536
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1248
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3896
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1296
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3252
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5096
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1592
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1960
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2168
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1000
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3484
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4932
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:656
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4808
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2320
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4740
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2928
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2112
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:992
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2988
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2140
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:428
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4672
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4048
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1260
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3732
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2836
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1508
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4880
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:916
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:572
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1992
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2936
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5004
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3796
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:540
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1960
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3940
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3272
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2884
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3268
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:380
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:876
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4116
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3280
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4824
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3116
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2776
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2252
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1712
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1376
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4848
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3408
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2972
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2836
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2028
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4804
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4908
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4268
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:836
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1732
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4312
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4464
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2704
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1288
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:4772
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
    3⤵
    - Drops file in Windows directory
    PID:1720
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1958860FC444EA416231A79389A8BB05
  2⤵
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57f56e.rbs

Filesize
23KB

MD5
8c187fa8344ede4596af42725efa4556

SHA1
638a2e3778fd21eb49f885699924d29167886fcc

SHA256
08b601b449186bba1dc8bcd697f135d65981174bd2c290cc0819f0666fa6236e

SHA512
327fae17f0cc2afafa26752e5a6957b1a8c9554039c549f6f35d5d83ac968c1914cd01a100d2beaa3ea5dcb02ab76a0099eb1bd7c9f8b7018428f8b47172becd

Download Submit
C:\Config.Msi\e57f581.rbs

Filesize
14KB

MD5
eafb897df79c1607be1496204c743bb7

SHA1
75d0930b732d7ced3f545ec76e201ff0bbae525b

SHA256
c414cbdc3959242a7cf6c3d0f45a9f3c8ae49dfb81d5d0fa6fbe439fc3067452

SHA512
4934a2dff8c79b18cdf3ac22a6dca51b2533eddf660bff722ae31f6481f0f1611510d040a7b32fe318b8753ef0469dbdf4cc8a507cc4bec36d9f7337b2b3cfbd

Download Submit
C:\Config.Msi\e57f585.rbs

Filesize
23KB

MD5
5188638f9c038a8560f22751c5dc6fad

SHA1
11d4b2d53746a7a901cf8dd40b96ee3ca4257868

SHA256
2b0b93d0d49b3dbbf9f6376c545b67e03756c2283ecb9f9b1accb20f40d6864d

SHA512
63c0ad6bf7c2967b9ce656cc8886958e1177085d5fd17014a985f2de82aaafd3ea986d5ea6920d53459affc9e22172aa86cf1e366a9368a786df492bebbb1303

Download Submit
C:\Config.Msi\e57f598.rbs

Filesize
14KB

MD5
70cf96c286d373efd2ea5f6940b20299

SHA1
74e50c4869dca00341285e72cff372d9fa960c64

SHA256
a1aadfede880f7753e9cc0da415094d8dcf9503044ceabb633c898aaf90a8656

SHA512
3ccaa98d35384be0ec43896871582774b14133548e9250cc882a2318228f99bd325ff4f1f9dec6e3cdc50383543ff21c5a3ee5448c2a1e7f33cc1ae28d107518

Download Submit
C:\Config.Msi\e57f59f.rbs

Filesize
21KB

MD5
da4e6cec0ee9a0f29527ed99ff1a45c2

SHA1
2262954083a79f5cc94f9d7ea6cc294ce16af1a4

SHA256
988f69a1348caa334c9bc2f7fb58e2590882924d35c9006403517aed364166d2

SHA512
b072648778a4f70dd6c055f7c8d7266889dcf1b682d8c6aeb68f515fa9ad278025cd21b6e92ffa1fa552cf58682e52df8cef496385f7818001462f361f9f3eae

Download Submit
C:\Config.Msi\e57f5b0.rbs

Filesize
14KB

MD5
2d9c2349bafe2da6d7a08ed5e81ab036

SHA1
3b8f70cc1bce01c11c04a0cf45673b5c53118131

SHA256
e3d4d5d6c8d7d30b288f513e4d84dc39ef10adb52656fcddf7b66e0c579f51df

SHA512
5674d380a6bc074b710f7085bd606f7e5846b12c1d5aff5202d89adee8c4ffdc32f3f5d63a26a7c466f49afbe1001b184c434cce4612bd43cf43a57a3fd66512

Download Submit
C:\Config.Msi\e57f5b5.rbs

Filesize
22KB

MD5
5fcee3fed2411a4fdbfadb5e09233c8b

SHA1
9992417e8931b42d144acf7b0bf4dfb96f4bb849

SHA256
c68cff65102e247ee6afe990f5be4bdb56c204cc2dafec7bea4d10be7d484b5a

SHA512
762a7ca011fa2ffb43105c43a867286ec7f1bc76b2c56e9899d701e6a5bfcd5b3d6b3ebfbb811f41e8080cca1c06b443ab4eb068edef5553971d555f6ef0ce35

Download Submit
C:\Config.Msi\e57f5c6.rbs

Filesize
15KB

MD5
5e5dd5a83957324f705ee2c5a6b3b03b

SHA1
295ac9206d21522359cb30b2730855fc477ca9f5

SHA256
95816348ed6bdc647e064c9ab7e58c68fb3b83b2c97ebfefac45f9b33637fb98

SHA512
a86aa8d6649516058b754d71cd8724def25e82d434e7dc52f03689bb4042dbb08723fe81bac62e80f5161ebbace454ad33d4abe6058c36e1199c1651e573879a

Download Submit
C:\Config.Msi\e57f5ce.rbs

Filesize
20KB

MD5
d76fe74e8aea7024387ce03d6a761396

SHA1
48d4c6303b66ef241767c6207b5452bf293e26f9

SHA256
e725aa2db82e6c05091130058772b0ff11736de0236dbd12a345ec5d10067c77

SHA512
b1a832749661e6af9912928dd07260b861f40c6b09d99b76c9a9961c37ddf602aa85e5fc5bc610a1edd651dad46f5dc81551d0111423301760c1c57dc701ea06

Download Submit
C:\Config.Msi\e57f5df.rbs

Filesize
17KB

MD5
8904c1ce6336a5b50373cc6387114b49

SHA1
fc19b4340b5083871b958fdcf82eff35cd0292b3

SHA256
ae9faafb58cf2e97986fc7a20e95cdef9443ff3301f7c12ef9adafdff6adb6b7

SHA512
4697ab5cf9ec7e32576454540a76ffa672cc42d7220bfcac265962a39fa6b97a72530d675803e68d73d0c805d22134b8b81a8a1e644d20ec57bc06bdb1e1b577

Download Submit
C:\Config.Msi\e57f5e6.rbs

Filesize
21KB

MD5
90725ea0fd6abcdbf0ac6f915ffa7cbd

SHA1
c140e168d1c5c9a730e5a7b13dd81d866723062c

SHA256
12a1850e656cae98e3600d83959f32f84af5feb34f6f0b450a853d2d9871741d

SHA512
88ea7f59a2d1e3c0bcdd78cbcf63653b42a3d37716f07afd95e67a73bf7d9dc66988cb8f044b66b7c9ac87bd14c8a2910fc3c78f8255bdf1ca7ab0fb016da0e2

Download Submit
C:\Config.Msi\e57f5f7.rbs

Filesize
20KB

MD5
8da2465b41d6f657dc174f16d154063b

SHA1
3ac659bf5822ee9482c21e78b4be8f75f4b1fd57

SHA256
fff29b45e64b7e6586209d4ae04bade767d3647b98e17c0c43ee8c823fb8837f

SHA512
46c3b3cd7ebfdf3d2f2768bd8531d53957a380f1e970d9311760e39936b5f696e7d492c0e729033cc7ee3ec007c1f7edab57951193ff2d69c3dd7387c521096f

Download Submit
C:\Config.Msi\e57f605.rbs

Filesize
31KB

MD5
b55adc76a5aaa8b7baa55b8d2eff3df3

SHA1
9b025ff35baed47058dd2cd543544dcddf5c1f1b

SHA256
a52281e5755036c11e204c71746a3b5cb259d8e8ce482c0b712d73401cfb6ba0

SHA512
95d409e1c842bce834b674fffc1d1aee0e6d9a542f4d552cff89ecdfc2b439424ae374293a062c63ed6551bdfebc0d0ad87a4b80d080e4d740a0b7dfeb67b92c

Download Submit
C:\Config.Msi\e57f609.rbs

Filesize
49KB

MD5
5298e22d5272dc091e2a2eb83fa0f76e

SHA1
4ee46a6a175e7d8f155d31932dfd1c5f8be62991

SHA256
c2ec5ff52add0e5fd002521680159c8f6734c97169428f335fd6fd06e69ebdae

SHA512
bfcbbb8612d11e3d4466e3cebc1351e7f8670ec97ea025ebc8463d2d9cdee8a5ec963f8667423347f498329061c59c24c02caac639a83634651d5c2f72cff015

Download Submit
C:\Config.Msi\e57f62d.rbf

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Config.Msi\e57f630.rbs

Filesize
31KB

MD5
637f624a2e5285d816eca9057fa15391

SHA1
eb4f9faecdbfe7c64e402001ea57fc80c3f8306f

SHA256
0f6641879cdcb9e68ea89832c6f237c10de5470b3e948366537c6e33ae9d58f6

SHA512
0f1b36f2f5dedf603c481c4680a1a4c692516711cade4a7f7f785d07ad23a7d487087d99f042165c002e16c43f203fcc79cc79604c46f52131b92a65aebb2086

Download Submit
C:\Config.Msi\e57f634.rbs

Filesize
52KB

MD5
15b12740f8124a2cc945ef05a80963d5

SHA1
0ae67b58ebfc5ad39f26fdca345a6415823d1518

SHA256
84fd9f64272ccc57ac5dc75e877dde3975a1a87cd2cd97fb6a71b2143e4c778d

SHA512
2794c06a9081a362cdc3afb2dde13e0e405d7b6c89f06b7a3416abba5552d5c990e2f2edff3779dbedbc35eecbb0c5f7590923bc553a36be3bc8e6bbefda6b3a

Download Submit
C:\Config.Msi\e57f666.rbs

Filesize
41KB

MD5
b47efccf82672e4f406321cf0a0c5299

SHA1
9ab344771da6c96f46796864d148ce91d5f329b7

SHA256
0cecad18f5df90cfe5fbff9ba65a3a8b7df6a403e5710f11b4d0a2ba0a65e4cd

SHA512
fa60e88456460b66eb300c2d559cf5e47b2a9882ea0929f5603ed0ad1deaf3d3fc966049967ee397ced3a569ddddc5711b5bd33e65750c16be7638aa252c78bb

Download Submit
C:\Config.Msi\e57f66d.rbs

Filesize
13KB

MD5
64ac1daefa5572f6535020180d7da675

SHA1
47fc6ac5c769c7a16da99b9f5a105e2888a812b7

SHA256
0c70b1705fea90840cf1a5b75aa0056aa2521659b396953432c829ed59ee8c0e

SHA512
5930b1a2c33326d942ea4d898ea9780598de2cf34560f89cc33c205bad682c4aae169f43f01f40596db08bb9dc2edc4983c4367db81c14e943ce43bb475a0674

Download Submit
C:\Config.Msi\e57f672.rbs

Filesize
21KB

MD5
6e2b7a03a880ad8ce4b1591cb5931445

SHA1
25bacc3678118c4c583454a1dddde4b5aefa78da

SHA256
12bb1ad58870bce77f31b9277c824da6a98cd8a370437a324d33cb46859afbad

SHA512
691f2268112e3cb51d6ec80269749771a82d1b3a8013ac6b1b797736d750552cca0d5542e7b283932196b43cd70606bbfa0bffe4798e734e6a47697b1cf66ff7

Download Submit
C:\Config.Msi\e57f677.rbs

Filesize
14KB

MD5
9a5caeb798665af1a475a0ff192ffd83

SHA1
e29c8dcdad7c7764e462037868cf9c4893c17075

SHA256
93635d1bc2fd8b0e153da158ff457e8fe43e79c68e7e8f58734294248da12776

SHA512
d558942b0559830996367aceae5b470f34e45b43dff235368a2f83b1307400affa91e82b9268cdc7cbfbe0af8936d7edc1df85c8e45f24984f1a2b0d29200a1d

Download Submit
C:\Config.Msi\e57f67c.rbs

Filesize
21KB

MD5
bee5ffb249ee6ca45a2d34a87b9d6feb

SHA1
531a7f0c74284ba2831b9df79dfc9d18ad87a8bf

SHA256
cc329aa25521e6b5d50fa0251b1c004fa3dd0eefce41d756ab4c3cdf11fa67e8

SHA512
8786ac7067a1712a1ffcb98c595b250d2df512f2b8fe53734f4620561357427933211bf99f14e82ab393048258d9ffff88ca389089981d25e1ba1e3183e919ab

Download Submit
C:\Config.Msi\e57f681.rbs

Filesize
18KB

MD5
117abd929419d71bc8320c820c1ca1c5

SHA1
643a99d584ce504d6ae7569b19c1174bb4c50497

SHA256
63698bb32ca23472935c5d926b5c98c2eaf2a8ac7cea4d2a65ae770fb3fe6941

SHA512
e31a83346ca66b108f45b0449fd2a09e32990f9bdcb2d7739bdd210682ce5437679621073e4eea775d404bd6a831c49fed103177a5215e90d112d825ef1d07a4

Download Submit
C:\Config.Msi\e57f686.rbs

Filesize
21KB

MD5
78897d8e4bc82e6c15808d1e11cf2115

SHA1
817b415783cb4321f1dc067921e3ff86ad6bc07c

SHA256
c9901c4840a4ebd906d1b5de0a44f1865bbec6e89afd4198e2723f28f308081c

SHA512
c2a93eb0e1ce11690e82efa8de9daa8b7c96dfd6f54b479fa57891b93690779d6d76ddd1d1c393b4d43e198a0ac94b2a02b70b85c1543dd6a8844a27743f56fd

Download Submit
C:\Config.Msi\e57f68b.rbs

Filesize
304KB

MD5
693465842e8f42691c081e0012238910

SHA1
420d539c442a030c6e524511a187c0a5e9c40f4e

SHA256
98c145754a08674e53ce43e74e96913bdbb74f07b41759e871229036c9a1931d

SHA512
b2bb065891d5f95511b3b0f67397984dce106167551de1e1ac40883b868c5efe01b7c889d670d7fd663f89f7754c8ea59f8a0a9faebd9c3211d2a64b676b9053

Download Submit
C:\Config.Msi\e57f68c.rbf

Filesize
44KB

MD5
bc959a160882b0de0583047b1b5b93a6

SHA1
78bda837a0fcc25623b54e95f3eff76c3bd79332

SHA256
b9ffa79403a9c57e5a36d6632bf8ebf8da0f6256c0b71fe4dba50390df17702e

SHA512
7cd370afe9903daf36543a2d57ffc869f2ab324fc4ef363119d4923eb3b6079485d6f1a0304b94b928aace18900d034d74ffa0d1cf8382301f6e22f4daf4f0cd

Download Submit
C:\Config.Msi\e57f68d.rbf

Filesize
41KB

MD5
91ceea551937cb5da627f33ef7995ee8

SHA1
4e7483605c4027381e4796345f0a0e6aa9342a5b

SHA256
4256104f1e0eb69836f00b38813ae62f79abed1724e0b07f8aca908e7bb74806

SHA512
2d720c8a331278707913fc064d7a0c2727ef13b3f8cd46aa4e4a2936aab2b1228d78c1662856739964a87a33c312be2d3f65170f38d65545f3a3184c0ad635f9

Download Submit
C:\Config.Msi\e57f68e.rbf

Filesize
76KB

MD5
7173d17aa9ff4cda07fbfff21a584a67

SHA1
37b04626e282aa6ae2a2dc96117dfc5b0b1f25cc

SHA256
972595aefda400197282647fa6d6e40b58ac15591443213682a87d1ac80cb867

SHA512
b583058ce0a7bac48042d63142342a430701f96bb8c8c0f00e2bdb168cf431e2f98a58bcb889623f6e6775195a9d4bae8f37686a48a2cd0034e426d6089a4167

Download Submit
C:\Config.Msi\e57f68f.rbf

Filesize
35KB

MD5
da7787ae5278031ef79441d29599dcff

SHA1
4e2a4c70035808dd8bffaeb6ded8fe2980566e0f

SHA256
06afbd06123031d3198a25ed0cbb7cfb08c1184cb58ecd7d12f42c235ebb5b39

SHA512
2c1ac894e778aea4515be33b9e894f89a527a5106734a8ea6d6693557aff8417a7f7b340834dd1d207e85e250e718c1d0365332e77ffece2f9e1e81b0082bd7e

Download Submit
C:\Config.Msi\e57f690.rbf

Filesize
35KB

MD5
86a1d818b679edbe94ab51b963ba79a1

SHA1
2b9ee6b54aa2f709442e7e514335e2548c933318

SHA256
b36b011818770bafe044bd83826f38eb81093f529872a0b83e341f6863b3cfaa

SHA512
ee1ee27bc740b4e4e29a11f4a428b5ccf7ef545444db972b64a8f4b7884462b8c589b5911d7d33e3f2a7b0d97dcea0b5d610a99a00b04d8b3099e695f9acf5b9

Download Submit
C:\Config.Msi\e57f691.rbf

Filesize
21KB

MD5
6083b2909a6c1ab52ce84da1b435e7cf

SHA1
e851ccddf1fcb0c2fd9cfb4a357f72633452f240

SHA256
0ef563502d57298ab0962de24692931a32327fc1338cbd80b6b0b2cab067c956

SHA512
53b8aad68d574e57f88fb3663b41455859b2c84ddbd152aa1f0973df15ad1ea1e72b57b54a0984ff8e4abbd1e4606833fb2e132d1d49d428f2e0ea4e7c4568f1

Download Submit
C:\Config.Msi\e57f692.rbf

Filesize
24KB

MD5
d87310699e3baac5ecc0f64673fe3485

SHA1
34460b0eb74977b98d9d3e683d5ffa2aec11059c

SHA256
4f9a3c48edbef17a0984c473d0d100e5541a26a92ed4ca3b336974c5eaabb4eb

SHA512
096196d3ff876b7cc5173e0d30125174e6fd1bb60432aa9cf64c3b22fd5ed2fa5a8bf35824e5840ab248b1015907eea0eddd964b4191f52454b03edf583e0b38

Download Submit
C:\Config.Msi\e57f693.rbf

Filesize
280KB

MD5
a3ae8e892e025e479978fb07fb449784

SHA1
71a1641ffb0da859af5e355c5bf4a9bcf1746e74

SHA256
a991c7d6fd80ce581f8bbeb7268032f06c9434cfa67298b0669c84d38be6535b

SHA512
e39d58dc26f8710006fefb51cfe1adb34c8886b6b281a8ea3d87a89c116e255d39c028cc42fce05a8ed61dc0a7c602e344e6c0957bc4156f9a76677687591a54

Download Submit
C:\Config.Msi\e57f694.rbf

Filesize
108KB

MD5
1c8e5ef9f86430fbda800e45c0a89aa5

SHA1
4e18ee249a208dbf7d7b52d412fa0d402fd3ff2a

SHA256
6e18c01cb3fd1b795c062a00d2921e8e0eee8efd89fa77d50c5e16f2b7ce74b6

SHA512
721f29dfd9beed272cbe213eadaba62aa1e1979828b23a226cb05eec536ac495eb33a01da05de82a23113a6d0ad4012032f453339499db3816abfecdecf19b66

Download Submit
C:\Config.Msi\e57f695.rbf

Filesize
152KB

MD5
6742f826c21773c933fc2a68ceecb99b

SHA1
dc689d3fb31e7cab6a33cd2192d6114542173514

SHA256
a203989e4399f9443a8848486292dcf04d7c7180dc7d1b4af07030cb0532e036

SHA512
4138836bf9561104facb88c175d9a1d29863110b7e0108149cc0ff32edddbd30ee1b0ba4b7ee8137ffe36c973aa2901f7c23a3dafc79a26b09a64a8b95b6db9a

Download Submit
C:\Config.Msi\e57f696.rbf

Filesize
140KB

MD5
cad14a2ced4a556139097c1f716eae70

SHA1
9552115b645c17165bacc2231725b3f8073105a3

SHA256
35cd20b4567788e3229be61becd6ea1eb115a2b81bfacf3d65d81d0003ecb96a

SHA512
df629a07c217880f174d52772090d49a5e88b73c0df45fccb714cd6ac4c01612e0aa755a1a0b9ba6c2a7a6701e6e94653e71a54c97a1076b7a5bde99d7f0c331

Download Submit
C:\Config.Msi\e57f697.rbf

Filesize
189KB

MD5
1f50737bb92b1f71b15824a0f113d3f9

SHA1
4d78793ea921986d011a024b91ac59d6c02de6e0

SHA256
f48f267a6e081809bd5ae607aa649529849a6541ca303a5653f6515d865a6b57

SHA512
89e6be6df11dd02896382a7cc9ee41ce74d5bbf845722531ff9a26fd2cb1a016925ea7d4948a4a652c079dafd084538b9b74c4a5dc0bfdd3cb2f0293796481f4

Download Submit
C:\Config.Msi\e57f698.rbf

Filesize
76KB

MD5
d68368708be2b6dac797743e23dbf655

SHA1
e843b858d72359ecf6fcdfca328ed19a7f23210b

SHA256
dff2dd57e4892ce613b160c935e2d0215d3357edb7791ceaaf880b5995c98361

SHA512
2542ce485c0c630b09be44a4faa841a3ebf2e1b7bd794e0b3fda4e866d97361b014eb3895c70c6b7acee4e29dcfd46b76697a1602666d1febf9cfa62988ea86e

Download Submit
C:\Config.Msi\e57f699.rbf

Filesize
245KB

MD5
6c42a2375813076f3c24428084741c10

SHA1
cd6e65ab9715ebb48aad56f4bec8a17e6a7536ea

SHA256
74d33e330fdf24cd40ce468b9a3b0960d417d9be0ed0ee45d4738d29948168ee

SHA512
e19df6abd422446c4c68fd22d14cd8a6e23965d0d93240b4dd7a7907e19e9e9ee38cafaa7457432515c3ecea32beed5252240e4c017fd907d85badafdc14157d

Download Submit
C:\Config.Msi\e57f69a.rbf

Filesize
292KB

MD5
bc9a83d77cae33f9eb9bd538ab65b2a1

SHA1
363fe5bb344cf1843d5f7eb2b0a725ac491ad6d8

SHA256
d0b2520c660959e388b3b24b1ebb7a6eca25dde878b0c0ce798657ae422a9c3c

SHA512
37ac66723c5bb78e45df3ae7175b497353343aec2eb5412213e3c6a1f3558e9cd68479728644643faac97c34ec3f3c43b7d01bb36b1e406613cb46ae4cef1c57

Download Submit
C:\Config.Msi\e57f69b.rbf

Filesize
128KB

MD5
c7fc5f01de9577403a1ea8aafad79e72

SHA1
6422fa355184394ace02c0ba88e5b8af3db7fa6c

SHA256
c778577e39211753844d5fcd2267464c043cea271c1477e866d40c9cbdbe49ef

SHA512
b7af7af4aa1dbe92000722bad422af6d54c842af065427e1cf82f61b1a0f82e71f2a2c9b4b12d1642205dc54ca23ecd4ac61c8015076389907914b0cecd04e87

Download Submit
C:\Config.Msi\e57f69c.rbf

Filesize
92KB

MD5
535d9d8441e0e22aa3f407c7197f8a0f

SHA1
ec6d047e975c107a7ecdf78bf352a5a68f53392f

SHA256
6e6afa2d6e7c46b9c64406efaf23bfdd3f7fd7a25cb757580f70730f4096ddb5

SHA512
f5e051ef6af191d86797a55dcd114ae920f8a285191f3f09c3493497d381f9ec70921d712c93280b3c8e82fefa77c040cf51e8af3a1e52b040a7fd442d9ee95e

Download Submit
C:\Config.Msi\e57f69d.rbf

Filesize
356KB

MD5
5e1a793d9615d4d9e153ee416abc83ad

SHA1
27d231f4d1e2b473f9695daa21b22804db779826

SHA256
8186f5e641a5b0770b635814b5cec2a5dff43158918bc1174edb328194b27090

SHA512
f54e786f2fab5324ce87be1d84ae69f63afa4ff5399e00248451375d2a56b5a0d30c74b27e5fd56b06976ec62688b09dfa39c4a1a02d47c3aa92da21b5e95876

Download Submit
C:\Config.Msi\e57f69e.rbf

Filesize
352KB

MD5
03898441f5d9a8809c04fe746fd498b3

SHA1
35cfba8e3600bd0a3389e96dd56ecd8efbf5ffc6

SHA256
8da3b816828229f66334565432f12973529f0d594b685c919b753cf2f692b296

SHA512
dc2c0f6c8d4985770535962ad31e55c13abe248363c12cf55a14bf1fe9dbbb78a2c91eefd9a4711beb53606202b1c2d5648971339c4edb9a61dd271b61416b12

Download Submit
C:\Config.Msi\e57f69f.rbf

Filesize
82KB

MD5
f148286b321ed09c2d17e9e3637c807b

SHA1
b0928429f52028b512dad9c7e0996ee7ade315d3

SHA256
33fc291a41f38880549e72b23ec4598cb7404259a93775f59bf2be17f798a69a

SHA512
d175430df339ae9b0f46d00aac752697f95ced9f7407b2d15505645bce313536c065ccfe2260787d4f387ad548f02a94457e662c32174f36ee97a76fa8e59f0b

Download Submit
C:\Config.Msi\e57f6a0.rbf

Filesize
41KB

MD5
e3c8239a97601bb203b9e9037eed89c2

SHA1
75f0e5f417477d4c491e8ad81f498faf761618a1

SHA256
27864727360196540664a55e1808db79f07303949156f843f0520106ebe047db

SHA512
71304187ca95a404d6d175d40be1dcf40d1744c644412e702a25fe7e9745977e3f826d7a9ba1f694c3da4382e8f97fcf41ec8dfdf40240dabee932619e26e7f2

Download Submit
C:\Config.Msi\e57f6a1.rbf

Filesize
76KB

MD5
219c69df0c23fdaf84e4c9ea2835a628

SHA1
d3b091bfcaa8506d299cb1d7453fdce7fb27dafe

SHA256
e9cb0016e439bab9d34038b15798cd9261640dec8c577a0035314de5d7892457

SHA512
e209df73a2dccfbc349657925ba9760dc2ea9b52e696f5159bbf3c729e768ebf43a1e6e86a28bf6b023dfc78fd217f03648513479956bfffcd4da04d1cadf8e8

Download Submit
C:\Config.Msi\e57f6a2.rbf

Filesize
80KB

MD5
75e8bc00ad7da1e7628f146dc33cc83a

SHA1
b140b32eeb3cb2223efc7c92346e3c4ecf65eb7e

SHA256
5a35e93da45d610cebbdc4980e7a33b3d094039a49823561c8a3fb87e88f747d

SHA512
b80522f835414b493c97715823902443088bd33c7e54a5fda665d73de7899df5e59c44aafdde33ffc9d71dc7c48036cee050dfdd87a24c29a9fff8ac1253acd3

Download Submit
C:\Config.Msi\e57f6a3.rbf

Filesize
48KB

MD5
775dac5f81248b14182c82013672c42e

SHA1
cef7bba712b25da04f60f597cb614c7e4b87f24e

SHA256
e95e6d348912c8bec21b006ba6ef77e52fe74287debea2864180c0511e68766f

SHA512
2d99dd61a4ede26a11e6f4c3569732c47911605543e7a72b0298ad25e0a573ba884bdd5719cb8b7cfae43b25f41ccb764c8a233d978346bd49bee1104e7cc97c

Download Submit
C:\Config.Msi\e57f6a4.rbf

Filesize
24KB

MD5
2a9b706d83be29f32a28f29be397e533

SHA1
31135de80dd7b7c4a27516806fbbb13d871548d9

SHA256
db47a4a99dc0cb5f558891ff552f75053122d04f4e4a2ff6165734cd456a0236

SHA512
cee9cf2576729b34f1352f63d9684695bd491586d31d3b3e81b11f2136b3843d513dbf59280b5aaa63b1cf085f0840040abcdd9d3d72dc15103987b2ad812e64

Download Submit
C:\Config.Msi\e57f6a5.rbf

Filesize
36KB

MD5
bd3e2c28c647533a057b5cdf8bff2c5f

SHA1
d36c80e460c5dde615ab1c268bd89309225ecb82

SHA256
f2742a96cb0a290ab71e316c086db449e6262a4614c70956f69165df8f9a0d3b

SHA512
14aba74084828f9710a1880d8ab55d7c76532d90ef6c9b8b5aa4cf7c67cbae1892b909b35e9239afba181a09f5bb59bf2607862d16330cae09fdcee0248a18cc

Download Submit
C:\Config.Msi\e57f6a6.rbf

Filesize
52KB

MD5
63a1e9cde10490008ba7ef47a12179d1

SHA1
5299af182b7cf08f95fcb3815149d7c54e73187d

SHA256
9b151503214ef428ece37af31d3d8345f1dc27fd26d17b59c52b718e8fd08bc4

SHA512
dc4074fd0614212d54dad0370bb99d53dbf9078cd3d4981d96f5ecebe36c82df0406cb2c232d07a1928a1ddddef74d832db3e7f479d5d3c1292481143c382efe

Download Submit
C:\Config.Msi\e57f6a7.rbf

Filesize
36KB

MD5
7a016cec8851a57b2f0376ae6d1fc837

SHA1
f161f9d8d7b073c1f17f55719c37124969bd7d2a

SHA256
19e5e00b55a8b1fc36c33d0d4bd0fba24a03a0959e91f3ab59acb353fed9677b

SHA512
f646fcd298b7a5d7b451219544ede8dc7e09aa3ea6f9a4256d336373d63b475281020ac70e5e08024e2dd8b8c886ff8607ae3139ada650eb8a6293aa0a141456

Download Submit
C:\Config.Msi\e57f6a8.rbf

Filesize
64KB

MD5
4d4774a30da56119888490cdf3157b09

SHA1
360221725daa9b7a14460fe6939d54b2173fb8d1

SHA256
0ee427eaedbcd82bd07674c9793435443c5b1c0780092909cf791198f0ad85e7

SHA512
eca13baee14a633c3a193df85c28eb797c18063977cea410d6ca41d0aca87379d04e6d2850a032ae5264e536863186e96eb9dc8baf1440517d69e33d4de73130

Download Submit
C:\Config.Msi\e57f6a9.rbf

Filesize
62KB

MD5
9002a577c07ab2b99979435cd8b67acd

SHA1
5b3c6231c113b726ddd55fd8a8e3ae84b1526820

SHA256
c323b9ebba3aabb01111f281f604ec0555c6030134ca18422ac7f6c73721d9c1

SHA512
f4e066679e9c34cb44cb459ba178fd43ef2e600f94f86ded21af1583f182050178a57271f2a15967c2caa87fb6eea1f5409edcb87b95775245db45af6506bb47

Download Submit
C:\Config.Msi\e57f6aa.rbf

Filesize
61KB

MD5
218e31b07c6e07633a84f0248730e220

SHA1
47ee36529b741f3d52c487e6dad151f516c2eb5a

SHA256
241e01940f6f128aecc75d21f148468eccc2d368883f0f5a869fb7f58f57e5ec

SHA512
e0481b2a424da192bd9ae9728a89f7c1496e887f198150016ed262b924b1634b414613bb80b969effadb3e34a108992768102f48da7a41ea87b9f2a459a2ddd0

Download Submit
C:\Config.Msi\e57f6ab.rbf

Filesize
81KB

MD5
93030b5af327ece3ddc3518410e1af59

SHA1
4be27729a906169d2afcf025e10f308fce35056c

SHA256
ea82d8bd8289e5892cad2443c1d586c0a311ddee52a8fda0f75072ef2317b650

SHA512
247e2d5e63e6bb12dd826e452ce7a1e086152a170e7f15c0d7794a1588838c2b6dd4038f07dac42844356795b72b5aa357e01039e419c6c5d90b05ebfd74da4d

Download Submit
C:\Config.Msi\e57f6ac.rbf

Filesize
200KB

MD5
c30dfa5fbf9f2e6d18ceb7108923fdfc

SHA1
523c4b9043cd6d722c01215f64173b9287623d76

SHA256
ec383c0455491bdcab4a1e8692359543d96f82ad73602c171734ae8ce45449e8

SHA512
075b726d3e37d9ba15db1aaca781502aff97b90dc6a80c4e1be20368dd1c9df13160b9d8bce09bfe467b406f7d0b698c6ace6aee5b0bf4149e4508d9ed74cab2

Download Submit
C:\Config.Msi\e57f6ad.rbf

Filesize
197KB

MD5
fca2f9f00de26d0b5af4881836d6337a

SHA1
b11dcad7c00c2c85354b131c796ae34bbbefdb38

SHA256
19e6ec40e9a239b3b208eb3f7874a76e12adbfc8b865f43452296df66a14e501

SHA512
7fae923c2a9c604991b172ac91e7e9e4298c01391940f23a190eb4bd3920c97af2476f1a4730cac350ddbd8956806e98870b46137b1711b224a6174c441af738

Download Submit
C:\Config.Msi\e57f6ae.rbf

Filesize
27KB

MD5
aa8ef0154efa83de1c2786ab1cb76f37

SHA1
5e4fcdf55c34538dfdda172a985731019f74898f

SHA256
db7364a16090f58ce23aeb0426b005b1d1a965307d7d4de117a553c190ba5d57

SHA512
17d3c193a516bf56ee6a28ef708b01c618d5a159d7c389be6f54579638e3d9c0a9a3add7dc6e19c6f0b63b235c53bbc186d92e77c60ddc297e2df8c612332bbd

Download Submit
C:\Config.Msi\e57f6af.rbf

Filesize
15KB

MD5
62faa6fe395c5810fe4fceffcba62966

SHA1
ed830d3d1156c3a5ea6502148f4347af0c4a8051

SHA256
1db349e42e9c57afdefc29f18886a98290099b74210cb396ac5485247bcee099

SHA512
4e876c4afdce30b29275eda6ecbb14aaf56bdaef4a1951e6ad09bbe2af5a37667d18f4358c895843010336f467e0bac3a7f8449a907011124d4e374c7b0c1e54

Download Submit
C:\Config.Msi\e57f6b0.rbf

Filesize
90KB

MD5
facce237d5cc5e89d8e92a36289f588b

SHA1
5b91fe97781b107df2754a5d38807a597f1d99a2

SHA256
ed9b46fd9f3275639988cb71eccb7c3f31b48282ed78e4abc9ae303cab219bf9

SHA512
f0363e0c7414157dabf929fa9c4b49b74d86a0997481b48d29ec3f0708221d9fc4954f4ba93f4299e9ef0c31d38dd8a691b908cc6557864c1a4baf3f448286f0

Download Submit
C:\Config.Msi\e57f6b1.rbf

Filesize
168KB

MD5
d2d2a9e08ad2df5d73ca0aa0797cd96a

SHA1
f6050bc38d27c805daa078383506b93c5dd854c7

SHA256
1246532e2e335750fcdeb3c801f98eaca1ac6579d1bdcae1c5ca89f8b24fd879

SHA512
197385ac8d349674675fb411cbd246b53b0860f8cbd47b79f6f05ebefda4563e75285cac2bef45ceb12cdfcd4b4d42c47050767608f96eaebc7111dbdbead1de

Download Submit
C:\Config.Msi\e57f6b2.rbf

Filesize
55KB

MD5
158f96bd130a9f3a1f7e91dc611e8b7d

SHA1
207264f61e8d8cd77c7dd82e7c8c38927bcdef85

SHA256
89885cd48e706c533aeff66d45cfee67561db4708bef31367a546f685f30eb55

SHA512
6ae9e17dddd7ae166fd195d202d73904bf6482d727f0a9d5cc01454d4a58f9da027acc9591dcfacafa039379bf151cb385ca4208ea70baf069516ff98fd31d4a

Download Submit
C:\Config.Msi\e57f6b3.rbf

Filesize
139KB

MD5
32f2ac5f45b93b733cab1865affd588d

SHA1
5062e6d2a8c1e06e19c9f0b29164915286ece618

SHA256
38f422c1c5751cf6796c44fec1c478a2a5379ddb6f3512004f1fcedad3b35cd5

SHA512
8384c6aef7c32ac0f10aad8490d82b1553c3d194dd3f7821bbe2c75eb50a6e5ece195be6c09615f273d3d4935163c15d1c83e7bc4ef45fd1113a9f0641ae0bf1

Download Submit
C:\Config.Msi\e57f6b4.rbf

Filesize
351KB

MD5
18a9dd94b5112ea94f3fc9fc22ff8409

SHA1
97a0b82343ef1599e517946a2c3c259b61e53ca7

SHA256
55758341c4094ac4cbf26712f45f1ed17fc1f570197538ac2267bd896a9f854e

SHA512
7bac448be18324efd337c7cffbae2c6db763d9d7450e70dd33b214981266008b7e4d0a895c7fd214d908b3eecb9a7a0ac0aba1d57c9e1fdcee3f9e72c39de3f6

Download Submit
C:\Config.Msi\e57f6b5.rbf

Filesize
361KB

MD5
0d3f3646c5638d9cc8fdaa159a698864

SHA1
f42487961ec708070a8d59428821aee39a00b24f

SHA256
b995226455ab343ab3fb8f0c9fc53a0638ae3bc1db3cddd00a9b567ae2bc9aea

SHA512
4b682b3afe8cfad1b497ab00fc159d7f43e708aeaf45f194f7e5cd46bd76838c9f4fd71a884ad2b7e9cb82995dd5ebae9fca24e4719b0db97f46aad65a668510

Download Submit
C:\Config.Msi\e57f6b6.rbf

Filesize
137KB

MD5
9f735917c0bba0f42b40e719047eefd5

SHA1
d8c1ef036b9d841db86ffc76d9150064ee836cce

SHA256
7acd536b7e7fbbf4578ce24aa39740279e7ffb7477bb77f6a2c7afbc12f16c83

SHA512
65522b77519efd6d43f17848ecf65d4bfed8f07d9f4212dce7f6c905650b4107396e7067c62802c7c953b02f78e924560c8ff151e195c0cab37606be69270a3e

Download Submit
C:\Config.Msi\e57f6b7.rbf

Filesize
313KB

MD5
8fff90087bf1665f043b9a7695e7b137

SHA1
241765749ef43b80d1e1fc74a375d1ca225798a8

SHA256
469c4ba594d34eba876fe2fdd5518781adc24da954772784feaf3c72ebe922c2

SHA512
5295d6d26bb3eeb9384413d8e1433558b66e53937ea91c1db2813fbbf0704d6e519738af244b306040648aaf4dd86f153d7cdb223baec3b52e48b3beac76b7a2

Download Submit
C:\Config.Msi\e57f6b8.rbf

Filesize
75KB

MD5
683fc126a13b915b3ff36735ea5ca5fc

SHA1
d1ccfdf78919f51b09fbde02c2cf0f332601bd74

SHA256
b8361411d7b7b0094669b0f74ce8afb488cfad61e2c26f76473db9ddae702929

SHA512
4d88cbe5c42815940595b1c7d466ec84a9e753977fa234591c0b14d2d826423c5bef13aaf93e4f3637a669c56e040da53529dbc31339f18b0587b0c1270c14d9

Download Submit
C:\Config.Msi\e57f6b9.rbf

Filesize
311KB

MD5
a7cf9a4c20e9b976611ba62c72753bc3

SHA1
1cdf05a20151942ebae91505b8c4c7f82beed627

SHA256
4eabc19bed47241d9b0201676b4bbff382574ae52fbde7f5b0a9bfdd0798e74e

SHA512
23cd1ea153a44629c03ca3f31e71aa3ee1d2167307c2330ff368f7a8b21dfcd596237f24c3944b491f007cf3100da5692b1de0672966ce3042bfc3ae647c9998

Download Submit
C:\Config.Msi\e57f6ba.rbf

Filesize
131KB

MD5
d8a76dfe6188e600bd7a8480dcedcbdb

SHA1
40080e226be118c2a0a8f9dd70879467ec09f198

SHA256
a1254966826e2849b1ba2d630e93ca7b75105c8d3acd9be795d625edf835ac0a

SHA512
9a01c3290be7d309e23a6048731c541cd0c602669ace34779e1e69c29da154b378edf0cacfe92354996e293bad205c1bfaf6a003840cf53216100cd39bf6dd76

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi

Filesize
232KB

MD5
824f1f188704d3de77660d90fea6b136

SHA1
9bcad1428defece9f2ceaf647d9571ca41b3f40e

SHA256
72a46f29c780949c1151efadd899806ee192b6fb4a87a9646d638df95f3a0bbf

SHA512
0e67e74d11d9423e5b8c95f35e66f173d051e5863466837c3f9a4cc2064d4e4e3e1213437c29374abe6a888f48280ac45da9befb8e90ee3bf111f695916cc972

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd

Filesize
28KB

MD5
16d16a4f17b3237db400b6a6e92274a1

SHA1
9b88979ad530b27fcb31801592d0b6b9bca46b24

SHA256
9cec220d05d4d851ee5dee8fed85bfd30953787fb62d3f1249d0749db9d1d0f1

SHA512
eb38032a4e3603370c58a45af4e0aa79b315cc7434ed367c8a2c1f1608954052431bb961fbf50ad789e7d640ed4335526dc96f847acef590e8973d7876f9a304

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\filever.vbs

Filesize
115B

MD5
c1aaed4e1791179d9cbcaccd4b544793

SHA1
71e365d700bcd1afbfb7a030692d891cce18eedb

SHA256
d4964554ef1fe0093b7c66e1285b1598bd9573df0b99f9a7e222d1fee448f860

SHA512
7c56da34bd514181ead79020547229a3fd01b3629807ff7acccaa2ab5ee747c58645c9ea1113ca7fa58b9d78de9f595010364c8abd2201eea48563fac303e11b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_9caaa3a5ed56b92c\ucrtbase.dll

Filesize
971KB

MD5
1eb17f650462eea820f4cd727d2d3ab1

SHA1
688f59160589ffa293502bffcd5c0e62e1993903

SHA256
24968e69daf49f58e812ada3e4cb24a66d6fb9ef14fc211538dd992b08ed1c3b

SHA512
4b2fd6f202d2c697d10e0a2751ec05128071c7a3f1296c9f41fdbf07b334d8eb48dad674d91150966e0ea925c8e2aeceff904bb3d055989de2e1f94dd7d4bf18

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_408c082234f947f6\ucrtbase.dll

Filesize
900KB

MD5
3df1d7da8c1493a5a00c0474323fef20

SHA1
f771c2f2cc1b0fc8534c7670f1633e8316f62092

SHA256
a134a1d4e9143bce04a4bbefe4f7ee5ad677da1913c1186e021623df01ba28bf

SHA512
fde8e6a06b13ebc64e42e09583e1466d32812b907274fdae8a5e04ee27f108aa311646e62b65aec30db5a9c150fdfe478b1586a7c413101377de50899af36582

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vcrun.msi

Filesize
36KB

MD5
02a7a8f705fb831559baac094a0b4269

SHA1
d47da0b6572514af57c3246059a4039df059f72c

SHA256
15684d42d6107225e93cba6c6a3311a7a86d4b515027da263fcd949d818532f2

SHA512
a68108d6a35a91750489a6c4a599187c3af5eab390744f3b56036a092117a6befb5cae9df56284ad49bf97aa99ae3bc6c1bc31a52a00e89e26706ab25ba7c400

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.v9.0.dll

Filesize
101KB

MD5
3a2be55abc357cf94721d4c4e56dc1d3

SHA1
4b518eaf0311468d8afa07bc40c70b007f96a531

SHA256
408386e17d4c20bc2ff25e4e63469b1f089aa07726586ccafd6bc83f2910456f

SHA512
8e103db985f8efc2cc6e6bb300542ffa0cd79c33fedbc45dcd0498e216969e4a8c37bc5dcbdd6a025729050e793fa2ba56858b077bf55d9c74a5bf18ca1ff5b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll

Filesize
27KB

MD5
e3799982b9b14b4aade990a3dca3f46e

SHA1
828a8dba5778b5682a19b7f32be155ab6b264c7d

SHA256
986c35d252077e4feecde7ffbd758d1324d589447992625637427d989c0e3234

SHA512
dda5c605f45b24b565fb006ce0a23e9991be9ec22dddeeaadde3883b591a72ef1fce7574a57c9eaad94ad904e2e73abe2d384815e8bb2d54f04394fc70e3c6cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll

Filesize
31KB

MD5
4ac5c9714bf108cfa18a30ac045980b8

SHA1
94bcfb74222e30a250d06952c2d336b7359dc191

SHA256
c3f1195c1e25a7ab3f202e78d1a653a5a9955f88780c43526027d50a87ca61a7

SHA512
d8631798973c17a2ec930d7859c1fedffffc78abbaab3284eed9aac852320ebd524195d45b008790c89e2aa2ae55c4cdc51b2309fe4b7691d91ce79fbf0363af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll

Filesize
137KB

MD5
ee1ad00cc1f9e86a03af73334bb198da

SHA1
d8eb6282875b94c6cb0667fc8970c768e1fca040

SHA256
4258dca13af72afbaab2190052cd78c31fd60c1771a15bc718ffdb74cfc30481

SHA512
be4dfacd19f76087e8d3e0ae9a95ceed5b73bb1b8dc3b3276b0c3ee2378a459388cd2a65cdcd830498d993dde650f459ac151119bddce842f68f80902726f59b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll

Filesize
79KB

MD5
32c430b1bf1348ca75656e3e8207c89d

SHA1
13b9c1b34b02a776c0067248ecfac5277e46d864

SHA256
698d79a05387757a16268ec99a296d6417153340f3df77ce76e70210563c6493

SHA512
1a6877ff69d484a50c64e2a09fbc7a0d3ceea149e30eadb59845b0a76eb4648d0ac6b9bbf7a76fa4ba4330d60fc51cee2eda4f6954da27126f73d78ac4427923

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll

Filesize
85KB

MD5
65463144c1fb623b0953969db41bda91

SHA1
5d6dade8cbc813ece4cdbef4d299e02996e8e2bb

SHA256
221cb5eab666a82d54b94fc03837f6fbbd2b8ac21c6d5be21ca4ecbf1e8618b2

SHA512
32a2e98d5221f88a69c3d12d38e975ca852e6304caf4a54219f1029e696d48b52b89b434dae6c5167e7133d3d484431c5236fbd1d0dffa655c7cdd94ed6b7c91

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework64\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll

Filesize
44KB

MD5
e4b08f20d60a58b0c6728151236df043

SHA1
dde2390aa352f386eab74294c1ab27022a3d80fd

SHA256
c14678e8f41b6acd9be49aff9d06dedcc23ff7b5de51e5f6a237a92f9e9f6ca1

SHA512
dddc3d34e4d357b0d5ae48d830390ee0b15e8642888c8f755a96170ac32753b79f316e9507149565d0026d65cee37de279ebcbb23396f1159648eafd16100b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240203062347_0_vcRuntimeAdditional_x64.log

Filesize
1KB

MD5
36321ce60af95e10c011a12b373d7bc4

SHA1
ed648f43293ce1059c1934dd39c9542ace72fb41

SHA256
5787cf93c1ed7197dbda8ec0f8dfb9bc6976fa4aee26dd71aa3277e093b793d0

SHA512
0e3c70df97e08cb06eb49ff7bfaa549f3992f698133f4254ca0fc07db89102bbd7713265c5f63415122bfcd992482c556a2154223b04c889810a22aa68726a95

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240203062347_1_vcRuntimeMinimum_x64.log

Filesize
3KB

MD5
85f34b291138f406a57bec49014efafe

SHA1
40b43b46f1b36d4d0ce3fe6c553935c831128b4b

SHA256
2b0d330f8705e764de2a1e7f2bdf444ca9cc683d8b202554551b12f8c97ea189

SHA512
8d3a054df7dcfb6c9985fa5b18ccbdfc4b4a706feddcc73f8714e5b73646af6c97ff4a8cc052724511488f9156e2d37d1c6fda174857042b663a970f54f57ce0

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240203062355_000_vcRuntimeAdditional_x64.log

Filesize
3KB

MD5
589ba19f6055eee8387191fabca705cd

SHA1
68c01c214c38181e0ac46f36dbdfd3d008647493

SHA256
c2fd104ddf5f2be9adb6dc6c4cb1f395220576cd470de31aa20e135670fecce8

SHA512
6f948c1ae9e2b8a793c2b456e4836364e45fe4534240bd21ec2962aabadeb15edba0b4b10a4f584055ad86747b2120ea2c30b1b058cc1d25ef48cce390f8f4a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240203062355_001_vcRuntimeMinimum_x64.log

Filesize
1KB

MD5
534e7d7c2189ee0e95d5129203b31533

SHA1
d85307add26128499da7a2a79c8c12189d3ca01a

SHA256
88befb02f9646fd8ab1a3433678713be7ddf4b53a0ac7a4149cdce76aa6885ae

SHA512
68a09e3d34397c7312df998e816f50195c479ab5b9e6f82d195fdd6e34fa52de85ef5b4818c715972f22331575302277b1ecbd62df092503de4da5284e2f8bbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240203062405_000_vcRuntimeAdditional_x64.log

Filesize
1KB

MD5
98ca99adaa248dc2fed1ef4c9fd606c6

SHA1
432a4bfc8de1937dc8a8eb36caed967e6833af75

SHA256
64a7f67afab306ced4e5fe98ffdbbc48646686235c6b40699af9bea15e07b29c

SHA512
281ee65a75d761747b394185b74ecf0df9a77e352c791cfdc4fb9f102d535b802516f8764747e5cd3b11fda81ec6f84ff497f4417584d2cc48ee6483f11d9b7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240203062405_001_vcRuntimeMinimum_x64.log

Filesize
1KB

MD5
c434e3a6d81177f78207fb13f0950869

SHA1
fa5788449cea07580ec0044124e535a2e211524f

SHA256
531abb710a1f433eac62cc07b36797e39de716b2b0095e7a9f49e1d02a80bb39

SHA512
e41d2087093e73ef784d919ba91b89ceb41cb8fc82e213504a6b375ec67d86e6b7f71d978c98ff18d69aed46481d82934c7f3dce899280fd48a0d78a4d3a3ca6

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240203062327_0_vcRuntimeAdditional_x86.log

Filesize
1KB

MD5
9f36dd1b6e800b08da2e34cd01a51009

SHA1
20b2afaf99aced0d3388775f2126bde335f35d4d

SHA256
9d0df7b4803d2f2e3f2b3153a2d3d5a7693c6dd864421dfdb4559bc8da47f4ba

SHA512
3df3ac9d58fd5b900d70d06f3dfded1e960848fe32e9d46d14975cc65ba48e04f18255a1d805ddc8d367c19afccde9af75bbc07b6c31ee57f894b0d65962775b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240203062327_1_vcRuntimeMinimum_x86.log

Filesize
1KB

MD5
310edc41d9decff1458251f631f7f353

SHA1
5d434ff39f6efacd0ff8ad1fc846a7f71b4973cb

SHA256
f6b7bdcd76f948f6a99d1d34cfa175a3246147ba6eb7bdae9ffdd0ebb0e56820

SHA512
6f351ab3f0dcc0904d1179716c36870b6d49a4664cc40025773d565210d2ca5d497affa60985d3ad080d0cf7d8910279268440bd64a5b251a92b906c29992f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240203062351_000_vcRuntimeAdditional_x86.log

Filesize
1KB

MD5
4e120a9e873d34c81467facc30126936

SHA1
cb935a280177260dc850b00dbefd7c476f8fe34d

SHA256
c790bf00e6f2b9ce193c758dee2a15bcad70e5a1df2ba48b57adda23ec369d94

SHA512
e6d142a1f5248c49352de5d7ee1c2e063c084818e9fd48041f361caa5ec6f380c77f73e149c269c942f066873bcf216ab8a276b60d48798c513270ce6418449a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240203062351_001_vcRuntimeMinimum_x86.log

Filesize
1KB

MD5
e15c9b0bc8353072b4e5f9d6e88e2b86

SHA1
2dd143238d4d32eb423c096a6e3332c0c77d408f

SHA256
95e843890d19991baaecb1fa8bc93cc140effb8c1470a4ea71bb82997a0433a9

SHA512
1361bdecb5994f61ba115abf8144c3c3608dca0cd622ece10b787dfb59b902fb49e6a5fe6d908ca32e80d99baffadc42f369c47a5f978989992184c2955746fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240203062401_000_vcRuntimeAdditional_x86.log

Filesize
1KB

MD5
48ba20b861f9cd5590582623775d69bf

SHA1
ebe39141c73dfd882c36044bfbc9a53b1b509cf5

SHA256
2c2d98b1d9e2373a2fca3121b94b69b5dcd4b576d07ba24331dfd6f327dff28d

SHA512
859aad429d80c28a18d1a5f24d97cdf60a8da9ccb399859a0f73026a0a1d3f8f140379b863e2025d0eb674f6cd06ee7e6b76c940ef94951e7a9e9b8873157118

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240203062401_001_vcRuntimeMinimum_x86.log

Filesize
1KB

MD5
19a04cd34629efbdaa73a5efc0622f1f

SHA1
2b685249f1c3f310673817e942a25610e812e41e

SHA256
a792deaaff654d91e8bc9bcd3ec68721db3f5a9a93803cf6ba785b1a2db15de2

SHA512
add2fa094754ad4b85ad4cfe5296846cde88a01ff65c11299a6991f82c74db0c98330ad0009e36be20519019c4b69f828fe8eb9be4e1c9046371ce6061065fa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\msi.txt

Filesize
246B

MD5
3309d5c3da730fcae9c7904f78842f1b

SHA1
ec2c0f39cab49805bdc12eec6ec561247df8125e

SHA256
30a391e58c990a092796dd0550793417f789d688f292dbaabde9e9c621f7572c

SHA512
058312e30f263b0a80f993d7edef59eb7f562d733b0ec37213307f088d56fcbc9eb68864e09ceb27bb75a28c8d76875d1afe73d712cde22d594a187b51b9b18d

Download Submit
C:\Users\Admin\AppData\Local\Temp\msi.txt

Filesize
222B

MD5
3202ae5dbae572888b398638c20b1b2d

SHA1
4ca3b72899993344bf6ede1ce058c452c1c98c4c

SHA256
cf6fe24fbe082db734d9621bfc020278bf33a1c566a91148cb2a2a43f759d60e

SHA512
6650f55ca78571db677b4a7cc9bb9ef021a035a0f1c24763b31f902b61a801ab7d19b49b7d6b8ee2daa5e5ea7c2346b015fe73e7fc220b18610759fe3468f270

Download Submit
C:\Users\Admin\AppData\Local\Temp\wix.txt

Filesize
492B

MD5
bc66f31fecd60ef1960dab28cebf95f7

SHA1
7e01f8d33a08288e4b5ca7b3a2da7ba78317d5f9

SHA256
9fe8569e638d78207063ee60211f6cfb7bbc3bc2c87448e11e0eb8baf4094a3f

SHA512
7ebbdb300500a99ea1b6cb7c68940bf2c66372af7bd4402bfee229bd27537ad75816bf10690c7818c7ed00702927731c4f56597cf4d37251bb182c0caf76d8ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\wix.txt

Filesize
738B

MD5
39be2d03301ce9c94fb217b1bd117c0b

SHA1
7e28ca09ab9cb687bba8ec0d3c0f2ac2b8cdabf6

SHA256
f31953e6c427fbe7669fa058651d5f248ef93e59a7859d5797865a54e44c9642

SHA512
fe70a9ecb8ed84ca2fa8cb9a5adc55fb718955ff68d4d9e52d52cc4ffe76fc9ea1aa06d6d35632a6ef9238c26653b0e4f7c9eb14a13f51c44cbbe588b36aed97

Download Submit
C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll

Filesize
126KB

MD5
d7bf29763354eda154aad637017b5483

SHA1
dfa7d296bfeecde738ef4708aaabfebec6bc1e48

SHA256
7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93

SHA512
1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\thm.wxl

Filesize
2KB

MD5
fbfcbc4dacc566a3c426f43ce10907b6

SHA1
63c45f9a771161740e100faf710f30eed017d723

SHA256
70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce

SHA512
063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\thm.xml

Filesize
5KB

MD5
0056f10a42638ea8b4befc614741ddd6

SHA1
61d488cfbea063e028a947cb1610ee372d873c9f

SHA256
6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87

SHA512
5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll

Filesize
117KB

MD5
a52e5220efb60813b31a82d101a97dcb

SHA1
56e16e4df0944cb07e73a01301886644f062d79b

SHA256
e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf

SHA512
d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e

Download Submit
C:\Windows\Installer\MSI626E.tmp

Filesize
83KB

MD5
08895ffbb06b9e35893a77b8d613bc53

SHA1
8826feda89dc5905d6c327aed3aa839a510b96be

SHA256
ff95ea08d4eb2a9879c839179b0a0bf223268afe84430f23582208c814ee19a1

SHA512
fe213b0050b9346b6c7a8583be988870e7442c64407fbbd98d952653e206037c108780dea9f0ea9c51346d021935231a774b040ecccaa6123869e6318517b1b9

Download Submit
C:\Windows\Installer\MSI6847.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSI7286.tmp

Filesize
80KB

MD5
393da89078925f78e19445882c37fc59

SHA1
1313f4e6c62670f1b10aaec77c105be275f50121

SHA256
bab5c035abecdb9e89b93dc5cc688b5c3e5c6aec4000e466595ee3ebb3342ca4

SHA512
aea5690cc1e6decedfb963c728b880ddcccc3d15b190943a890c38d41057d3511afff2e6298c6042ad2d862abb13e95992406511356bc58bad82754954f321c0

Download Submit
C:\Windows\Installer\MSI8CD5.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSI96C6.tmp

Filesize
93KB

MD5
186694813c3d5e33202a1a72c5079cc3

SHA1
90a9c2bf6419be6f46999e137c2149feca62cd13

SHA256
fb13d67c05d0e3c693701d782a55bc002ab62e972e4f018bd6b1717493bf1ae2

SHA512
57bf8ef4bdc08bcd7a83f82d14556710a2ef0cc7ef63366c48b144002a5f70cd58a130011cce648dcb3e9f62eafd6b188aa908b3b8f324448fb38567e499383b

Download Submit
C:\Windows\Installer\MSI9FC7.tmp

Filesize
165KB

MD5
6e800abfd934716540e62bc299e0af05

SHA1
25590192477503a9f66dcfb35226da1044944384

SHA256
9c28a752873a0dbf291c07013fdd066d5db17ecb6e6de70af8935fde83db62af

SHA512
ad87ec6cb4e2890aa6201b4c13f63ba9267b3b1161a6755f9d4284f63873059174e1a04e515e5ee677e00750dab1a35a46f5ba6f07b2d18b25835781aa58413f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
155KB

MD5
23fed6fa8bd4a6d7d10da1bd125183d5

SHA1
0d672f2376658d16f707c2f496e2ecfbfd21bb21

SHA256
af4dda3b434c26537ad92f987ec636a47904bbab3f51cec0d991e16b25119640

SHA512
1938d408935ecdca4694b8ba10dd7b59bbd7c605bcae3ac36535a213099874c16895d029222641f3706f623d0851c07b19fee78de13638ebb0e3b70b50c09f4c

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
146KB

MD5
3c2d01310b9f8030e57b289354b1af28

SHA1
ac39d3275fdbdc86e2ea77df22cd5911e16012c2

SHA256
60e674f93f3e7b530ecf785566c1c6a1d19128614f77996d9f0a9e341ffba4fd

SHA512
0dbcf15d54b1977277d2a66146195fb493ee462954e403e3552c66aa9afce6f504958290702d1e085d5d83c2534de50deb25111c3ca20fd4fdbe409736295eb3

Download Submit
C:\Windows\Temp\{E98C5426-08EB-4F0A-B4F4-7E0AF9C9EE59}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\assembly\tmp\10NDJ4M9\Microsoft.Office.Tools.v4.0.Framework.dll

Filesize
30KB

MD5
2e3d8c68eb196999f24dd2892e3928c7

SHA1
0cf00141cbc4c6dc3864bf64ffe00bea7cc53516

SHA256
d2bbca206a4c9adc3653d89de28cf5cbcb2f207f325b88400221172d374cb8aa

SHA512
431f991657467ba68a4090a78689df4b92edb1ab3d15a027f4b3778d78ccb1fb616aa73ab38af36efd09796bdc037ec02e58eda34d35b4dd448c1e33002ce801

Download Submit
C:\Windows\assembly\tmp\5BZNMMJM\Microsoft.VisualStudio.Tools.Applications.Hosting.dll

Filesize
204KB

MD5
9271c97ab5dfea2f07276294260eadb1

SHA1
af4a8f4263854f1d894e011f12c20f7ffb999be3

SHA256
83bc5de456cabea05e1ddad4891973acc71ee79bf2e0baa8959925b832482b07

SHA512
e1c5df44ad0195d51d1031fd0ae5aa80a21088390b70a3e88de7865731ba9606b3414ac500c8fb483ab8e7ba866c2b7e5b6ada27e3a346d54adf390ac3cdeb1f

Download Submit
C:\Windows\assembly\tmp\5LDP9PGD\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll

Filesize
38KB

MD5
7b3e31534368a47f43e8567c53436e87

SHA1
da240a98b20fc4fa50bf44132f1c8bf0b008c7b1

SHA256
35b314036d762404bee6d909e4688c995bf33bbc24a518e44756e6c176aae733

SHA512
cd7648c81d6a9e4205796824fa2271fb50c5f3c12fa1ba11868a1f8c0ffb7e7275d8940cb63157f28f09c8cc0ad33e9bba2d8a324aa5124fc570cc9bab118938

Download Submit
C:\Windows\assembly\tmp\72MV4QPK\Microsoft.Office.Tools.Outlook.dll

Filesize
58KB

MD5
c247453494d6d753406ee361552ff08d

SHA1
4092b6376b9f23980fd060b28e405710b22ff30b

SHA256
6c4ee23d9fae50259cfa5ddcd7d9df6bd11113652c6a0819d2048b221447ec83

SHA512
fde000aab02a6a18857e542012ca6f2f3042d788b3f4697449a25a9c67f69a35a388be24613dd8a38b63384c5c9507382c5487128edbe981cd527eae7e4d670b

Download Submit
C:\Windows\assembly\tmp\9MS53ZVW\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll

Filesize
155KB

MD5
d0d87fd4383b07586ad1f57053b9dd45

SHA1
02ba37b8917b23a466bd58285acebbdf0425bba5

SHA256
c5c266cd1021a1a893a832d465709fd49d6543bcec39dcc838ec1b336eef1ea6

SHA512
94dab03b23a26387f9673063da495d7efdc0a0e6b875b3e4762aa413a9fe6a67083e65509ecb24b4f23282973cdbf3f0882b53420a1d5349c7057c1b6737d676

Download Submit
C:\Windows\assembly\tmp\AU81LVWD\Microsoft.Office.Tools.Word.dll

Filesize
142KB

MD5
1c888498ab30ebe0970d6580b5b9de18

SHA1
d1bc9e79cbd7a95866b1ecb66b60f2346ae73f83

SHA256
3aec1befda3f7697a056e15bcb2e224e9d51c030226695f0395feca465199986

SHA512
80d3bd1e9caf896988ff05c22747269be63ee8808b6d22c0f4ff123979c1368e82d1a5ee54c584da50a0caf72a8970aa5da9297e68f77468001207372ea8cab9

Download Submit
C:\Windows\assembly\tmp\CLVBJ79O\Microsoft.VisualStudio.Tools.Office.Runtime.dll

Filesize
393KB

MD5
b226ce859695ab846a8a37e3fad3b994

SHA1
545afd72de08a91770b7ac330713d539fb224d0b

SHA256
46d6773708ba7a1a42ef2eed83fa0b217c2a1ce187cc399f8a8b4322a43186d0

SHA512
8464477ad8e1a8bb19e8d3843093c0243d397f8a78ea08908fa83f293f5556da0abbc478e7a251420d6c9251b25c615a7a3559b622e865c32ab7ff67acf4866d

Download Submit
C:\Windows\assembly\tmp\CP6TKTUT\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll

Filesize
64KB

MD5
e819c4efbd3768434d7017d3bbc685ae

SHA1
0a86d63669b44f4d682ea1571ce68a832463e1bc

SHA256
8ff73f6ce604af15467e7fd76f97fee522b369aee9a5d139935531c32dff3625

SHA512
14403892ff6b5f365e9bda591f47872546acce39adb57a743b2ec244187048966a92ef2a381ccc9497e2fb573208d9da63e51af43b16fd25352e94de04723b0a

Download Submit
C:\Windows\assembly\tmp\FEL5OYIF\Microsoft.Office.Tools.dll

Filesize
18KB

MD5
d9d8720e574ca2c4d73af18af5559c99

SHA1
65abe011c39187ff9e8c2029eaef9bf2195a62a1

SHA256
ff6eb35df52286db68204c8025edd1a363b9262df8f66992a7200d82be74d3c2

SHA512
233ebe6274031b625f0c631ed758600deb0cec51b12924c3c67cc516c1c0f8781607f72c5e5b5d2ce9e080a8586dc3964914d951d111ebaf4beb93b0cd0d5c11

Download Submit
C:\Windows\assembly\tmp\I2X79ULV\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll

Filesize
192KB

MD5
081cbb2b33b8707f1cc51d8d03205d5c

SHA1
42c1eb1008212cb3553a3aa3b0ad509e6257480b

SHA256
0c1743c01c049f73f6e948ea62332b9bba4333dff2db05ae59cf9e67cb046bdb

SHA512
81e576da0e72ffb3b787f0f7212fc28005e7673bbe5fb0e08145408b1c23fc95967f43642c6c4b9c899a9749ac3e2360dfce783d04ff29f9a84919f971e08bf5

Download Submit
C:\Windows\assembly\tmp\J1SM6I6C\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll

Filesize
27KB

MD5
56eeb5de31567dd9e5c0d72667d430d7

SHA1
889bb6086189d6c8f8b9ab66ba92bc98225a19ff

SHA256
87bedfd052846290e483d280d28d847c5301d89cbe7a9301296424d944e2f6b7

SHA512
be3dd48f40d8e73da642f93706975a4c15e7fdf417505dc1ab0f06e815740a8fcad2c318bc7cfe74f91158cfa86ec208775c7672b823ea003020ba7ad75ddef4

Download Submit
C:\Windows\assembly\tmp\JOQYFSWQ\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll

Filesize
360KB

MD5
53559db577b0b76f3d2b3e53f3e46baa

SHA1
90f369e6112e25d1bf9292683cd96439e7b355c2

SHA256
131a20dbb41bf7dd7ab584ca23b5dc31f83f5f3393d71fad0c9a50598ca74688

SHA512
04230a326eb7d369d300ae55e3edca982cf0aa21794c0ceb833ea164f490faeee488fb85257c33fe4260a6793bdde7648290de4d6ee991574ecd9961951559df

Download Submit
C:\Windows\assembly\tmp\JQURSWAQ\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Filesize
38KB

MD5
180fae4fbf3c08686ede2978c52c7578

SHA1
f01fd9bd577375a9cd19ebc682878f7ca16042bf

SHA256
6a9202e772b5f27eff0d1045f99c75945bf138b8b9d64b3a357a5890fefd9df4

SHA512
47e15c79fcb5b0ae2d8c3238a8c9213f2231754e8e033bac908fda027c65ead4333e8cb36313d57190298d6e0bb6021eccd385c29fe3cca33ae8d7a9ed43a708

Download Submit
C:\Windows\assembly\tmp\M8VX6VE0\Microsoft.VisualStudio.Tools.Office.ContainerControl.dll

Filesize
78KB

MD5
b96bd5ef4be841e3a6fe468f8d3af86c

SHA1
e00510df4c62c48eac6b58e00142e3a673b0d2e1

SHA256
d05ff6939d9b662258da791cb4f1bbd492bd0b4818fa20bc28d128e638e178c8

SHA512
0237cbef9a8af1a3de1bff7c38f2ae47efb88c8204cddc9ef2a64e060826fd8eaf9f75d62028676a66e42aa8becbb4803ae362f960d6b08c58e2bdd68d11cc4f

Download Submit
C:\Windows\assembly\tmp\OAPAMIEB\Microsoft.Office.Tools.Excel.dll

Filesize
171KB

MD5
92763b8c90df9130f2befa2fda4300a9

SHA1
49cc82031b910ee3d1d4d8db73accf2290bafd99

SHA256
462fec6b2b9124bde32d42864ca88a8fafcab25cf4785891f42c0f4b7f93b092

SHA512
5baa914ac314c3871581722cc17a3fb614c053fe2650b7795a80fe5f2759e74fd72ef1f948b8164b08ffd3b09d9411a15d479342bc4ece2c16b184448b5caa03

Download Submit
C:\Windows\assembly\tmp\QTUWJNPE\Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll

Filesize
200KB

MD5
c5ea27074636fa8603591a82c8adf9c6

SHA1
b5324b0d5822a4e7b7c55d13ad9bbc74b7c06b44

SHA256
71986f30c7c84267c378885c236a1d077353e5b3a8361ca062cf9f0b8ef4aae6

SHA512
c7b754e4c04ca2b7586aac2153e368094648698f475bdf55d19a8d392907227d24a9b58425e55d789ee47002f532f0726d3a3e80aae139a4bb0f09011f227a0d

Download Submit
C:\Windows\assembly\tmp\R7V25XGO\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll

Filesize
134KB

MD5
a8c894ba5ff23d432f9404360dffb95c

SHA1
fb4ac7311c34206a1f7f5893a99338f9c70435f5

SHA256
aad4335e9b9d01427b93984610ba280064dbe53d540eddf769a5595209465e25

SHA512
39acbee48d4907eb4aca643b9f1f7d3322ec3c3f8dbbfb066bba5d8a96d5891a2f70ee017fb4eb76b9a20b6861b1988f82143566912c1f0ae9c3f17876947f0c

Download Submit
C:\Windows\assembly\tmp\S24L7A0G\Microsoft.Office.Tools.Common.Implementation.dll

Filesize
354KB

MD5
ba1494f98486a2d81ab8c8397773e75f

SHA1
c3d63c34c4659862c39da0cbd8cae0796e7f5881

SHA256
bd1f1fd9b729f3d7b5538a0ce970999583c495996cc976a05243ea306fa15122

SHA512
f00a9fb668644be2563287a67c6259e2e59913c771891cda48908bc6afc5639ce3480afe1b0b63be4f5af6a1b9aac4d7a2203b9d13c9a57d0d531975d1e79a94

Download Submit
C:\Windows\assembly\tmp\SN1AUV0O\Microsoft.Office.Tools.Excel.Implementation.dll

Filesize
459KB

MD5
66fc0bb0e940871a6e6a91544a4e9245

SHA1
9e684859645e15a3df7dcbf4d3885daa92291387

SHA256
ae1ebaaa0833e24018f7f9979b0b998df14f4c774f24657a8b4d57f93b154bc5

SHA512
00719150c7da8a1f68c68126f91d7b8b9c8f851c03f86d37484d897db85739d4a51cc69435d6dcee9ba2fb5582d6dee45f6762a7a7924850eb5165749c3f0e64

Download Submit
C:\Windows\assembly\tmp\TEADMZA5\Microsoft.Office.Tools.Word.Implementation.dll

Filesize
337KB

MD5
b97883170674d936a1ce67e30c799917

SHA1
dd6b71efe3ad8f465e7bdacc736d9d5edba4a5a8

SHA256
a2e32987b35ef69c30fb77d6408f9e8832c5aa6191cdcff14584dace16be9de3

SHA512
154f03d99344400e27f21a4931eba85b8c981e04149c2b9c4e66405bedd94f12ba0e5c364f56d0e59712621415a5c2e77a2797cd3fc1cccc1d63019738c489d2

Download Submit
C:\Windows\assembly\tmp\UEO0N6N8\Microsoft.Office.Tools.Outlook.Implementation.dll

Filesize
140KB

MD5
e938cc784f563c9a6629ea77da50c771

SHA1
20ccb42c502a479399eb0d5595f73685c30c631a

SHA256
3ff0c6a6fe21d8b53f817898663edc1191e5f693147ff8cccf02546076690227

SHA512
a6a8fe0014b5ad1d20697d04a0f9a328061ac01b44e56cc3232d4a5a8b93a15c6ebbed7de847d944c9e8405ded341d806a60dce211aed02a403f563ed25cd934

Download Submit
C:\Windows\assembly\tmp\UK7UCBN6\Microsoft.Office.Tools.Common.dll

Filesize
93KB

MD5
1f6642901be2e8cb1781f42ea9221dd3

SHA1
ddeb8341afd5738e47c68167d025317e90bb5cb4

SHA256
c1ecfec1b7c5bb334311733f3f128d9458d1ec4c8fed084457e974b9dd86f97c

SHA512
cf00dd543c4e8d0309b5e273b96f959a8c227243eba941cadfd313ceeb8e89c2faaf6c93869b4ce170f6e4078886ef05a1aab0110c1ee312a446947c475fcdac

Download Submit
C:\Windows\assembly\tmp\UU0PS8Z6\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll

Filesize
65KB

MD5
4972166965a977047f5a15ebd2e26577

SHA1
df21db439aa28e7dfbd40abcab207b4ebb00bdbf

SHA256
0cbe8c184ae9bc3d778a0b8a71a47c6f4aeecade8a56bdae2c6c1a4b1c3679a1

SHA512
6eeef05f86b2ae117e228b5abf4f87a97cbc86e64cbff8e61bef1ab21515856b0d5510897bcae0684a339670fca81ac3e7bfecb15c6dca612d21e1e7957e751d

Download Submit
C:\Windows\assembly\tmp\WEPNX1C1\Microsoft.VisualStudio.Tools.Applications.Runtime.dll

Filesize
84KB

MD5
b0d9f341933c81fc09457c7a7dc892be

SHA1
155b6cc40a33c3bfa6a29e1b3047e22a70d7eceb

SHA256
02c599ef2a67374754cd6ecc7197bf751fbbefc56eee4a0e718ad906193fa6fa

SHA512
bc76a45739d02c9846a062feb0d5352f3e15398222198b5d3a40e3717a4cce7ade908d07a024ef0a9f2d998b310f656aa54ece3333ec91c3532b358179906aef

Download Submit
C:\Windows\assembly\tmp\YQC2XWBU\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll

Filesize
44KB

MD5
9aca167b44c968ffbb76c54300ed14bc

SHA1
e09cb1a38c774d8f779ec5749b168ca3e3448654

SHA256
e90286d537d4f1e92274c5f184cef8f234213c4b239a4e6a3e390815040ecac1

SHA512
8d1de5a945ce39d83ad097ee86b01fce11039dedc1c3741dae2b947d80770dfd4ad983baa23fcd5d328b94b909d7917bfdfcda9511f77a7f667534d89d251902

Download Submit
memory/1868-2694-0x000001D99A7B0000-0x000001D99A7D6000-memory.dmp

Filesize
152KB

Download
memory/1868-2730-0x000001D99A9C0000-0x000001D99A9D4000-memory.dmp

Filesize
80KB

Download
memory/1868-2916-0x000001D99A6F0000-0x000001D99A748000-memory.dmp

Filesize
352KB

Download
memory/1868-2923-0x000001D999440000-0x000001D999456000-memory.dmp

Filesize
88KB

Download
memory/1868-2929-0x000001D99A7F0000-0x000001D99A856000-memory.dmp

Filesize
408KB

Download
memory/1868-2936-0x000001D999470000-0x000001D999496000-memory.dmp

Filesize
152KB

Download
memory/1868-2902-0x000001D99A870000-0x000001D99A8E6000-memory.dmp

Filesize
472KB

Download
memory/1868-2896-0x000001D99A6F0000-0x000001D99A74C000-memory.dmp

Filesize
368KB

Download
memory/1868-2889-0x000001D999470000-0x000001D999498000-memory.dmp

Filesize
160KB

Download
memory/1868-2883-0x000001D999440000-0x000001D999452000-memory.dmp

Filesize
72KB

Download
memory/1868-2876-0x000001D999470000-0x000001D99949E000-memory.dmp

Filesize
184KB

Download
memory/1868-2869-0x000001D999440000-0x000001D99945C000-memory.dmp

Filesize
112KB

Download
memory/1868-2862-0x000001D998B80000-0x000001D998B88000-memory.dmp

Filesize
32KB

Download
memory/1868-2855-0x000001D998B80000-0x000001D998B8C000-memory.dmp

Filesize
48KB

Download
memory/1868-2631-0x000001D998B80000-0x000001D998B8A000-memory.dmp

Filesize
40KB

Download
memory/1868-2848-0x000001D999560000-0x000001D999594000-memory.dmp

Filesize
208KB

Download
memory/1868-2841-0x000001D999560000-0x000001D999596000-memory.dmp

Filesize
216KB

Download
memory/1868-2835-0x000001D999450000-0x000001D999468000-memory.dmp

Filesize
96KB

Download
memory/1868-2828-0x000001D999450000-0x000001D999464000-memory.dmp

Filesize
80KB

Download
memory/1868-2821-0x000001D999450000-0x000001D999464000-memory.dmp

Filesize
80KB

Download
memory/1868-2814-0x000001D998B80000-0x000001D998B8A000-memory.dmp

Filesize
40KB

Download
memory/1868-2807-0x000001D999470000-0x000001D999488000-memory.dmp

Filesize
96KB

Download
memory/1868-2801-0x000001D998B80000-0x000001D998B8E000-memory.dmp

Filesize
56KB

Download
memory/1868-2795-0x000001D999470000-0x000001D99948A000-memory.dmp

Filesize
104KB

Download
memory/1868-2788-0x000001D99AAD0000-0x000001D99AB2C000-memory.dmp

Filesize
368KB

Download
memory/1868-2781-0x000001D999560000-0x000001D999594000-memory.dmp

Filesize
208KB

Download
memory/1868-2774-0x000001D99AAD0000-0x000001D99AAFA000-memory.dmp

Filesize
168KB

Download
memory/1868-2767-0x000001D998B80000-0x000001D998B8A000-memory.dmp

Filesize
40KB

Download
memory/1868-2761-0x000001D9993E0000-0x000001D9993EE000-memory.dmp

Filesize
56KB

Download
memory/1868-2754-0x000001D9993E0000-0x000001D9993EE000-memory.dmp

Filesize
56KB

Download
memory/1868-2747-0x000001D9993E0000-0x000001D9993EE000-memory.dmp

Filesize
56KB

Download
memory/1868-2909-0x000001D999470000-0x000001D999496000-memory.dmp

Filesize
152KB

Download
memory/1868-2726-0x000001D99A910000-0x000001D99A924000-memory.dmp

Filesize
80KB

Download
memory/1868-2722-0x000001D999460000-0x000001D99946E000-memory.dmp

Filesize
56KB

Download
memory/1868-2718-0x000001D999450000-0x000001D99945E000-memory.dmp

Filesize
56KB

Download
memory/1868-2706-0x000001D99A990000-0x000001D99A9B8000-memory.dmp

Filesize
160KB

Download
memory/1868-2703-0x000001D99AA70000-0x000001D99AAC8000-memory.dmp

Filesize
352KB

Download
memory/1868-2700-0x000001D99A8D0000-0x000001D99A8EA000-memory.dmp

Filesize
104KB

Download
memory/1868-2697-0x000001D999440000-0x000001D99944C000-memory.dmp

Filesize
48KB

Download
memory/1868-2691-0x000001D99AA00000-0x000001D99AA66000-memory.dmp

Filesize
408KB

Download
memory/1868-2688-0x000001D99A930000-0x000001D99A98E000-memory.dmp

Filesize
376KB

Download
memory/1868-2685-0x000001D99A790000-0x000001D99A7A2000-memory.dmp

Filesize
72KB

Download
memory/1868-2682-0x000001D99A760000-0x000001D99A786000-memory.dmp

Filesize
152KB

Download
memory/1868-2679-0x000001D999420000-0x000001D99942E000-memory.dmp

Filesize
56KB

Download
memory/1868-2676-0x000001D99A730000-0x000001D99A75E000-memory.dmp

Filesize
184KB

Download
memory/1868-2673-0x000001D99A850000-0x000001D99A8C6000-memory.dmp

Filesize
472KB

Download
memory/1868-2670-0x000001D999730000-0x000001D999748000-memory.dmp

Filesize
96KB

Download
memory/1868-2667-0x000001D999400000-0x000001D999408000-memory.dmp

Filesize
32KB

Download
memory/1868-2664-0x000001D999700000-0x000001D999716000-memory.dmp

Filesize
88KB

Download
memory/1868-2661-0x000001D9996E0000-0x000001D9996FC000-memory.dmp

Filesize
112KB

Download
memory/1868-2658-0x000001D99A7F0000-0x000001D99A84C000-memory.dmp

Filesize
368KB

Download
memory/1868-2655-0x000001D99A6F0000-0x000001D99A724000-memory.dmp

Filesize
208KB

Download
memory/1868-2652-0x000001D9995B0000-0x000001D9995C8000-memory.dmp

Filesize
96KB

Download
memory/1868-2649-0x000001D99A5B0000-0x000001D99A5E6000-memory.dmp

Filesize
216KB

Download
memory/1868-2645-0x000001D9993E0000-0x000001D9993EE000-memory.dmp

Filesize
56KB

Download
memory/1868-2642-0x000001D999470000-0x000001D99949A000-memory.dmp

Filesize
168KB

Download
memory/1868-2638-0x000001D998B90000-0x000001D998B9A000-memory.dmp

Filesize
40KB

Download
memory/1868-2635-0x000001D999560000-0x000001D999594000-memory.dmp

Filesize
208KB

Download
memory/4060-3133-0x0000000001140000-0x000000000116C000-memory.dmp

Filesize
176KB

Download
memory/4060-3134-0x0000000001120000-0x000000000112E000-memory.dmp

Filesize
56KB

Download
memory/4060-3135-0x00007FFD4FED0000-0x00007FFD50871000-memory.dmp

Filesize
9.6MB

Download
memory/4060-3136-0x00000000013A0000-0x00000000013B0000-memory.dmp

Filesize
64KB

Download
memory/4060-3137-0x00007FFD4FED0000-0x00007FFD50871000-memory.dmp

Filesize
9.6MB

Download
memory/4060-3138-0x0000000001310000-0x000000000131A000-memory.dmp

Filesize
40KB

Download