Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
26/04/2026, 17:46
General
- Target 2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe
- Size 30.1MB
- Sample260426-wcdldahs9j
- SHA256 b20c17984697a0d3f43b2f015c3f5cca82005cd36692fbbc5c8c779a8bdababa
Score
10/10
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 64 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 6 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 64 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /c:" 5."3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver3⤵
-
-
C:\Windows\system32\reg.exereg.exe query "HKU\S-1-5-19"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\find.exefind /i "ComputerSystem"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v productname4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex4⤵
-
-
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled3⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled3⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.40219.4733⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.61135.4003⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.40664.03⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 50.35719.03⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.50727.6229"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.50727.6229"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.30729.7523"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.30729.7523"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F03⤵
-
-
C:\Windows\system32\find.exefind /i "VC_RED_enu_"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "VC_RED_enu_"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{773AD50D-AAE6-4BA1-AD01-B5A38874C840} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"3⤵
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{F6C59FC1-374D-4069-BB1B-3ACD14390382} {A866FBE0-6DD5-4BB5-8E14-A0E9F789595C} 25444⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f3⤵
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{56FBAF80-D092-4D9C-AACC-CA1A52A1D3E5} {58467373-28FF-4AAB-A57E-09E29CC1B9DE} 26604⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{6FEE322D-CEAA-4067-8C8D-9A080CFB1311} {5E685814-9DB2-42CB-B2F8-8A7E38C6FE5D} 48604⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f3⤵
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{4BD4853C-575E-445C-911D-4ACA61E7AC27} {2AC555EB-8F11-4522-8DFF-34EF0609E8B1} 34484⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f3⤵
-
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=624 -burn.filehandle.self=644 /uninstall /passive /norestart4⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{ED7BB34F-FD4A-4E45-9E54-B0DED997B54E} {1A12B4D5-6F2E-47EB-BA27-DAA8FD9859E2} 56805⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=624 -burn.filehandle.self=644 /uninstall /passive /norestart4⤵
- Loads dropped DLL
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString3⤵
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString3⤵
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9} /passive /norestart3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /f3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /passive /norestart3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.60917.03⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{610487D9-3460-328A-9333-219D43A75CC5} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\9D7840160643A823393312D9347AC55C3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "TRIN_TRIR_SETUP"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Studio 2010 Tools for Office Runtime *Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"3⤵
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.40219.4733⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp140.dll"3⤵
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp140.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 50.35719.03⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.50727.6229"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.50727.6229"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.30729.7523"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.30729.7523"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "VC_RED_enu_"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F3⤵
-
-
C:\Windows\system32\find.exefind /i "VC_RED_enu_"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53CF6934-A98D-3D84-9146-FC4EDF3D5641} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010792BA-551A-3AC0-A7EF-0FAB4156C382} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{61B44572-8722-4DAF-8ACF-8E742D30BCC5} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{6DB765A8-05AF-49A1-A71D-6F645EE3CE41} /passive /norestart3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41} /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{662A0088-6FCD-45DD-9EA7-68674058AED5} /passive /norestart3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5} /f3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" /qb3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeMinimum_x86.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeAdditional_x86.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\vstor40_x64.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D391-45A6-A8FB-00B01E2B010D} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /passive /norestart3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{C5E3A69D-D393-45A6-A8FB-00B01E2B010D} /passive /norestart3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vbcrun.msi" /qb3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding F81904102647467CF788037ABF09C20A2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding DDF8DCA13DDECCCE8D9847F7B1B95E562⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0856A927A786C2DE430D2A2D5D57CFF22⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C6AE0DE0C4EE5823E84A08DBA1EC28272⤵
- System Location Discovery: System Language Discovery
-
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding 643FB718CD9F7C0933D25BB03523DCFB2⤵
-
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding 7C3A4220111C6B3A2DA431FD2822F0432⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FB8676B23CC00BBAD4D392920674AF042⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8EFE95E2F6C580365802F0BF78E571C62⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4C5C97E35F13D775E84C05C9E92A3A772⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D6337F29E477AFE94D39F1F81AF3B33F2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 07ED3F07E7633CC2C54C216D3395634B2⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding E76FCC47191CD94D0E4D50625DB139662⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A9BE1F534B42EBDF0AE9AF6989CA8634 M Global\MSI00002⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding B49E7866318B44D5149994E03F6AD67B E Global\MSI00002⤵
-
C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe"C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild3⤵
- Drops file in Program Files directory
-
-
C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe"C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BAF9213A5E92E4EF35BF6F66FBE77D36 E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue3⤵
- Drops file in Windows directory
-
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221849.log" /uninstall /passive /norestart ignored /burn.runonce1⤵
- Loads dropped DLL
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221849.log /uninstall /passive /norestart ignored2⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221849.log /uninstall /passive /norestart ignored -burn.unelevated BurnPipe.{3A010CD7-83DB-4E59-9EEE-7C092DD56BAA} {D04F3B35-2F13-438A-9B4D-8D89947525A1} 15763⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce1⤵
- Loads dropped DLL
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260426221852.log"2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260426221852.log" -burn.unelevated BurnPipe.{96C95D22-99C1-410A-AB8A-2E31B7763CC0} {106E93C5-D5D8-4457-BBF5-B2D871EB2431} 60083⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce1⤵
- Executes dropped EXE
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260426221858.log"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260426221858.log"3⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2AppInit DLLs
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2AppInit DLLs
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e58a258.rbs
e58a26b.rbs
e58a272.rbs
e58a283.rbs
e58a288.rbs
e58a299.rbs
e58a2a1.rbs
e58a2b2.rbs
e58a2b9.rbs
e58a2bd.rbs
e58a2e1.rbf
e58a2e8.rbs
e58a2ec.rbs
e58a318.rbs
e58a31d.rbs
e58a322.rbs
e58a329.rbs
e58a32e.rbs
e58a333.rbs
e58a338.rbs
e58a33f.rbs
e58a34b.rbs
e58a352.rbs
e58a361.rbs
e58a366.rbs
e58a36b.rbs
e58a370.rbs
e58a376.rbs
e58a379.rbs
e58a37d.rbs
e58a385.rbs
e58a38a.rbs
e58a395.rbs
e58a39a.rbs
e58a39b.rbf
e58a39c.rbf
e58a39d.rbf
e58a39e.rbf
e58a39f.rbf
e58a3a0.rbf
e58a3a1.rbf
e58a3a2.rbf
e58a3a3.rbf
e58a3a4.rbf
e58a3a5.rbf
e58a3a6.rbf
e58a3a7.rbf
e58a3a8.rbf
e58a3a9.rbf
e58a3aa.rbf
e58a3ab.rbf
e58a3ac.rbf
e58a3ad.rbf
e58a3ae.rbf
e58a3af.rbf
e58a3b0.rbf
e58a3b1.rbf
e58a3b2.rbf
e58a3b3.rbf
e58a3b4.rbf
e58a3b5.rbf
e58a3b6.rbf
e58a3b7.rbf
e58a3b8.rbf
e58a3b9.rbf
e58a3ba.rbf
e58a3bb.rbf
e58a3bc.rbf
e58a3bd.rbf
e58a3be.rbf
e58a3bf.rbf
e58a3c0.rbf
e58a3c1.rbf
e58a3c2.rbf
e58a3c3.rbf
e58a3c4.rbf
e58a3c5.rbf
e58a3c6.rbf
e58a3c7.rbf
e58a3c8.rbf
e58a3c9.rbf
e58a3e8.rbs
symsrv.dll
symsrv.dll.000
vcredist_x86.exe.tmp
vcredist_x86.exe.tmp
vcredist_x64.exe.tmp
vc_red.msi
Installer.cmd
filever.vbs
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
ucrtbase.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
ucrtbase.dll
vcrun.msi
Microsoft.Office.Tools.v9.0.dll
Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll
Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
Microsoft.Office.Tools.Common.v9.0.dll
Microsoft.Office.Tools.Excel.v9.0.dll
Microsoft.Office.Tools.Outlook.v9.0.dll
Microsoft.Office.Tools.Word.v9.0.dll
Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll
Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll
Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll
dd_vcredist_amd64_20260426221849.log
dd_vcredist_amd64_20260426221849_0_vcRuntimeAdditional_x64.log
dd_vcredist_amd64_20260426221849_1_vcRuntimeMinimum_x64.log
dd_vcredist_amd64_20260426221855_000_vcRuntimeAdditional_x64.log
dd_vcredist_amd64_20260426221855_001_vcRuntimeMinimum_x64.log
dd_vcredist_x86_20260426221852.log
dd_vcredist_x86_20260426221852_000_vcRuntimeAdditional_x86.log
dd_vcredist_x86_20260426221852_001_vcRuntimeMinimum_x86.log
dd_vcredist_x86_20260426221858.log
dd_vcredist_x86_20260426221858_000_vcRuntimeAdditional_x86.log
dd_vcredist_x86_20260426221858_001_vcRuntimeMinimum_x86.log
msi.txt
msi.txt
msi.txt
wix.txt
wix.txt
logo.png
wixstdba.dll
wixstdba.dll.tmp
wixstdba.dll
wixstdba.dll.tmp
license.rtf
thm.wxl
thm.xml
license.rtf
wixstdba.dll.tmp
MSI944.tmp
MSIC26D.tmp
MSID4AB.tmp
MSIE21C.tmp
MSIE7E3.tmp
MSIFEB7.tmp
ngen.log
ngen.log
wixstdba.dll
license.rtf
thm.xml
Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll
Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll
Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Hosting.dll
Microsoft.Office.Tools.Excel.Implementation.dll
Microsoft.Office.Tools.v4.0.Framework.dll
Microsoft.Office.Tools.Outlook.dll
Microsoft.Office.Tools.Word.Implementation.dll
Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll
Microsoft.Office.Tools.dll
Microsoft.Office.Tools.Word.dll
Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll
Microsoft.VisualStudio.Tools.Office.ContainerControl.dll
Microsoft.VisualStudio.Tools.Office.Runtime.dll
Microsoft.Office.Tools.Common.Implementation.dll
Microsoft.VisualStudio.Tools.Applications.Runtime.dll
Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll
Microsoft.Office.Tools.Common.dll
Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll
Microsoft.Office.Tools.Excel.dll
Microsoft.Office.Tools.Outlook.Implementation.dll
memory/216-1580-0x000002035D920000-0x000002035DA35000-memory.dmp
memory/216-1581-0x000002035BDB0000-0x000002035BDBC000-memory.dmp
memory/380-1967-0x0000000010000000-0x0000000010030000-memory.dmp
memory/380-2110-0x0000000000F20000-0x0000000000FB6000-memory.dmp
memory/380-2105-0x0000000000D10000-0x0000000000D75000-memory.dmp
memory/380-2112-0x0000000010000000-0x0000000010030000-memory.dmp
memory/380-1780-0x0000000010000000-0x0000000010030000-memory.dmp
memory/936-1584-0x0000020EDC370000-0x0000020EDC485000-memory.dmp
memory/936-1585-0x0000020EDC490000-0x0000020EDC49C000-memory.dmp
memory/1032-2356-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1032-2351-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1220-1751-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1220-1827-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1220-1825-0x0000000001370000-0x0000000001406000-memory.dmp
memory/1220-1824-0x0000000000D10000-0x0000000000D75000-memory.dmp
memory/1232-2120-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1232-2060-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1232-2119-0x0000000001570000-0x0000000001606000-memory.dmp
memory/1300-1773-0x0000000000EA0000-0x0000000000F36000-memory.dmp
memory/1300-1776-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1300-1772-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1576-1976-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1576-1972-0x00000000007D0000-0x000000000082E000-memory.dmp
memory/1576-1974-0x00000000013B0000-0x0000000001446000-memory.dmp
memory/1576-1834-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1576-1710-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1592-2363-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1592-2368-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1616-2379-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1616-2435-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1652-1586-0x00000268E9DF0000-0x00000268E9F05000-memory.dmp
memory/1652-1587-0x00000268E82E0000-0x00000268E82EC000-memory.dmp
memory/1716-2499-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1716-2532-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1944-2736-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1944-2788-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1960-2055-0x0000000000B90000-0x0000000000C07000-memory.dmp
memory/1960-2056-0x0000000001090000-0x0000000001126000-memory.dmp
memory/1960-2058-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1960-1901-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2000-1705-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2000-1706-0x0000000001130000-0x00000000011C6000-memory.dmp
memory/2000-1709-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2196-1664-0x0000000000A60000-0x0000000000AF6000-memory.dmp
memory/2196-1667-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2196-1673-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2196-1626-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2196-1663-0x00000000008F0000-0x000000000094E000-memory.dmp
memory/2196-1670-0x00000000008F0000-0x000000000094E000-memory.dmp
memory/2196-1671-0x0000000000A60000-0x0000000000AF6000-memory.dmp
memory/2196-1666-0x0000000073240000-0x0000000073264000-memory.dmp
memory/2320-2381-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2320-2372-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2532-1712-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2532-1970-0x0000000000870000-0x0000000000906000-memory.dmp
memory/2532-1973-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2532-1836-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2532-1969-0x00000000007D0000-0x000000000082E000-memory.dmp
memory/2544-1677-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2544-1659-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2544-1660-0x00000000008F0000-0x000000000094E000-memory.dmp
memory/2544-1624-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2544-1661-0x0000000000A50000-0x0000000000AE6000-memory.dmp
memory/2544-1674-0x00000000008F0000-0x000000000094E000-memory.dmp
memory/2544-1675-0x0000000000A50000-0x0000000000AE6000-memory.dmp
memory/2600-2243-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2600-2248-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2660-1679-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2660-1745-0x00000000012A0000-0x0000000001336000-memory.dmp
memory/2660-1744-0x00000000007D0000-0x000000000082E000-memory.dmp
memory/2660-1747-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2872-2240-0x0000013A7AB10000-0x0000013A7AC25000-memory.dmp
memory/3076-2648-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3076-2617-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3292-2160-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3292-2158-0x0000000001450000-0x00000000014E6000-memory.dmp
memory/3292-2123-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3448-1897-0x0000000000920000-0x00000000009B6000-memory.dmp
memory/3448-1833-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3448-1896-0x0000000000120000-0x0000000000185000-memory.dmp
memory/3448-1899-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3796-2373-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3796-2438-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3796-2425-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4112-2690-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4112-2730-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4256-2161-0x0000015E66320000-0x0000015E66435000-memory.dmp
memory/4404-1982-0x0000000000E10000-0x0000000000EA6000-memory.dmp
memory/4404-1981-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4404-1984-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4524-1743-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4524-1683-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4524-1740-0x00000000007D0000-0x000000000082E000-memory.dmp
memory/4524-1741-0x0000000000930000-0x00000000009C6000-memory.dmp
memory/4528-2534-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4528-2555-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4588-2652-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4588-2688-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4840-1988-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4840-2196-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4840-2164-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4840-2194-0x0000000000B90000-0x0000000000C07000-memory.dmp
memory/4840-2195-0x0000000001170000-0x0000000001206000-memory.dmp
memory/4860-1829-0x0000000001730000-0x00000000017C6000-memory.dmp
memory/4860-1831-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4860-1828-0x0000000000D10000-0x0000000000D75000-memory.dmp
memory/4860-1749-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4952-2045-0x0000000000B90000-0x0000000000C07000-memory.dmp
memory/4952-2048-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4952-1949-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4952-2046-0x0000000000AA0000-0x0000000000B36000-memory.dmp
memory/4972-2118-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4972-2116-0x0000000000C40000-0x0000000000CD6000-memory.dmp
memory/4972-2062-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5212-2198-0x00000000007D0000-0x0000000000866000-memory.dmp
memory/5212-2200-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5212-2197-0x0000000000B90000-0x0000000000C07000-memory.dmp
memory/5212-2145-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5212-1986-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5408-2230-0x0000020003800000-0x0000020003915000-memory.dmp
memory/5620-1583-0x000001CA41520000-0x000001CA4152C000-memory.dmp
memory/5620-1582-0x000001CA3F7F0000-0x000001CA3F905000-memory.dmp
memory/5644-2615-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5644-2593-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5680-1903-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5680-2051-0x0000000000B90000-0x0000000000C07000-memory.dmp
memory/5680-2054-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5680-2052-0x00000000009D0000-0x0000000000A66000-memory.dmp
memory/5752-1601-0x00000000769B0000-0x0000000076A13000-memory.dmp
memory/5752-14-0x00000000769B0000-0x0000000076A13000-memory.dmp
memory/5752-357-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5752-12-0x00000000769C5000-0x00000000769C6000-memory.dmp
memory/5752-689-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5752-1682-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5752-692-0x00000000769B0000-0x0000000076A13000-memory.dmp
memory/5752-688-0x00000000005E0000-0x0000000000676000-memory.dmp
memory/5752-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5752-1643-0x00000000769B0000-0x0000000076A13000-memory.dmp
memory/5752-1646-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5780-1895-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5780-1837-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5780-1893-0x0000000000AC0000-0x0000000000B56000-memory.dmp
memory/5780-1892-0x0000000000120000-0x0000000000185000-memory.dmp
memory/5796-2440-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5796-2497-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5836-2225-0x0000000000400000-0x0000000000496000-memory.dmp
memory/5836-2165-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5836-2227-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5928-2732-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5928-2791-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5948-2591-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5948-2557-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6008-2107-0x0000000001080000-0x0000000001116000-memory.dmp
memory/6008-1777-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6008-1948-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6008-2109-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6008-2106-0x0000000000D10000-0x0000000000D75000-memory.dmp
memory/6132-2236-0x0000000000760000-0x00000000007F6000-memory.dmp
memory/6132-2233-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6132-2238-0x0000000010000000-0x0000000010030000-memory.dmp