floxif | b20c17984697a0d3f43b2f015c3f5cca82005cd36692fbbc5c8c779a8bdababa

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe
Size 30.1MB
Sample260426-wcdldahs9j
SHA256 b20c17984697a0d3f43b2f015c3f5cca82005cd36692fbbc5c8c779a8bdababa
MD5 8c9cf32bbb143f4d82e24158b0271d14
SHA1 38a424ee14e3d7817b45cdff994fe415e93b1d34
SHA512 7decff20b3b219ff79aca691915b09de8aa268687711f8d7dae864c0a762e4a81a2f9437ecee8f006b73565481a394499617b435932a509189b2bb4bd660d09d
SSDEEP 786432:pJVdGL3z5NXeyQIwJtNYUJwif0nOJa9WEWRIOG5B7DVGLhYNBFv3cnZC9:HjOLXelIMjJwi0wMVW6n7ShYWC9
TLSH
T1C96733B51818C5ACE7E0B1F0080BF5A176DAF9BCE9C5CC46B1F4BC99919E4618FE612C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery floxif persistence privilege_escalation ransomware spyware trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x002400000002b129-1.dat	floxif

UPX dump on OEP (original entry point) 8 IoCs

resource	yara_rule
behavioral2/files/0x002400000002b129-1.dat	UPX
behavioral2/memory/4832-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4832-635-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4832-632-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4832-1627-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4832-1666-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4832-2077-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4832-4147-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x002400000002b129-1.dat	acprotect

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 64 IoCs

pid	Process
4832	2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe
3752	vcredist_x86.exe
4796	vcredist_x64.exe
2708	vcredist_x86.exe
4652	vcredist_x64.exe
4532	VC_redist.x86.exe
1692	VC_redist.x64.exe
728	MsiExec.exe
728	MsiExec.exe
728	MsiExec.exe
728	MsiExec.exe
728	MsiExec.exe
728	MsiExec.exe
728	MsiExec.exe
728	MsiExec.exe
656	vcredist_x64.exe
728	MsiExec.exe
728	MsiExec.exe
728	MsiExec.exe
728	MsiExec.exe
728	MsiExec.exe
3160	MsiExec.exe
3160	MsiExec.exe
3160	MsiExec.exe
3160	MsiExec.exe
3160	MsiExec.exe
3160	MsiExec.exe
3160	MsiExec.exe
3160	MsiExec.exe
3160	MsiExec.exe
3160	MsiExec.exe
3160	MsiExec.exe
3160	MsiExec.exe
3160	MsiExec.exe
4480	vcredist_x86.exe
1424	MsiExec.exe
3104	MsiExec.exe
2484	MsiExec.exe
3304	MsiExec.exe
4860	vcredist_x64.exe
1480	MsiExec.exe
1480	MsiExec.exe
1480	MsiExec.exe
1480	MsiExec.exe
1480	MsiExec.exe
1480	MsiExec.exe
1480	MsiExec.exe
1480	MsiExec.exe
1480	MsiExec.exe
1480	MsiExec.exe
1480	MsiExec.exe
1480	MsiExec.exe
1480	MsiExec.exe
4808	MsiExec.exe
4808	MsiExec.exe
4808	MsiExec.exe
4808	MsiExec.exe
4808	MsiExec.exe
4808	MsiExec.exe
4808	MsiExec.exe
2592	VC_redist.x64.exe
4808	MsiExec.exe
4808	MsiExec.exe
4832	2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20260426221911.log\" /uninstall /passive /norestart ignored /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20260426221911.log\" /uninstall /passive /norestart ignored ignored /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msvcr71.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr100.dll	msiexec.exe
File created	C:\Windows\system32\mfc100kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msflxgrd.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\msmask32.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\tabctl32.ocx	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msstkprp.dll	msiexec.exe
File created	C:\Windows\system32\mfc110cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcr70.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc100jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\atl100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc71u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msbind.dll	msiexec.exe
File created	C:\Windows\SysWOW64\picclp32.ocx	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120.dll	msiexec.exe
File created	C:\Windows\system32\mfcm100u.dll	msiexec.exe
File created	C:\Windows\system32\mfc110deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc110esn.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\richtx32.ocx	msiexec.exe
File created	C:\Windows\system32\mfcm120u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sysinfo.ocx	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110deu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc71chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\vcomp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\comctl32.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\dblist32.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\msmapi32.ocx	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110chs.dll	msiexec.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x002400000002b129-1.dat	upx
behavioral2/memory/4832-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4832-635-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4832-632-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4832-1627-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4832-1666-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4832-2077-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4832-4147-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp	2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\DESIGNER\mswcrun.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll	2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\ActionsPane3.xsd	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\DESIGNER\mshtmpgr.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\PipelineSegments.store	addinutil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\VSTOFiles.cat	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI80B9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD0B9F234D38EC0CD.TMP	msiexec.exe
File created	C:\Windows\Installer\e588879.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI85FB.tmp	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\I60V2WK98I\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSIB929.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF08CB82C8EBB99133.TMP	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260426221936328.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260426221936375.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260426221939516.1\amd64_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_b0616a48.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260426222002016.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260426222002063.1\8.0.50727.6229.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260426222002016.0	msiexec.exe
File created	C:\Windows\assembly\tmp\W9V3O5OD\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\YMDESTNK\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\ARRDMBH3KQ\Microsoft.Office.Tools.Excel.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSIAF74.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF84.tmp	msiexec.exe
File created	C:\Windows\Installer\e58886f.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260426222005657.0\msvcr90.dll	msiexec.exe
File created	C:\Windows\Installer\SourceHash{610487D9-3460-328A-9333-219D43A75CC5}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\MSIB1C9.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100ita_x64	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260426221939547.1	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260426222005657.2\mfc90cht.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260426222005688.0\9.0.30729.7523.policy	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_msvcr100_x64	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260426221939500.1\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_942a41ec.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260426221939516.0\mfc90esn.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\e588870.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260426222005672.1\9.0.30729.7523.policy	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE0033F8A76E2AE4A.TMP	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\WMITH9FM99\Microsoft.Office.Tools.Word.Implementation.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\SystemTemp\~DF6E80A5EC245FD73E.TMP	msiexec.exe
File created	C:\Windows\Installer\e588870.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260426222002079.0\8.0.50727.6229.policy	msiexec.exe
File created	C:\Windows\SystemTemp\~DF197F7064D7B5CA81.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF23465C0DE8B87191.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\SystemTemp\~DFE53817BE9F5959B6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9F2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF13.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC577.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB8628A3C8C83D6CB.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF64A7F01B9FCB60C1.TMP	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\MSIC146.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1A6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC8CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e588861.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260426222001969.1\msvcp80.dll	msiexec.exe
File created	C:\Windows\SystemTemp\~DF342697D5F5678F47.TMP	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000adcdd9a6d08c0ad30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000adcdd9a60000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900adcdd9a6000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aadcdd9a6000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dadcdd9a6000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E8F8E80F-02EB-44CC-ABB5-6E5132BA6B24}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}\AlternateCLSID = "{0B314611-2C19-4AB4-8513-A6EEA569D3C4}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{648A5600-2C6E-101B-82B6-000000000014}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BFCA30D5-DDE3-11D1-B6D9-0000F87557F8}\AlternateCLSID = "{1E9B270D-5829-490E-84F5-1C25D74BF01D}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\AlternateCLSID = "{79C784C5-8F0D-4A55-ADB3-590CCFC8EB0D}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3A2B370C-BA0A-11D1-B137-0000F8753F5D}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F91CAF91-225B-43A7-BB9E-472F991FC402}\AlternateCLSID = "{556C2772-F1AD-4DE1-8456-BD6E8F66113B}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1E216240-1B7D-11CF-9D53-00AA003C9CB6}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6B7E638F-850A-101B-AFC0-4210102A8DA7}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{21D93913-CB0F-11D0-84AC-00A0C90DC8A9}\AlternateCLSID = "{018BCA43-2122-4211-9589-458B6A6E2A63}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9ED94440-E5E8-101B-B9B5-444553540000}\AlternateCLSID = "{44E266A2-CD46-47A0-9ED5-EEEC5F0C2A6E}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9012A7B8-F56E-11D0-8043-00C04FB6C701}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{642AC766-AAB4-11D0-8494-00A0C90DC8A9}\AlternateCLSID = "{A7F31C6B-5300-47C8-A642-5AC673794C92}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{43478D73-78E0-11CF-8E78-00A0D100038E}\AlternateCLSID = "{6785E9BB-087E-4772-8CA5-3331CC3B574E}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E35A5B50-1B6B-4C46-A323-42214F91F48B}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6FBA474B-43AC-11CE-9A0E-00AA0062BB4C}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{59245250-7A2F-11D0-9482-00A0C91110ED}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20C62CAB-15DA-101B-B9A8-444553540000}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F21C-CCB0-11D0-A316-00AA00688B10}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C932BA85-4374-101B-A56C-00AA003668DC}\AlternateCLSID = "{A57635FC-8D02-4D32-8B6E-4FBD4E2DB8A7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{026371C0-1B7C-11CF-9D53-00AA003C9CB6}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1906F94F-8256-480A-8CDF-60821592CB4B}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BFCA30D5-DDE3-11D1-B6D9-0000F87557F8}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1906F94F-8256-480A-8CDF-60821592CB4B}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{27395F85-0C0C-101B-A3C9-08002B2F49FB}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6FBA474B-43AC-11CE-9A0E-00AA0062BB4C}\AlternateCLSID = "{D88A442E-9C85-48E3-A6F8-EF61C93989A0}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{00028C00-0000-0000-0000-000000000046}\AlternateCLSID = "{36D792B3-CEA5-454E-A7EF-5B045E60EDEF}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F219-CCB0-11D0-A316-00AA00688B10}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\AlternateCLSID = "{DD2DBE12-F9F8-4E32-B087-DAD1DCEF0783}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9012A7B8-F56E-11D0-8043-00C04FB6C701}\AlternateCLSID = "{CB2C5FC2-C7ED-4CC1-AF07-5C5485DAB3B1}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\AlternateCLSID = "{3D8152C1-0CFD-4968-9684-794046886E31}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{27395F85-0C0C-101B-A3C9-08002B2F49FB}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\AlternateCLSID = "{CEDFFAFD-3C2F-4552-9FD3-3DC4299057FD}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{232E456A-87C3-11D1-8BE3-0000F8754DA1}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F21C-CCB0-11D0-A316-00AA00688B10}\AlternateCLSID = "{D3CCB2F7-0D00-4F26-9569-D7C368DE34E2}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FE38753A-44A3-11D1-B5B7-0000C09000C4}\AlternateCLSID = "{CFA7636D-CAA1-4F18-868F-8720624C8B86}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{601EB760-8909-11D0-9483-00A0C91110ED}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3A2B370C-BA0A-11D1-B137-0000F8753F5D}\AlternateCLSID = "{62B025F5-F551-44A9-8BA8-0118EFB9127C}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F91CAF91-225B-43A7-BB9E-472F991FC402}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E8F8E80F-02EB-44CC-ABB5-6E5132BA6B24}\AlternateCLSID = "{962F28D6-107D-47A5-9515-2864454CFDD1}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3A08E130-8F65-11D0-9484-00A0C91110ED}\AlternateCLSID = "{D7FFEFBC-C693-4E6F-AE2E-ED001389CB17}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F6DB041E-66D0-48BC-8797-57C24F5C801C}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAB97084-FC6C-11D0-805D-00C04FB6C701}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20C62CA0-15DA-101B-B9A8-444553540000}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3A08E130-8F65-11D0-9484-00A0C91110ED}\Compatibility Flags = "1024"	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\43	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\48	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\42	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\43	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\42	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\48	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\44	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\47	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\40	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\44	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\39	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\41	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\38	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\46	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\41	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\45	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\40	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\49	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\37	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C05586832351A613E9FF58906A9EF297	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{83081C08-382C-4ED4-ACCF-DCBECA021010}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{274C2936-A842-45f3-A457-FB4BA4ED1BA2}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dbadapt.DataAdapter\ = "DataAdapter Object"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D624E3E0-720A-11CF-8136-00AA00C14959}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\MiscStatus\1\ = "165265"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6B7F1602-D44C-11D0-A7D9-AE3D17000000}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSHierarchicalFlexGridLib.MSHFlexGrid.6\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Common Files\|Microsoft Shared\|VSTA\|Pipeline.v10.0\|HostSideAdapters\|Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D606EEC9-8368-4F10-88DB-BF5563EC36F6}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB36A921-805A-11CF-91F7-C2863C385E30}\InprocServer32\ = "C:\\Windows\\SysWOW64\\mshflxgd.ocx"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE7-47EB-101B-A3C9-08002B2F49FB}\ = "Common Dialog Help Property Page Object"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5522DAF9-06D6-11D2-8D70-00A0C98B28E2}\TypeLib\ = "{38911DA0-E448-11D0-84A3-00DD01104159}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{007CB060-1B7C-11CF-9D53-00AA003C9CB6}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSComctlLib.Slider\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{38911DA0-E448-11D0-84A3-00DD01104159}\1.1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E304B70C-0FCE-4E1B-9C81-CDAAD9F7DA55}\MiscStatus\ = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A0E7BF67-8D30-4620-8825-7111714C7CAB}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E074E8-BA0A-11D1-B137-0000F8753F5D}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6FBA474C-43AC-11CE-9A0E-00AA0062BB4C}\TypeLib\ = "{6FBA474E-43AC-11CE-9A0E-00AA0062BB4C}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F0D2F21D-CCB0-11D0-A316-00AA00688B10}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{030B4A81-1B7C-11CF-9D53-00AA003C9CB6}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D624E3E0-720A-11CF-8136-00AA00C14959}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUM_AMD64,V11\DEPENDENTS\{CA67548A-5EBE-413A-B50C-4B9CEB6D66C6}	vcredist_x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0,version="9.0.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="9.0.30729.7079",culture="neutral" = 440048004b00330047007a00760063003800340058006d005b0052005a003100430065004c0068005600530054004f005f00520075006e00740069006d0065005f0043004c005200330035003e00640046006800780072005a0053006e006e004000340071005e0056005b00570046003f006800760000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EFB6597-857C-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.2"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A030281-02AF-11D1-8D9D-00A0C90FFFC2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E746493-6ED1-11CE-9223-08002B369A33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E074E0-BA0A-11D1-B137-0000F8753F5D}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\HELPDIR	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSDataListLib.DataList\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\MiscStatus	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBCombo\CurVer\ = "MSDBCtls.DBCombo.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\VC_Redist_12222_amd64_enu	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\FT_VC_Redist_ATL_x64 = "VC_Redist_12222_amd64_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCDB0DF2-FD1A-4856-80BC-32929D8359B7}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Version\ = "2.2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{86CF1D34-0C5F-11D2-A9FC-0000F8754DA1}\2.0\HELPDIR	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WinForms.Control.Host.V3\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E1B5150-DB62-11D0-A0D8-0080C7E7B78D}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B541C03D-63BC-11CE-920C-08002B369A33}\TypeLib\ = "{EE008642-64A8-11CE-920F-08002B369A33}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90290CCB-F27D-11D0-8031-00C04FB6C701}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{373FF7F2-EB8B-11CD-8820-08002B2F4F5A}\TypeLib\Version = "1.5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5522DAF9-06D6-11D2-8D70-00A0C98B28E2}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E07513-BA0A-11D1-B137-0000F8753F5D}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE39-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "C:\\Windows\\SysWOW64\\mscomctl.ocx"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E9E074F4-BA0A-11D1-B137-0000F8753F5D}\ProxyStubClsid	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0,version="9.0.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="9.0.30729.7079",culture="neutral" = 440048004b00330047007a00760063003800340058006d005b0052005a003100430065004c00680056005300540041005f00520075006e00740069006d0065005f0043004c005200330035003e00330027005d0035005a00670075006f0074003f0040005a004400470052007000240024005200790000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B6413C2-C55E-4BA7-B4DF-1A71DBC6ACC2}\ = "Microsoft MAPI Messages Control, version 6.0 (SP6)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A4FCCB0-DFF1-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{BDC217C8-ED16-11CD-956C-0000C04E4C0A}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B8385E0-1B7D-11CF-9D53-00AA003C9CB6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D646316D-0915-421A-84C1-6A21C2495791}\VersionIndependentProgID\ = "MSDataGridLib.DataGrid"	msiexec.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
2704	reg.exe
1980	reg.exe
4800	reg.exe
4368	reg.exe
4852	reg.exe
1420	reg.exe
1800	reg.exe
3256	reg.exe
1532	reg.exe
4816	reg.exe
4932	reg.exe
2800	reg.exe
4936	reg.exe
1500	reg.exe
444	reg.exe
1676	reg.exe
1196	reg.exe
3032	reg.exe
4708	reg.exe
2324	reg.exe
1480	reg.exe
3172	reg.exe
2284	reg.exe
468	reg.exe
1116	reg.exe
3960	reg.exe
4544	reg.exe
1568	reg.exe
4288	reg.exe
3032	reg.exe
3304	reg.exe
4160	reg.exe
2116	reg.exe
236	reg.exe
4148	reg.exe
4132	reg.exe
3008	reg.exe
4340	reg.exe
3892	reg.exe
2352	reg.exe
4796	reg.exe
908	reg.exe
388	reg.exe
2276	reg.exe
2416	reg.exe
3908	reg.exe
656	reg.exe
4820	reg.exe
3684	reg.exe
4480	reg.exe
940	reg.exe
3212	reg.exe
428	reg.exe
3156	reg.exe
2840	reg.exe
3604	reg.exe
3344	reg.exe
3108	reg.exe
1440	reg.exe
3080	reg.exe
1396	reg.exe
3160	reg.exe
4248	reg.exe
1552	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4832	2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe
4832	2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
4832	2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe
4832	2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe
3272	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe
Token: SeIncreaseQuotaPrivilege	2584	WMIC.exe
Token: SeSecurityPrivilege	2584	WMIC.exe
Token: SeTakeOwnershipPrivilege	2584	WMIC.exe
Token: SeLoadDriverPrivilege	2584	WMIC.exe
Token: SeSystemProfilePrivilege	2584	WMIC.exe
Token: SeSystemtimePrivilege	2584	WMIC.exe
Token: SeProfSingleProcessPrivilege	2584	WMIC.exe
Token: SeIncBasePriorityPrivilege	2584	WMIC.exe
Token: SeCreatePagefilePrivilege	2584	WMIC.exe
Token: SeBackupPrivilege	2584	WMIC.exe
Token: SeRestorePrivilege	2584	WMIC.exe
Token: SeShutdownPrivilege	2584	WMIC.exe
Token: SeDebugPrivilege	2584	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2584	WMIC.exe
Token: SeRemoteShutdownPrivilege	2584	WMIC.exe
Token: SeUndockPrivilege	2584	WMIC.exe
Token: SeManageVolumePrivilege	2584	WMIC.exe
Token: 33	2584	WMIC.exe
Token: 34	2584	WMIC.exe
Token: 35	2584	WMIC.exe
Token: 36	2584	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2584	WMIC.exe
Token: SeSecurityPrivilege	2584	WMIC.exe
Token: SeTakeOwnershipPrivilege	2584	WMIC.exe
Token: SeLoadDriverPrivilege	2584	WMIC.exe
Token: SeSystemProfilePrivilege	2584	WMIC.exe
Token: SeSystemtimePrivilege	2584	WMIC.exe
Token: SeProfSingleProcessPrivilege	2584	WMIC.exe
Token: SeIncBasePriorityPrivilege	2584	WMIC.exe
Token: SeCreatePagefilePrivilege	2584	WMIC.exe
Token: SeBackupPrivilege	2584	WMIC.exe
Token: SeRestorePrivilege	2584	WMIC.exe
Token: SeShutdownPrivilege	2584	WMIC.exe
Token: SeDebugPrivilege	2584	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2584	WMIC.exe
Token: SeRemoteShutdownPrivilege	2584	WMIC.exe
Token: SeUndockPrivilege	2584	WMIC.exe
Token: SeManageVolumePrivilege	2584	WMIC.exe
Token: 33	2584	WMIC.exe
Token: 34	2584	WMIC.exe
Token: 35	2584	WMIC.exe
Token: 36	2584	WMIC.exe
Token: SeBackupPrivilege	2272	vssvc.exe
Token: SeRestorePrivilege	2272	vssvc.exe
Token: SeAuditPrivilege	2272	vssvc.exe
Token: SeShutdownPrivilege	4124	vcredist_x64.exe
Token: SeIncreaseQuotaPrivilege	4124	vcredist_x64.exe
Token: SeSecurityPrivilege	3272	msiexec.exe
Token: SeCreateTokenPrivilege	4124	vcredist_x64.exe
Token: SeAssignPrimaryTokenPrivilege	4124	vcredist_x64.exe
Token: SeLockMemoryPrivilege	4124	vcredist_x64.exe
Token: SeIncreaseQuotaPrivilege	4124	vcredist_x64.exe
Token: SeMachineAccountPrivilege	4124	vcredist_x64.exe
Token: SeTcbPrivilege	4124	vcredist_x64.exe
Token: SeSecurityPrivilege	4124	vcredist_x64.exe
Token: SeTakeOwnershipPrivilege	4124	vcredist_x64.exe
Token: SeLoadDriverPrivilege	4124	vcredist_x64.exe
Token: SeSystemProfilePrivilege	4124	vcredist_x64.exe
Token: SeSystemtimePrivilege	4124	vcredist_x64.exe
Token: SeProfSingleProcessPrivilege	4124	vcredist_x64.exe
Token: SeIncBasePriorityPrivilege	4124	vcredist_x64.exe
Token: SeCreatePagefilePrivilege	4124	vcredist_x64.exe
Token: SeCreatePermanentPrivilege	4124	vcredist_x64.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4832	2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe
3752	vcredist_x86.exe
4796	vcredist_x64.exe
2708	vcredist_x86.exe
4652	vcredist_x64.exe
4532	VC_redist.x86.exe
1692	VC_redist.x64.exe
4588	msiexec.exe
656	vcredist_x64.exe
4588	msiexec.exe
5012	msiexec.exe
5012	msiexec.exe
244	msiexec.exe
4480	vcredist_x86.exe
244	msiexec.exe
3368	msiexec.exe
3368	msiexec.exe
424	msiexec.exe
424	msiexec.exe
2144	msiexec.exe
2144	msiexec.exe
4860	vcredist_x64.exe
4456	msiexec.exe
4456	msiexec.exe
4360	msiexec.exe
2592	VC_redist.x64.exe
4360	msiexec.exe
1356	msiexec.exe
1356	msiexec.exe
4248	msiexec.exe
4248	msiexec.exe
4320	msiexec.exe
4320	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
3496	msiexec.exe
3496	msiexec.exe
2840	msiexec.exe
2840	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
4168	msiexec.exe
4168	msiexec.exe
1920	msiexec.exe
1920	msiexec.exe
2116	msiexec.exe
2116	msiexec.exe
3548	msiexec.exe
3548	msiexec.exe
4976	msiexec.exe
4976	msiexec.exe
4220	msiexec.exe
4220	msiexec.exe
1880	msiexec.exe
1880	msiexec.exe
3976	msiexec.exe
3976	msiexec.exe
4148	msiexec.exe
4148	msiexec.exe
2124	msiexec.exe
2124	msiexec.exe
3836	msiexec.exe
3836	msiexec.exe
2212	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3924	4832	2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe	80
PID 3924 wrote to memory of 1400	3924	cmd.exe	82
PID 1400 wrote to memory of 244	1400	cmd.exe	83
PID 3924 wrote to memory of 1008	3924	cmd.exe	84
PID 3924 wrote to memory of 1292	3924	cmd.exe	85
PID 3924 wrote to memory of 2316	3924	cmd.exe	86
PID 3924 wrote to memory of 3008	3924	cmd.exe	87
PID 3924 wrote to memory of 2584	3924	cmd.exe	88
PID 3924 wrote to memory of 4944	3924	cmd.exe	89
PID 3924 wrote to memory of 3708	3924	cmd.exe	91
PID 3708 wrote to memory of 4960	3708	cmd.exe	92
PID 3924 wrote to memory of 1620	3924	cmd.exe	93
PID 1620 wrote to memory of 1760	1620	cmd.exe	94
PID 3924 wrote to memory of 4748	3924	cmd.exe	95
PID 4748 wrote to memory of 3152	4748	cmd.exe	96
PID 3924 wrote to memory of 424	3924	cmd.exe	97
PID 3924 wrote to memory of 1944	3924	cmd.exe	98
PID 3924 wrote to memory of 656	3924	cmd.exe	99
PID 3924 wrote to memory of 3324	3924	cmd.exe	100
PID 3924 wrote to memory of 1932	3924	cmd.exe	101
PID 1932 wrote to memory of 3496	1932	cmd.exe	102
PID 3924 wrote to memory of 3688	3924	cmd.exe	103
PID 3924 wrote to memory of 3808	3924	cmd.exe	104
PID 3808 wrote to memory of 1792	3808	cmd.exe	105
PID 3924 wrote to memory of 3556	3924	cmd.exe	106
PID 3924 wrote to memory of 3700	3924	cmd.exe	107
PID 3700 wrote to memory of 1144	3700	cmd.exe	108
PID 3924 wrote to memory of 3928	3924	cmd.exe	109
PID 3924 wrote to memory of 1816	3924	cmd.exe	110
PID 1816 wrote to memory of 1480	1816	cmd.exe	111
PID 3924 wrote to memory of 2124	3924	cmd.exe	112
PID 3924 wrote to memory of 4148	3924	cmd.exe	113
PID 3924 wrote to memory of 4692	3924	cmd.exe	114
PID 3924 wrote to memory of 4368	3924	cmd.exe	115
PID 3924 wrote to memory of 584	3924	cmd.exe	116
PID 3924 wrote to memory of 4924	3924	cmd.exe	117
PID 3924 wrote to memory of 2488	3924	cmd.exe	118
PID 3924 wrote to memory of 324	3924	cmd.exe	119
PID 3924 wrote to memory of 2268	3924	cmd.exe	120
PID 3924 wrote to memory of 4708	3924	cmd.exe	121
PID 3924 wrote to memory of 4160	3924	cmd.exe	122
PID 3924 wrote to memory of 1980	3924	cmd.exe	123
PID 3924 wrote to memory of 1420	3924	cmd.exe	124
PID 3924 wrote to memory of 3160	3924	cmd.exe	125
PID 3924 wrote to memory of 1532	3924	cmd.exe	126
PID 3924 wrote to memory of 2540	3924	cmd.exe	127
PID 3924 wrote to memory of 1440	3924	cmd.exe	128
PID 3924 wrote to memory of 4524	3924	cmd.exe	129
PID 3924 wrote to memory of 4936	3924	cmd.exe	130
PID 3924 wrote to memory of 2324	3924	cmd.exe	131
PID 3924 wrote to memory of 3468	3924	cmd.exe	132
PID 3924 wrote to memory of 3080	3924	cmd.exe	133
PID 3924 wrote to memory of 2284	3924	cmd.exe	134
PID 3924 wrote to memory of 4652	3924	cmd.exe	135
PID 3924 wrote to memory of 2096	3924	cmd.exe	136
PID 3924 wrote to memory of 2276	3924	cmd.exe	137
PID 3924 wrote to memory of 8	3924	cmd.exe	138
PID 3924 wrote to memory of 3800	3924	cmd.exe	139
PID 3924 wrote to memory of 3304	3924	cmd.exe	140
PID 3924 wrote to memory of 2404	3924	cmd.exe	141
PID 3924 wrote to memory of 3184	3924	cmd.exe	142
PID 3924 wrote to memory of 4008	3924	cmd.exe	143
PID 3924 wrote to memory of 1116	3924	cmd.exe	144
PID 3924 wrote to memory of 2884	3924	cmd.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_8c9cf32bbb143f4d82e24158b0271d14_elex_floxif_wannacry.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Windows\system32\reg.exe
      reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1008
- - C:\Windows\system32\findstr.exe
    findstr /c:" 5."
    3⤵
    PID:1292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2316
- - C:\Windows\system32\reg.exe
    reg.exe query "HKU\S-1-5-19"
    3⤵
    PID:3008
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- - C:\Windows\system32\find.exe
    find /i "ComputerSystem"
    3⤵
    PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
      4⤵
      PID:4960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
      4⤵
      PID:1760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
      4⤵
      PID:3152
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:424
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:1944
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:656
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:3324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
      4⤵
      PID:3496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
      4⤵
      PID:1792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.61135.400
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3556
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
      4⤵
      PID:1144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40664.0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
      4⤵
      PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 50.35719.0
    3⤵
    PID:2124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:4148
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4368
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:4924
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:324
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:2268
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4708
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4160
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0
    3⤵
    - Modifies registry key
    PID:1980
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:1420
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
    3⤵
    PID:3160
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A
    3⤵
    - Modifies registry key
    PID:1532
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:2540
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1440
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
    3⤵
    PID:4524
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4936
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2324
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D} /v UninstallString
    3⤵
    PID:3468
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{773AD50D-AAE6-4BA1-AD01-B5A38874C840} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3080
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2284
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4652
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2096
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2276
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:8
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3800
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3304
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2404
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3184
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
    3⤵
    PID:4008
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1116
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2884
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1552
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2336
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3988
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
    3⤵
    PID:4020
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2068
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2688
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:2416
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1160
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4760
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4132
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1436
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2808
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:940
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:496
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4352
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
    3⤵
    PID:4820
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1224
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1748
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1396
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2596
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1104
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:468
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4756
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4904
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
    3⤵
    PID:2524
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4624
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2392
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3908
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3360
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4588
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1500
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4816
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1676
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
    3⤵
    PID:3292
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4172
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4532
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:388
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1136
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2600
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3008
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4280
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4460
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4800
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2584
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3368
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
    3⤵
    PID:2840
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1760
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2072
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
    3⤵
    PID:2040
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1060
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1812
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
    3⤵
    - Modifies registry key
    PID:656
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3324
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3032
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
    3⤵
    PID:4752
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4976
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4868
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
    3⤵
    PID:2704
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3712
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1792
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4340
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2812
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1584
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
    3⤵
    PID:3412
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3832
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2776
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1480
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4604
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1956
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4368
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1936
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:884
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
    3⤵
    PID:1076
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5040
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4500
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s
    3⤵
    PID:4504
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3636
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4360
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3160
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5088
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:888
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3892
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4468
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1968
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable" /s
    3⤵
    PID:4112
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3468
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2920
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4248
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4292
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2096
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
    3⤵
    PID:728
- - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    PID:1972
  - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{09945AF5-4694-4556-855F-51AB90CF5F54} {0D0D69EF-935E-4666-88B2-0F69926D3B3D} 1972
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:3752
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
    3⤵
    - Modifies registry key
    PID:4852
- - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4124
  - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{C0CCB668-61EF-4F84-AAE4-DD54A991ED22} {07559A88-9154-4C89-9820-52C925D6796F} 4124
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4796
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f
    3⤵
    - Modifies registry key
    PID:3212
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    PID:4856
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{220E97C0-2623-44F5-AF40-3D8670CCBAE8} {C945EB9D-55FD-4C37-818B-C4A93C709BFF} 4856
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:2708
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
    3⤵
    PID:3852
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    PID:4616
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{E82A6A70-E848-4062-98F3-0576E3E5FA04} {FF1C2AD8-5C81-4DBF-BFB9-216291B1B8E4} 4616
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4652
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f
    3⤵
    - Modifies registry key
    PID:428
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4172
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=572 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:4532
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{5EFB5BEA-8171-4388-ACFE-7E43D0BE7ED1} {B04FE5FE-1D4C-4132-A793-AB19183F2C9E} 4532
        5⤵
        
        PID:2024
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f
    3⤵
    - Modifies registry key
    PID:444
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1292
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=572 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:1692
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{205257B9-8A67-46FA-B87F-A9743A58F832} {36A89B00-4902-4311-8D37-EA9279C3E267} 1692
        5⤵
        Adds Run key to start application
        
        PID:2908
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f
    3⤵
    - Modifies registry key
    PID:3172
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:908
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1116
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4588
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f
    3⤵
    PID:4336
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
    3⤵
    PID:2776
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:5012
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f
    3⤵
    - Modifies registry key
    PID:1676
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1420
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:244
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /f
    3⤵
    - Modifies registry key
    PID:2352
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
    3⤵
    PID:4920
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3368
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /f
    3⤵
    PID:4612
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString
    3⤵
    PID:1060
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString
    3⤵
    PID:1796
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4820
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{BF08E976-B92E-4336-B56F-2171179476C4} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:424
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /f
    3⤵
    - Modifies registry key
    PID:1800
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString
    3⤵
    PID:2796
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2144
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /f
    3⤵
    PID:3832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:732
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
      4⤵
      PID:884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.60917.0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2640
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{610487D9-3460-328A-9333-219D43A75CC5} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3960
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\9D7840160643A823393312D9347AC55C
    3⤵
    PID:2580
- - C:\Windows\system32\find.exe
    find /i "TRIN_TRIR_SETUP"
    3⤵
    PID:1976
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Studio 2010 Tools for Office Runtime *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3156
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2064
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
      4⤵
      PID:3800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2708
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:4152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3344
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:4468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:4320
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:1888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:1732
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:584
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} /v UninstallString
    3⤵
    PID:1956
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
    3⤵
    PID:2324
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D
    3⤵
    - Modifies registry key
    PID:2116
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:4644
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1196
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F
    3⤵
    - Modifies registry key
    PID:4796
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:1420
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3684
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString
    3⤵
    PID:4112
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53CF6934-A98D-3D84-9146-FC4EDF3D5641} /v UninstallString
    3⤵
    PID:2816
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010792BA-551A-3AC0-A7EF-0FAB4156C382} /v UninstallString
    3⤵
    - Modifies registry key
    PID:908
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{61B44572-8722-4DAF-8ACF-8E742D30BCC5} /v UninstallString
    3⤵
    PID:2632
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4480
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4816
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2600
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4852
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:236
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4680
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2172
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s
    3⤵
    PID:3516
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2584
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2468
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4932
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1340
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3420
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4544
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3104
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4648
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s
    3⤵
    PID:4980
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1060
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2372
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3032
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4392
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:656
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3256
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4600
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3292
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:2840
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:424
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3752
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s
    3⤵
    PID:752
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1944
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2032
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3604
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1920
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2404
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s
    3⤵
    PID:2124
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4692
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:324
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4148
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:884
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4168
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s
    3⤵
    PID:4464
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3992
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1976
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s
    3⤵
    PID:3492
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4372
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4308
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1568
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1144
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3288
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4288
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4248
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2028
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:3876
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3344
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4456
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f
    3⤵
    - Modifies registry key
    PID:2800
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
    3⤵
    PID:2292
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4360
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f
    3⤵
    - Modifies registry key
    PID:2704
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:1356
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:4248
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4320
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1768
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3496
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2840
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:1444
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4168
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:1920
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2116
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3548
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" /qb
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4976
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4220
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:1880
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3976
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:4148
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2124
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3836
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\vstor40_x64.msi" /qb
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:2212
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D391-45A6-A8FB-00B01E2B010D} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3108
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString
    3⤵
    PID:3932
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3032
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /passive /norestart
    3⤵
    PID:3928
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{C5E3A69D-D393-45A6-A8FB-00B01E2B010D} /passive /norestart
    3⤵
    PID:400
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vbcrun.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2596

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3048

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3272
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 06916FDD5B3A030DECB4C61AC729BD65
  2⤵
  - Loads dropped DLL
  PID:728
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 3A225E9964F70B9B86D143273A5B8FDA
  2⤵
  - Loads dropped DLL
  PID:3160
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 23E68AA282859B71DA53223E429705DB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1424
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0C56C1BCC42A0D482BC420073322A53A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3104
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 766189B64964BBEA449862E9A48A874C
  2⤵
  - Loads dropped DLL
  PID:2484
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E9B8A9E16049C8658C6983F15797202F
  2⤵
  - Loads dropped DLL
  PID:3304
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding B95B336B7456D0EE1A544817E3C0F191
  2⤵
  - Loads dropped DLL
  PID:1480
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 826B3A218B6DA0B2C88B715EDC9C3417
  2⤵
  - Loads dropped DLL
  PID:4808
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 10F7649157202855A87C8CF1771D2700
  2⤵
  PID:3412
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CB68861C0CF0C1253B5CC2A344147BC8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1968
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8CAEC93FBFD9A581BF05A08593A55C13
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3564
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E42BDF1453D804691A5001910A959E1F
  2⤵
  PID:2396
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 981A5546EF65478F37ADD52DAA8AE22A M Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4304
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 01D09A89DAAF031FD08E3A6A13A776D3 E Global\MSI0000
  2⤵
  PID:1596
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild
    3⤵
    - Drops file in Program Files directory
    PID:4452
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild
    3⤵
    PID:4296
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2480
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 37983E6FC0A4BEEA2186DE6C10B40AFD E Global\MSI0000
  2⤵
  PID:3496
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2560
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4220
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4040
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:324
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2728
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4232
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2344
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2064
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4468
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:564
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4796
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:908
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5044
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4120
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2908
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3152
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1796
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4980
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4920
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3032
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3620
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2540
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2596
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4836
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:324
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2728
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2260
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4168
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2324
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4996
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3628
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4132
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5044
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1136
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1812
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3152
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1768
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4388
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4920
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3032
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3420
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1424
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4540
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4292
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1104
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1560
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3992
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2344
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1532
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3344
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2972
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2568
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4796
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3628
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2816
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3636
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1500
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4820
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4048
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:384
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2072
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4920
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3928
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3984
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:836
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:884
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4040
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4292
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2676
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3216
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3992
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5012
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2480
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:564
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1996
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2028
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4788
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4652
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1980
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2816
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4044
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2908
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2632
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1500
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4612
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4820
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1760
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4344
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2552
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3292
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4852
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4668
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3040
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:324
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1776
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:4792
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
    3⤵
    - Drops file in Windows directory
    PID:3284

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221911.log" /uninstall /passive /norestart ignored /burn.runonce
1⤵
PID:3100
- C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221911.log /uninstall /passive /norestart ignored
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1892
- - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221911.log /uninstall /passive /norestart ignored -burn.unelevated BurnPipe.{04BAB897-B744-4E91-BB20-22581F84642C} {165F0FCA-66EB-4CF6-9F78-2F0F607EFBC3} 1892
    3⤵
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:656

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce
1⤵
PID:3508
- C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
  "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260426221913.log"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:844
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260426221913.log" -burn.unelevated BurnPipe.{C1D2260C-7D60-4821-9DE2-0EF2FEED35F1} {139DC31A-013C-462D-BEFC-F1D9C4ABC270} 844
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4480

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce
1⤵
PID:4548
- C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
  "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221915.log"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2112
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221915.log" -burn.unelevated BurnPipe.{2934A785-3979-4201-9408-A45DA1FF6AD1} {7D32B5BD-D06D-4A39-BE4F-081A37D4EA8E} 2112
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4860

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /burn.runonce
1⤵
PID:896
- C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221918.log"
  2⤵
  PID:3792
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221918.log"
    3⤵
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58877d.rbs

Path C:\Config.Msi\e58877d.rbs
Size 23KB
SHA256 ef510f92c1af70b814541ede66a40bccac6f3097472cd51c95db40d964be8ef8
MD5 1a462a10eafa9ec9f506a5c5daf79c10
SHA1 fe04743d3aeffd8d5bd557584d1b8ebb0e7adbbe
SHA512 3aafa7348fb1518a86e6d5fb9fbdb053e9bfc7548f4d4446f581cae7e306ebadcf3d7bd2303a5a33b0f4541d494c7860ccd6032f86df39066b6f1e3e1bd47a42
SSDEEP 384:IW3R6JeHiCR6HeHTqSPjlHtCZYIygytj/fH9jMAo5GRhNerhY0GRjQ94L2XCCW3p:IAJfy+CgL
TLSH
T1C6B2F003668496D3C8A66B30DC6B1B683B36D7D99765834B00ECD1344E933C73F9AA9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588790.rbs

Path C:\Config.Msi\e588790.rbs
Size 14KB
SHA256 4535894c7a375b4eae530b0b208097b0c2c553b8b47c10cc7896789b45836114
MD5 83e68eef2b5ad9358380d76082a97fef
SHA1 df5e18f426c71364831bac9dfc39ca4f2420e0d5
SHA512 f08c3b4b6a229a12c70d1677dbc8b40462b701d5a1f1327eb706f9b8f5149bf44390a90123e676759abe4a1258d10b1a60c71bf3d7193bfde3f51b689e7eaff0
SSDEEP 192:I7f93Re+I/SgqRevI/SEPc2Eo0Iq01aDJTeowKZeLrP81qAZzajzaMglg2jH:IT93RUSRpdkSlHKUvjCMgK2jH
TLSH
T189623042AA8082D2D9AA2B30DD171B203BB3D3D6C715838B11CC9674CF47BC56FE999D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588797.rbs

Path C:\Config.Msi\e588797.rbs
Size 21KB
SHA256 e2f2da026543fcd249bf2e1147f5923ff1ae43a15fd9814d18055120d284d9fe
MD5 ac185ad03b2866434f79b6efa011fb02
SHA1 f95977ac051e0225dade1a319c81130ff8503d4d
SHA512 154d55b2e6a4db7a083ce89dddb1eb10a8bb3cd4df1e9d012f61630457210b57febda9f4d01817646b1b14a628e4550c07c8e69f05a81d23e537daebab5e093f
SSDEEP 384:WoRrWR/we5esSOMX3Mq8KywUD1cjdVu07t+DOepB:WMK4e5erOMX3Mq8Kt81cjdVu07t+DOeT
TLSH
T1F5A2EC03B65096D3D8672B30DD2B1B257B76C7E99711838B00EC92344FA77C62F9658E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5887a8.rbs

Path C:\Config.Msi\e5887a8.rbs
Size 14KB
SHA256 9c7687935c27be0257315f3275eaba2c3d5898592fe0a2b68cc414211a96ca7f
MD5 d6926b2756e523e91639209618c6ba03
SHA1 6ccfed36486eaf62ac891e06b8ad0d150cabfb03
SHA512 9062a84209b5b087e8a2c7b8969986c93a84fa006e4d63711f5d7816efa56c8232cb14474a46e848aba2ec28fe2a8197e14e01810060e37d1e2212f8b4ec7c28
SSDEEP 96:WMNp48xNpM0u7ztH8RdeDwYx12tH8RseDwYCj71rR7c7QNpx1FNpLxcNpkFaxcTP:W+R5YbRUYYaqbzfCgPo6/Wufl
TLSH
T10652F003AB0586C3DDA62B30DA231B247B73C7EE9354839B21DDD1744E577862E8D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5887ad.rbs

Path C:\Config.Msi\e5887ad.rbs
Size 22KB
SHA256 6ca67f16fd9e74a69e114f727d517f70072083bf5ff49f7fdfda62cf195ba9fc
MD5 ad5d325e378e27187bb5dd622f439abf
SHA1 3883199d32d3a6ca66b402d435295d801cdb8b7f
SHA512 ff39db8ea59e11d4599e976175f4cbffa8a6cdd1f37cca1b531c3a8c359a95bc47011baceb0ffca4d2e96eec5af3f9804a2d7e51d167ee28c8690e966c76a8ff
SSDEEP 384:K7RARRJNUZUGz5YkrcZqbogvXD7DQdw2BzqZAEK7:KVwQq
TLSH
T117A2CB026640D5E3C86B2B30ED631B693B32D7D59794878B00DD90748EA73D72F9DA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5887be.rbs

Path C:\Config.Msi\e5887be.rbs
Size 15KB
SHA256 524e2aa1689f8f7b24ffadaf8d24e8d084d2c0583f1bd3388d74ba1e3400e76e
MD5 b50017c200b5fdb94f3d4daa7f316516
SHA1 15ec650c3102d639e10d51dbb7764dac707ea939
SHA512 158bfa3f9952d5f07a53b4f62218f165356e05a11f0a9b7cef495cdf4c2e049f57852c85bb6d4d90796d3c9cf373d50adb14866c73f3f8d153d2c14387e91588
SSDEEP 384:KFFRYaX27RRYmX2tR5JZpgBmQ7fpqPfdExv:KJiv42
TLSH
T1436232436A1581D2D8672B30CA1B1BA93F66C7D5D718834B01CD9A308F477CA7EDC64E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5887c6.rbs

Path C:\Config.Msi\e5887c6.rbs
Size 21KB
SHA256 3678e89f996d12ed1c9ddac97443cbb6a826582a737211199b9d1aecad38a5bf
MD5 2a7406cd6c46fdc069a6b98ccbc5f983
SHA1 cb4e21ad7b5855ec8d8b58de5ffe3e51513ffc52
SHA512 f7c5830c40ab6248e0f68f09f3d21c47ecb92a57f492605cbffc3da5ddca0a60817b6a5b15d0a121631fef3df1777533cb9c0d7f9b16f31ecc8b48de106e1906
SSDEEP 384:DkRVGRGnAKxNAUhUC7xJjrMNYPzIbSfMAgpsMHkte/xkP:DYMSAKhkmf
TLSH
T1A4A22F03768089E3C86227B0DD671BA53B73D7D99350434B10ECD5348F633D72E9AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5887d7.rbs

Path C:\Config.Msi\e5887d7.rbs
Size 20KB
SHA256 d0abf1b70597df6f30849fe09477cb1e539690bd5e4c06e1d8babd2a8c15d010
MD5 d90a5d41686843367e0783a062dd1319
SHA1 821d3d0dc340ad324db9374d12dba55a35770612
SHA512 6063d6cf4e6dbde1ff3766b5cd0a99f6ee7f2f7411f3508299f2a4f50b0cee783fda666d3a62d9f79997f09754a8bb53ea94745de1840a658e836521495fc280
SSDEEP 192:DuRq1kRf15dXcFUADIc1f+W+y4+oAWmgCbQu7:DuRq6RfTeC81f/clEx7
TLSH
T14AA2FB52AA80C9D3D8766B30CD271B653B76DBD5A390438B40DC94308F93BCA2F9D68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5887e5.rbs

Path C:\Config.Msi\e5887e5.rbs
Size 31KB
SHA256 38f27e544451c5ec741f22852f87c9ff55e1fc4c07fac9f4856279582970034b
MD5 e742566ec7996e54a6adacbddb94dd1e
SHA1 3a4d290a46390cd51cc31129b7486d41f1bdf19f
SHA512 f23040fb9a39a4e8cb3081d0512ae711e69bdfea008af52417fc8519504ad116b07ddb80d2375858849366f05d2bdc705f6f7eb3391ad18435dd0f30624889ce
SSDEEP 384:PW8N8xRBNeRlTu8iu8Uu8XcAlRTMV/ZawBV3yFgmkHRu+Ru2S:PMSdsaVvRIVxDe6HRu+RuJ
TLSH
T1DFE25502F64EDAD2ED243730CE872BA57BD3D3E6530E1A5B00CE91701B46BD94D5D26A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5887e9.rbs

Path C:\Config.Msi\e5887e9.rbs
Size 49KB
SHA256 61040d1f949962420db62654dd3e7cfe18d67e42dbbef5357a5749eef4db25b3
MD5 e6f43b7f2a0e1844175393651b247d30
SHA1 07ad5f7a01600b1f05c3cad2ad6147baca19f2e3
SHA512 b55682a46e15596e070d6bcb9204a17dbf21486b71fe59cf3f73f4fef26764a9f99d75a55a46a38ff53ee1c566319edc544f832249c3db5d6fd623082b3efae7
SSDEEP 768:5YyFWVQKRy2Rs2iOD0MMGrLxBg6IfZ1It4KwjlHvizBNOY:eJ7cG
TLSH
T1B533EE023354E6D3D6652A30CD030BB57F3BC6E69312866B54ADC5788FA3BC62E85E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58880d.rbf

Path C:\Config.Msi\e58880d.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e588818.rbs

Path C:\Config.Msi\e588818.rbs
Size 31KB
SHA256 fe8e6bf2fbbba407b78ec312e6801a3e92277a4195234c64ba7710bb7335f2a2
MD5 cfb31bea2f75d00dca0c60a586a976ea
SHA1 53c2e8ed914ccf198e73c366362c74c5a70c4480
SHA512 2ac86ef7ef38e75b91cd196f2f632391f17630aee91f6df14e6c125bb57d9c58552e6f2c4de4f9baea1a95679dde1d14217d5190bc2d387c7022fa8178ac0640
SSDEEP 768:Xi5nUjEYuxy1SQBCUsAE6HRzY1WY3BYBYFY7YYYpYQlxlQrnr:L1GI
TLSH
T171E29207F316A6D2E9493F74C5032B6CBB87D7E6830E064F44DDC8A00E66BC66A5538B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58881c.rbs

Path C:\Config.Msi\e58881c.rbs
Size 52KB
SHA256 4ce194101419b5cc4bff5017426161cce3f775391913b6bd76143793567bd794
MD5 8f1d82c298656a04db35f3953a1b88ba
SHA1 c2adc7c7cb75f6bc48d2da91fa9120231bf89fe4
SHA512 27074ab244b29a201e65ecb5c7d4fdf8ae2c7d6f1492ef374989ca7e710ce550fd9182907a2eb7961b10a048a9442d2f98dc7a4a86fba759a3f5adb85565b757
SSDEEP 384:/lU/RXLRUt9Ia9m4Z9qjSZvPrwtFpCndsTfjUEulJGw8fRJKO1RJxJ9ZRJOBRJDM:/s1gl9qM7kFvfefdKyfK
TLSH
T1703341027680D0C2D56967B2F82B0B94BB36DB96572102DF81DDD63C8E673C66E8CE4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58884e.rbs

Path C:\Config.Msi\e58884e.rbs
Size 41KB
SHA256 9e92e8c42ad6993dfeba6ee897301f57ec06bff8a1f52afb1621abc3e63eb89c
MD5 c67dfb6abed8415a390a2f20c0aa12c5
SHA1 180b13828488d935ca6ff9ca9a1fd7396a691d0e
SHA512 fdce5f2ee0b285d16ee0b017a2568b9330f5e031e77195efc6d45fbbf29758a3e5dbb189a6eca81f0241915e7c21e1508b6cd37f562b5347c3ac1802b08c20c8
SSDEEP 768:0QyMuCg21kTx9/DoflxL1JcEYYwNSCNfCRxj45:jyMuCg21kTx9/DoflxL1JcEYP8g
TLSH
T1681352027900C0C7E5762BB1EC2F17847375D6D79B21439F85CEA534AE873CA5E89E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588855.rbs

Path C:\Config.Msi\e588855.rbs
Size 13KB
SHA256 48a9a06c5a861625a96ef6729a3aa290a1d39dde0703d2ec540f7bfa1ddf054c
MD5 0451960a889120c843ff1c963ae184bb
SHA1 365c925ed1812a09da6229466e3883b4bf838361
SHA512 9e2374a486117ba4fead5af300a56d39cc5d528a79247eda5f837c577ed57620c63696a64304270c6f4a15f7a3534caadbba67e97317d44504b5c7253c5d1ea2
SSDEEP 192:M7f40kVOBVxVxVdVwVVSVeVTNherOcTfwCSGDYfvIozDYfvchoI9PEuN7/oLppV:MT45WLLX+VUQT6aAf50X0UVB/4
TLSH
T175522242BA40C1D2E8AA2B30DE4B1B243BB2D3DAC750938B05CD91749F477DA5FD958E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58885a.rbs

Path C:\Config.Msi\e58885a.rbs
Size 21KB
SHA256 adf515b611ff252b90a3639bfd896ed09979fa918bb10baabae5fa63ac551556
MD5 648d09a7aeb3128ecbf69f0b7eec2097
SHA1 174ef813c165a27cfe026ed181a2fe43ea0bef41
SHA512 f20c91a8c760fe46ccc2786da639bc5d1bfbf4cdb9efba9474f05442d43dcc8519ac8eecd45b1e373b61f7f298eaacb12c803c2485b291f7b4c7c6c0fedcd91a
SSDEEP 384:MWj/tdt8tVtctsitntTtxtwtstqtFtyttCtwtUt3tsjtdbt8rD85B923fjjtkfHu:MYPKHqhtRbG6M3UCGC9shPq/GGzNH
TLSH
T131A2ED426A40C6D7D8A66B30CD9B1B183376D7D9E7A5934B00CCD1304E833CB6F9A69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58885f.rbs

Path C:\Config.Msi\e58885f.rbs
Size 14KB
SHA256 ba5c9ae95125fa1da24c2e2d44273e4a81d9379cac04fcdd40b2c0d8b936bdbb
MD5 b69750bcf63e1c0247072a9c35896e11
SHA1 6fae90a15013b2cf7021ba94dcd93177c5657e4e
SHA512 cc4df65043724e1d6306834de979c91a284e21b8389a6c913ec0ff32408340c30ec508dbeebfeec927b39fba62b1cb00921847d133d35763134f7c4308d67af4
SSDEEP 192:tyJXuj2IYcw/0FBCP1NAkI4NAkJnFEXENNep6F:tytuj2IYcwVOoOOh
TLSH
T10162E042A60082D3E8AB6B74DE5727143BB5E3DBD391638B08CD91304F837C95F9969E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588864.rbs

Path C:\Config.Msi\e588864.rbs
Size 21KB
SHA256 5d119e71ef5127b0fe0658521341af2ba72425f1f6cfa21111ff40f04f92d740
MD5 cb974d91010bb8f648df16b90e46a368
SHA1 8daab9c933a8f4aec0d564ddf8d13be7c45f12eb
SHA512 2abb81245d12f09097f09cccc3d600b12d6cde587ace498c50ee7d9468821086d23d7b2c4752b4a448b6d1aa6ee5e5dca0bc8acf9848db88afd283ca08270d45
SSDEEP 384:tMT8MgXEtmrnb0MM0IE+AfCuS588UkRs242B5XDcpq:tMT8MgXEtmrnb0MM0IuD2F
TLSH
T1C1A2ED42A640D6C3D8A76B30DE5B1B653735C3DAA7A4534B01CCD0345FD33CA6F9AA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588869.rbs

Path C:\Config.Msi\e588869.rbs
Size 18KB
SHA256 59b93f6a2c049c03034362ff3cc1e91c33d59c67156b70131881ffc764b81f7f
MD5 1b0478dec04386ad7129fcd390193186
SHA1 c8b5a13f7e465bb1546d3157718cea62a091f8c2
SHA512 13f981b26c83b9b7883bcf94c6ee0d43c51bec83be04797d1bf13b1528fd0ce1a07c7f8a92f732f2bcd3cabe42c3b1cc98fe4d1c52ea3df4cc0cb3f01efb99c0
SSDEEP 192:t9DAoBHRq+M3NinQv7XZDtY1eCi2wfUIVwfUg03ETLNfHOp+:txAoBHRqF3NinQv7J+twfVwf7X
TLSH
T10992EB416A40C2A3E9A63B70CD5B1B1937B6D3DA97A1434B41CC80748E837CA6FDE58B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58886e.rbs

Path C:\Config.Msi\e58886e.rbs
Size 21KB
SHA256 d6f6c90d1267d7ad0e9e382d6d64f0801845dad85f2f8d94077b195dda60fef3
MD5 9be8b88f54b588448c3c441c3a28323d
SHA1 eb1fd29f0055d6d402c75970cf785d35ec4a679d
SHA512 454d66c7b18c30bdce70c20cd0953ceffe8348b3fa2174d7265f012c02f048e63c9795f3ee1046ba015ad7e1897249f43afd84641a2d5e19b29ef20192d807dc
SSDEEP 384:+T6tFYQxkA+pAv9jH4ryInsalckU72eC6PZj0hMh+2Y2sLH:+T6tFYQxkA+pAv9jayIiZwKU2YXLH
TLSH
T19FA2EC017A00D296E4AB2730CD971B283776C3D99361D78B80CDE1348F937D66EED68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58887d.rbs

Path C:\Config.Msi\e58887d.rbs
Size 41KB
SHA256 3c8a1e306e2f11623d3f12cde5507ee11968b9d21a4a7c21c62e52374a556dbc
MD5 7d5d80e2ae76f4ec6f0504a11c6ec1e0
SHA1 d8f27e2d8106daa26e0bb867adf298a37f6bb066
SHA512 2a366907cbfed6cf8b96d5a13be890b6c77570e915661b2580be0654f067398fc82dbd0e72b0cb65edcdf14bd9e86fd67c33f93e5f5ffb5aab72f88364e79fc2
SSDEEP 384:rraSWXI8pxL6+YgpiqeHs0wgdKtklYgHTPWdTwJrDT8STopdQQjQNJoa73eiU5i0:rBW4uxO+YgpiqeHs0wgdKtk5gkl//0cg
TLSH
T10E13FF426600D2C3EAA61A30CE071B757B7AC2E6D715976F14CED0704FC3BC92E99B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588883.rbs

Path C:\Config.Msi\e588883.rbs
Size 3KB
SHA256 10e0adf307c1a55d3ecc7e7d9ba9227ae5e17888f39d9ffa18636557f34b8de1
MD5 704dc5d48524d3cb14cb9d971f4ab6b0
SHA1 7897979a4b8d35d9ad9e6909af00f2b996f4c863
SHA512 cca6025441aacee3cfddf47b6b558524ea2a005871e2072519e09964f0baa8d34354c035e5be5fc5dda0223316d62639657dcfc2ef30905e88467a664f116561
TLSH
T19871C9039904C2C2EDE63B70D9571B2137B3C7EA8390938B11CC91704E47BC6AEDA24A
MD5 SHA1 SHA512 TLSH

Submit Download

e588886.rbs

Path C:\Config.Msi\e588886.rbs
Size 3KB
SHA256 5de91aee4381810704e505d6e815088f89697cfcec928d796e39042f133cbd6b
MD5 3feb5c176d7e5890d8fea16e86c70661
SHA1 2d74b00071ed212e604432010e36c18cff162bc0
SHA512 dcabfc87f28b03cb1e0c901c755039939ecb2417f4c4ff7b8bee07e55eff4ef7aecac8bc9c985763ee5e2154168758b2974c8e7bbc7c4449a9edeeb8acf57920
TLSH
T14871C043994496D2DCA62B70CA270B6837B7D7DE975043CB458CC1740E877C5AEDB28B
MD5 SHA1 SHA512 TLSH

Submit Download

e58888a.rbs

Path C:\Config.Msi\e58888a.rbs
Size 15KB
SHA256 a66d6a8fd22ccb90561a2ae949e6a6a71c8c0cd2fddfad7a8a493bcced2a3994
MD5 90e19fe135e77d86f7a91e344bb4cc98
SHA1 82397290ee1d24d04c3dba97963627d706a5ceb5
SHA512 61a19dcf1cdfadd9f863dda059e1c96bbfcaaec874dfc2d1cbd4890cea593ef3cd8ba6ebc3c63c814100463c3fab249e11e35aeb98f2cf9d2c7bf5c4747cecf4
SSDEEP 96:rrXNpU0jNpgbKwNNNNXsNV9NpvHP+HRxWR5OeeNpVZCzze1zeQKwSUAMeD2gARCh:rrSKtlR5UCs1aAkIgaAkyH/EnwNWepFh
TLSH
T1ED621E02A60089D3ECA22B34CA971B583732D7E6D394534F00ECD5749E87BC61F9D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588892.rbs

Path C:\Config.Msi\e588892.rbs
Size 20KB
SHA256 c4e26423886260ba84d9fa8b3bb311a4cbae425e518d7546d1bf62701e17b15f
MD5 e31f5126deb05f0400bbd1f86f3553bf
SHA1 12cafa988d3268e6625cc2e256fc350ae16b2281
SHA512 7d50c1681760bf9ef9c9cb58f3d2fa37c2a7f170edfa23f3c1bef370c86ab7c6204312a83bb5f6a107cdd38033aa8be2d3cef8ed83b9c3ab386a9febd0efda9a
SSDEEP 192:2YUU92K2jY0E1iKCq3wzR5KCF1CAkIuCAk60W41E5kCT4b6epRX:2YdIK2jY0E1iKCq3w/Rj+jSYT4bZ
TLSH
T10592DB427A00C683E8A76B70CD6B27283772D7EAD751578B01CDD0304E977C66F9A68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588899.rbs

Path C:\Config.Msi\e588899.rbs
Size 15KB
SHA256 9af43de1ee1a2345d30c94fec1c1a6d5f5a8096e5b7dfe15956c9cffe2c3de9a
MD5 61b03e520a024b2f0c11a795b9ed8ad6
SHA1 e5ed66bf42d8b2ddc6eaeae940b590a5c694ad8c
SHA512 506426d3c20f2fc06515878126e54fae729f343bf56057eed908a774cad1bd981fc13f24e617d43ff34dfb9619a058f5699bf8ca1d21c6760ae03132897ce2cb
SSDEEP 96:2eRp55Rp/N9WT8RYeDd11xIjtknz0yWcW/Rp0cdzRp9OXw3Tjtkno8ijwUBQdogN:2kRH17n3Xyin5f7e+nh18XTBy
TLSH
T10D72FD02A94096C3E8662B70DD571B7037B6D7E5E354838B40DC92349F877E62F9E28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58889e.rbs

Path C:\Config.Msi\e58889e.rbs
Size 19KB
SHA256 8462e23ba19ec4f2382eb2e4df6232f19471602fb34c4b3504acacf7c4afe031
MD5 38aa1fce4c2e565b3ec4f68dbdec0ab5
SHA1 d1fabdcad5d96272177f5e59abf5f042f2f48ee8
SHA512 261588a3bfa2a11f47572e4ded87f7ddba345d2863588fbac05e78978839def2fe3b02b9319403569c53631d95ba8f21b5d37a30d9dbdc98ad007b8dab0123a4
SSDEEP 96:2PRp0LWRp2JJNBdwNNNNNNNNNNjr8934hKqnHV5zTRpP8Nkg9pRE4a+eeRp1aCcY:2OYNKqv1dCt23UIE3USyrjnyEmqUxOpw
TLSH
T11B92EA436A00C5E3D8A76B71CE5B0B163B72D7E6C754634B44DCD1304F937CA2E99A8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888ab.rbs

Path C:\Config.Msi\e5888ab.rbs
Size 19KB
SHA256 b371e3ece48dec70c7a0d0d3e2128d967df8c3c9816bab105507ebf343f16a3f
MD5 37391afc27b20169ca11056fc6c4bd8c
SHA1 2b9bdc8ed8a793f1b98788f011c1f5f14931d33a
SHA512 803662d964f3aa82edc2302915de23c938346e200e07ae537d00e72a0d6333316c9f34ca75f9847216f5e1106812145a3a59ba52c5a2c8306d15e6cb981f7c5b
SSDEEP 384:2MR+gmiMawmn28I1S9HXVZFbLQPOseOdYy9e2Lmto3Bft:2Q+1iMawmn28IA9HXVZFbkPOse0Yy9eS
TLSH
T1AB92DC03B64499D3D8A62B70DD670BA57B32CBE59361434B40DC95388F933C62ED9A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888ba.rbs

Path C:\Config.Msi\e5888ba.rbs
Size 20KB
SHA256 147b13227ff8f734607099c7a34213f6f1afbae1cf40e5bc8a69217297e3740e
MD5 2dbe65ad21ae257a6a881424e40aaaa4
SHA1 5da9a797602f5c8cee23dea24378a7e5891a3b09
SHA512 c450247406709c178433850245435ef5ad2069523445f81331dae1f96857aa8af9e9b5a997249e38c74233362641701d24b281aba3d411a88c7fb85b64bb9ee3
SSDEEP 192:thmBtwUk0Ve2SD4QsUh+HRrMSCx2gUIlgU5uDhLW5LsUErLrS7aOpsH:thSVk0Ve2SD4QsUh+xLglghlKQfS7G
TLSH
T1A292A9427A00DA92D8B62B30CD971B293372D3DAD751534B01DCC1744F837CAAF9AA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888bf.rbs

Path C:\Config.Msi\e5888bf.rbs
Size 1.1MB
SHA256 ba6c17399d797256026e4c01a3bcacbcef41e496479f6c42f0c268ca71426a79
MD5 c065278e074bb9814e9f3880db6b1597
SHA1 ebc3da144d9551210f313ef7f789e162d516b08c
SHA512 053eafcc6113331e2cd26d0b88146f179afea65b45c8c6e855595d49eaf04c0f4eb974e3e5487e5267346a50d5256719d3c02a93cf29d0e3d0a017fbb90544fc
SSDEEP 24576:ABcQDe3eVbfVhwXDpUpPIhwXDpUpPChwXDpUpPthwXDpUpP3:3uVRhwNUxIhwNUxChwNUxthwNUx3
TLSH
T1CB35074173E44175E5F7AA34D9F24A16BB73B8525B34D3CF0254862D0E72BC0AE7AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888c0.rbf

Path C:\Config.Msi\e5888c0.rbf
Size 44KB
SHA256 b9ffa79403a9c57e5a36d6632bf8ebf8da0f6256c0b71fe4dba50390df17702e
MD5 bc959a160882b0de0583047b1b5b93a6
SHA1 78bda837a0fcc25623b54e95f3eff76c3bd79332
SHA512 7cd370afe9903daf36543a2d57ffc869f2ab324fc4ef363119d4923eb3b6079485d6f1a0304b94b928aace18900d034d74ffa0d1cf8382301f6e22f4daf4f0cd
SSDEEP 384:sA4dzYZj6Tt3jmpuXkGtrfK76lNWg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+7n3n:sHK6TtMGgpFiJi3SYDw
TLSH
T11013541C97E70712F2B34A719AF150C24ABEBD03BEE6E77F9B45030944616884992FF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888c1.rbf

Path C:\Config.Msi\e5888c1.rbf
Size 41KB
SHA256 4256104f1e0eb69836f00b38813ae62f79abed1724e0b07f8aca908e7bb74806
MD5 91ceea551937cb5da627f33ef7995ee8
SHA1 4e7483605c4027381e4796345f0a0e6aa9342a5b
SHA512 2d720c8a331278707913fc064d7a0c2727ef13b3f8cd46aa4e4a2936aab2b1228d78c1662856739964a87a33c312be2d3f65170f38d65545f3a3184c0ad635f9
SSDEEP 384:XKBk39BmxOVst4SCtrpuXYa1pbr/0K7yKKJ9Yu6dnPU3SERztmCJMadMardz/Jiq:XKGfZs5CZqljU6rqnuqzeEfViIF
TLSH
T1FC13B529D3F84712D2F74BB16CF1A4835936FA539EB8DB5C149A530A48133D84E62F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888c2.rbf

Path C:\Config.Msi\e5888c2.rbf
Size 76KB
SHA256 972595aefda400197282647fa6d6e40b58ac15591443213682a87d1ac80cb867
MD5 7173d17aa9ff4cda07fbfff21a584a67
SHA1 37b04626e282aa6ae2a2dc96117dfc5b0b1f25cc
SHA512 b583058ce0a7bac48042d63142342a430701f96bb8c8c0f00e2bdb168cf431e2f98a58bcb889623f6e6775195a9d4bae8f37686a48a2cd0034e426d6089a4167
SSDEEP 768:MTcr9yq2UX/RPLYyODdyoSNjSvYomC+L8XW/FuhyINGLTGnBEPzfsTKJzePDFiJg:9dVV8XW/FipNGfGBEPz0ceceimOU
TLSH
T1AD7385189BFD0722F2B30B71EEB684C15E7FBE277912D61F5508414E2491FA488E2B76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888c3.rbf

Path C:\Config.Msi\e5888c3.rbf
Size 35KB
SHA256 06afbd06123031d3198a25ed0cbb7cfb08c1184cb58ecd7d12f42c235ebb5b39
MD5 da7787ae5278031ef79441d29599dcff
SHA1 4e2a4c70035808dd8bffaeb6ded8fe2980566e0f
SHA512 2c1ac894e778aea4515be33b9e894f89a527a5106734a8ea6d6693557aff8417a7f7b340834dd1d207e85e250e718c1d0365332e77ffece2f9e1e81b0082bd7e
SSDEEP 384:neght+fMtSM9jmxa1CFbfKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+3hW8zNWZQ:egX+EtkqR6rqnGHKoVijm
TLSH
T181F29529D7F84712E2F347B1ACF684836976FA13AE78DB5C14C6534948137844A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888c4.rbf

Path C:\Config.Msi\e5888c4.rbf
Size 35KB
SHA256 b36b011818770bafe044bd83826f38eb81093f529872a0b83e341f6863b3cfaa
MD5 86a1d818b679edbe94ab51b963ba79a1
SHA1 2b9ee6b54aa2f709442e7e514335e2548c933318
SHA512 ee1ee27bc740b4e4e29a11f4a428b5ccf7ef545444db972b64a8f4b7884462b8c589b5911d7d33e3f2a7b0d97dcea0b5d610a99a00b04d8b3099e695f9acf5b9
SSDEEP 384:6kQOJrYa7mdessomj5R/yeizfa19xrwKJ9Yu6dnPU3SERztmCJMadMardz/JikPg:tQOVYoxVUqzD6rqnz7AWpLrFVieG
TLSH
T1E2F2C628C3FC8326EAB34B70E9F594876937F513AE76C7AC1499530D08227944523B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888c5.rbf

Path C:\Config.Msi\e5888c5.rbf
Size 21KB
SHA256 0ef563502d57298ab0962de24692931a32327fc1338cbd80b6b0b2cab067c956
MD5 6083b2909a6c1ab52ce84da1b435e7cf
SHA1 e851ccddf1fcb0c2fd9cfb4a357f72633452f240
SHA512 53b8aad68d574e57f88fb3663b41455859b2c84ddbd152aa1f0973df15ad1ea1e72b57b54a0984ff8e4abbd1e4606833fb2e132d1d49d428f2e0ea4e7c4568f1
SSDEEP 384:WK2RrrOcCdqEGSGEg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+cZhP8W4XYW:TurKjgEnGEFiJrvPA
TLSH
T1C6A22628D3F85721F2F34B70ADF284839973B913AE79D76D2586030D0866A449963F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888c6.rbf

Path C:\Config.Msi\e5888c6.rbf
Size 24KB
SHA256 4f9a3c48edbef17a0984c473d0d100e5541a26a92ed4ca3b336974c5eaabb4eb
MD5 d87310699e3baac5ecc0f64673fe3485
SHA1 34460b0eb74977b98d9d3e683d5ffa2aec11059c
SHA512 096196d3ff876b7cc5173e0d30125174e6fd1bb60432aa9cf64c3b22fd5ed2fa5a8bf35824e5840ab248b1015907eea0eddd964b4191f52454b03edf583e0b38
SSDEEP 384:CZp0wdaXOa1FOKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+81LUWIYj3gWUXRm05:Cz0Ka+qb6rqnDnOVi+t+8
TLSH
T152B22428D3F85312E2F38BB1DDF58487A976BA53AE35C79C2596134D08227844963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888c7.rbf

Path C:\Config.Msi\e5888c7.rbf
Size 280KB
SHA256 a991c7d6fd80ce581f8bbeb7268032f06c9434cfa67298b0669c84d38be6535b
MD5 a3ae8e892e025e479978fb07fb449784
SHA1 71a1641ffb0da859af5e355c5bf4a9bcf1746e74
SHA512 e39d58dc26f8710006fefb51cfe1adb34c8886b6b281a8ea3d87a89c116e255d39c028cc42fce05a8ed61dc0a7c602e344e6c0957bc4156f9a76677687591a54
SSDEEP 6144:Z/0op4WYV7/m3o5777376V7777U77aPsNKIXaXce7mNTp8HWwR/JBMm0CthHvd:+777376V7777U77aPMKIXaXce7mNTp8Z
TLSH
T19A54F8A6A2E84F22D3FE037920F1554B09F1EC17D64EFB4B684082F56C1B7A09A63D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888c8.rbf

Path C:\Config.Msi\e5888c8.rbf
Size 108KB
SHA256 6e18c01cb3fd1b795c062a00d2921e8e0eee8efd89fa77d50c5e16f2b7ce74b6
MD5 1c8e5ef9f86430fbda800e45c0a89aa5
SHA1 4e18ee249a208dbf7d7b52d412fa0d402fd3ff2a
SHA512 721f29dfd9beed272cbe213eadaba62aa1e1979828b23a226cb05eec536ac495eb33a01da05de82a23113a6d0ad4012032f453339499db3816abfecdecf19b66
SSDEEP 1536:64OjG3HW1g/e6TLw8PW/quND/OOw6XSq/KGTEEFBtU+IN7cqKQns:6rjoi6vdu0Ow6tKGfU+IN93s
TLSH
T1D2B31A1093FC4721E6F70BB57DF6A0418673F9229EA3D31D1959060E1826F948EA2B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888c9.rbf

Path C:\Config.Msi\e5888c9.rbf
Size 152KB
SHA256 a203989e4399f9443a8848486292dcf04d7c7180dc7d1b4af07030cb0532e036
MD5 6742f826c21773c933fc2a68ceecb99b
SHA1 dc689d3fb31e7cab6a33cd2192d6114542173514
SHA512 4138836bf9561104facb88c175d9a1d29863110b7e0108149cc0ff32edddbd30ee1b0ba4b7ee8137ffe36c973aa2901f7c23a3dafc79a26b09a64a8b95b6db9a
SSDEEP 3072:Z0anyn/CiBk6HOIz42IJqFF/0/WAWwerjeVPt:Hn+Va4k
TLSH
T12CE3295A63EC0716F6FB0731A8FA54416EBAF8032966CB5C2C4E45DE05B1B908673B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888ca.rbf

Path C:\Config.Msi\e5888ca.rbf
Size 140KB
SHA256 35cd20b4567788e3229be61becd6ea1eb115a2b81bfacf3d65d81d0003ecb96a
MD5 cad14a2ced4a556139097c1f716eae70
SHA1 9552115b645c17165bacc2231725b3f8073105a3
SHA512 df629a07c217880f174d52772090d49a5e88b73c0df45fccb714cd6ac4c01612e0aa755a1a0b9ba6c2a7a6701e6e94653e71a54c97a1076b7a5bde99d7f0c331
SSDEEP 3072:wAyIIXB6eUAnH0gUYwlIVkGw5Ll0k+5bcj:wrIMFRuf
TLSH
T1FAE3281963E81B1BF2F70734E8FB00824BBAB9077967D71F694E41CE05A1B844662B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888cb.rbf

Path C:\Config.Msi\e5888cb.rbf
Size 189KB
SHA256 f48f267a6e081809bd5ae607aa649529849a6541ca303a5653f6515d865a6b57
MD5 1f50737bb92b1f71b15824a0f113d3f9
SHA1 4d78793ea921986d011a024b91ac59d6c02de6e0
SHA512 89e6be6df11dd02896382a7cc9ee41ce74d5bbf845722531ff9a26fd2cb1a016925ea7d4948a4a652c079dafd084538b9b74c4a5dc0bfdd3cb2f0293796481f4
SSDEEP 3072:Lcs+QnXsia21rUBJeImxRGluQriZy+GZ7X/kMIJo:LcsrRIHiYYK
TLSH
T1CA14192467FC1B11F2FB4B7AEDB5A0019A76FE662D13D31D15A0419E1872B40CAB2B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888cc.rbf

Path C:\Config.Msi\e5888cc.rbf
Size 76KB
SHA256 dff2dd57e4892ce613b160c935e2d0215d3357edb7791ceaaf880b5995c98361
MD5 d68368708be2b6dac797743e23dbf655
SHA1 e843b858d72359ecf6fcdfca328ed19a7f23210b
SHA512 2542ce485c0c630b09be44a4faa841a3ebf2e1b7bd794e0b3fda4e866d97361b014eb3895c70c6b7acee4e29dcfd46b76697a1602666d1febf9cfa62988ea86e
SSDEEP 768:nI/327083Js1D8z1bKta9mqfVD20avQwiubnW2yCzT/8yA:nI/320UJsbta0qhRwfLyCzj8yA
TLSH
T17973F700BBBD4BA9D1FA0B7AA8B990109471FE557813CA1E0E94B14E54F2F90CEB1777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888cd.rbf

Path C:\Config.Msi\e5888cd.rbf
Size 428KB
SHA256 13f36534cf603cd722ac9078e51930cba190395d23d6688b65a8c788262759e5
MD5 9e877ffed2e2c9a013c59581f88786b5
SHA1 d3bbb3e2c36520ec267463916d3356bf4fcd8037
SHA512 5b4ff6de141bf2dc321dfa05fe8c93f64ca91eae6b41041264736c3c6db9d0520c135103873c5f32a47c742fb51317b3303e7656cd259331113f9b876ad17613
SSDEEP 6144:7Nu/UTUZ5+Io0NuaoBR1KGc89rBEXkKNymKfgkLkzArpMaK0I33I+p89GP5AWMJP:Zu/UT4HQ+hpxK1/
TLSH
T1CE94E71023A88E2ACECB0275E45BC6158674DB0A76ADEF5F5DF5E2AC2CC27924D43173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888ce.rbf

Path C:\Config.Msi\e5888ce.rbf
Size 292KB
SHA256 d0b2520c660959e388b3b24b1ebb7a6eca25dde878b0c0ce798657ae422a9c3c
MD5 bc9a83d77cae33f9eb9bd538ab65b2a1
SHA1 363fe5bb344cf1843d5f7eb2b0a725ac491ad6d8
SHA512 37ac66723c5bb78e45df3ae7175b497353343aec2eb5412213e3c6a1f3558e9cd68479728644643faac97c34ec3f3c43b7d01bb36b1e406613cb46ae4cef1c57
SSDEEP 6144:2/3++m0QBrwOMPL8R60SxaS7Qa9CngvwCzD5OnOB3Uxo9GdwFCRcfgc9/w7GvAfM:2/3++m0QBrwOMPL8R60SxaS7Qa9CngvZ
TLSH
T18B54F816277C4A2FDA6B0674F5B2067106B9EB077392EB6F9961C2AC1EC37408D03677
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888cf.rbf

Path C:\Config.Msi\e5888cf.rbf
Size 128KB
SHA256 c778577e39211753844d5fcd2267464c043cea271c1477e866d40c9cbdbe49ef
MD5 c7fc5f01de9577403a1ea8aafad79e72
SHA1 6422fa355184394ace02c0ba88e5b8af3db7fa6c
SHA512 b7af7af4aa1dbe92000722bad422af6d54c842af065427e1cf82f61b1a0f82e71f2a2c9b4b12d1642205dc54ca23ecd4ac61c8015076389907914b0cecd04e87
SSDEEP 3072:HEmV8EKUaX1IrJeE+6pwluGCulHxTqo+Ue:HEm5azUaxW
TLSH
T126D31A01B7FD372AF2FB0B79A9F96001C97AFC556A26D78D1851424E04B5F808A72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888d0.rbf

Path C:\Config.Msi\e5888d0.rbf
Size 92KB
SHA256 6e6afa2d6e7c46b9c64406efaf23bfdd3f7fd7a25cb757580f70730f4096ddb5
MD5 535d9d8441e0e22aa3f407c7197f8a0f
SHA1 ec6d047e975c107a7ecdf78bf352a5a68f53392f
SHA512 f5e051ef6af191d86797a55dcd114ae920f8a285191f3f09c3493497d381f9ec70921d712c93280b3c8e82fefa77c040cf51e8af3a1e52b040a7fd442d9ee95e
SSDEEP 1536:KJr/e6TLw8PW/lTqUJBS0zxRiY+Xmh8GTEEFBtGQglqKA016:KJi6vPUL7zxwXmh8Gf99XZ
TLSH
T1CA93E82493FC4F61E6F71B742DF6A1814A72F9625EA2DB1F102D410E1D23B948972B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888d1.rbf

Path C:\Config.Msi\e5888d1.rbf
Size 356KB
SHA256 8186f5e641a5b0770b635814b5cec2a5dff43158918bc1174edb328194b27090
MD5 5e1a793d9615d4d9e153ee416abc83ad
SHA1 27d231f4d1e2b473f9695daa21b22804db779826
SHA512 f54e786f2fab5324ce87be1d84ae69f63afa4ff5399e00248451375d2a56b5a0d30c74b27e5fd56b06976ec62688b09dfa39c4a1a02d47c3aa92da21b5e95876
SSDEEP 3072:JBijFKiOKL/u3RW1NvAbugFh/jLqthte2Seh6GVa5DU91Tp01sq9kAaCXrmRKHpH:jIZrvgQKA91TnAa+tPvH
TLSH
T1B774C62073F95208E6B70B30AC7651C51A77BE67BE15C62F2449324D6A72B938B23773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888d2.rbf

Path C:\Config.Msi\e5888d2.rbf
Size 352KB
SHA256 8da3b816828229f66334565432f12973529f0d594b685c919b753cf2f692b296
MD5 03898441f5d9a8809c04fe746fd498b3
SHA1 35cfba8e3600bd0a3389e96dd56ecd8efbf5ffc6
SHA512 dc2c0f6c8d4985770535962ad31e55c13abe248363c12cf55a14bf1fe9dbbb78a2c91eefd9a4711beb53606202b1c2d5648971339c4edb9a61dd271b61416b12
SSDEEP 3072:DAUe9MSVBYRApDFen6PZhls5unXIYAH+OguqlRUGl0bbuMe37LfZ+QT/xK6ur6Ex:DAikDFsY3IYU+uojT/xK6ur6EaPef
TLSH
T1D174C624A6F95B65E2E70730ECF904D6D676BE03BF2AD34F1512610E1871B819A63F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888d3.rbf

Path C:\Config.Msi\e5888d3.rbf
Size 82KB
SHA256 33fc291a41f38880549e72b23ec4598cb7404259a93775f59bf2be17f798a69a
MD5 f148286b321ed09c2d17e9e3637c807b
SHA1 b0928429f52028b512dad9c7e0996ee7ade315d3
SHA512 d175430df339ae9b0f46d00aac752697f95ced9f7407b2d15505645bce313536c065ccfe2260787d4f387ad548f02a94457e662c32174f36ee97a76fa8e59f0b
SSDEEP 1536:mkrEteCiTny7jWHfpSEZRwsexZG0YUBXfqiGi79WShdMUVV:mk3gCbzexZG0YUBXfqidZhdM4V
TLSH
T155836B17A3EC4B13D3F64630A8F09A03AA71FAC37566D79B30466769089B3D44E32B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888d4.rbf

Path C:\Config.Msi\e5888d4.rbf
Size 41KB
SHA256 27864727360196540664a55e1808db79f07303949156f843f0520106ebe047db
MD5 e3c8239a97601bb203b9e9037eed89c2
SHA1 75f0e5f417477d4c491e8ad81f498faf761618a1
SHA512 71304187ca95a404d6d175d40be1dcf40d1744c644412e702a25fe7e9745977e3f826d7a9ba1f694c3da4382e8f97fcf41ec8dfdf40240dabee932619e26e7f2
SSDEEP 768:Jc1JB9Xaefxf2ZquXoQGaHQ6rqnig3qTVi:O1JHXtp+ZquHHwig6TV
TLSH
T1FC13D72493F80323E6F347B09DF194839A37B953AE25DB9D1099574D0812BC5CE62F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888d5.rbf

Path C:\Config.Msi\e5888d5.rbf
Size 76KB
SHA256 e9cb0016e439bab9d34038b15798cd9261640dec8c577a0035314de5d7892457
MD5 219c69df0c23fdaf84e4c9ea2835a628
SHA1 d3b091bfcaa8506d299cb1d7453fdce7fb27dafe
SHA512 e209df73a2dccfbc349657925ba9760dc2ea9b52e696f5159bbf3c729e768ebf43a1e6e86a28bf6b023dfc78fd217f03648513479956bfffcd4da04d1cadf8e8
SSDEEP 1536:SdbojRaLEJ2tF0Hdlyw7GL1w1IcT7TXLqdqCOHN2gxyVu8:4YR63P8dlNGu1IcT7TXLqbgx69
TLSH
T1B373291193F88327C6FE43B564F0A8125FB9F653BEB6E71D0885939A48537C08D52B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888d6.rbf

Path C:\Config.Msi\e5888d6.rbf
Size 80KB
SHA256 5a35e93da45d610cebbdc4980e7a33b3d094039a49823561c8a3fb87e88f747d
MD5 75e8bc00ad7da1e7628f146dc33cc83a
SHA1 b140b32eeb3cb2223efc7c92346e3c4ecf65eb7e
SHA512 b80522f835414b493c97715823902443088bd33c7e54a5fda665d73de7899df5e59c44aafdde33ffc9d71dc7c48036cee050dfdd87a24c29a9fff8ac1253acd3
SSDEEP 1536:4Uy56bAm4HNNN5AU+QO2TFvKe/elIQcmEtli/G//ZgUKtmOo:Iu4HNNNmdy9EUIG/qlY1
TLSH
T1B8831A1993EA4B13D2FA0B7898F154C24BBAF5037DB6E72F9A46124E04933C44962F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888d7.rbf

Path C:\Config.Msi\e5888d7.rbf
Size 48KB
SHA256 e95e6d348912c8bec21b006ba6ef77e52fe74287debea2864180c0511e68766f
MD5 775dac5f81248b14182c82013672c42e
SHA1 cef7bba712b25da04f60f597cb614c7e4b87f24e
SHA512 2d99dd61a4ede26a11e6f4c3569732c47911605543e7a72b0298ad25e0a573ba884bdd5719cb8b7cfae43b25f41ccb764c8a233d978346bd49bee1104e7cc97c
SSDEEP 384:Qeg/3V8jOAfSr7CgWzwL4/7y24p4kwo6972IbL8J717lw2Ghr49gpWg67KGhJSxl:V6l8HKAMs/+24E7r8LVGUFiJzFDQ
TLSH
T15323321C9BE75323F1B64A71EEF145C24EBDB803B9A6A73FDB451608089368844D2F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888d8.rbf

Path C:\Config.Msi\e5888d8.rbf
Size 24KB
SHA256 db47a4a99dc0cb5f558891ff552f75053122d04f4e4a2ff6165734cd456a0236
MD5 2a9b706d83be29f32a28f29be397e533
SHA1 31135de80dd7b7c4a27516806fbbb13d871548d9
SHA512 cee9cf2576729b34f1352f63d9684695bd491586d31d3b3e81b11f2136b3843d513dbf59280b5aaa63b1cf085f0840040abcdd9d3d72dc15103987b2ad812e64
SSDEEP 384:w3K6a/IZa1nKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+CmWbzpWZDzDm0GftpB/:w33qA6rqnLPAVip
TLSH
T1ABB20428D3F85312E2B38BB09DF5C487A977BA53AE39D79C1496134D08267C44963B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888d9.rbf

Path C:\Config.Msi\e5888d9.rbf
Size 36KB
SHA256 f2742a96cb0a290ab71e316c086db449e6262a4614c70956f69165df8f9a0d3b
MD5 bd3e2c28c647533a057b5cdf8bff2c5f
SHA1 d36c80e460c5dde615ab1c268bd89309225ecb82
SHA512 14aba74084828f9710a1880d8ab55d7c76532d90ef6c9b8b5aa4cf7c67cbae1892b909b35e9239afba181a09f5bb59bf2607862d16330cae09fdcee0248a18cc
SSDEEP 384:NQK7QQZbXvJ5qCmIG7g67KGhJSxUCR1rgCPKabK8tBX5PKytZ+G6reVxW8H7W:JbxjG7FiJH6a1
TLSH
T103F2AF1C8AE70652F1B24F70DAF140C25EBEBC137DA6676FDB4607090C65A488D92FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888da.rbf

Path C:\Config.Msi\e5888da.rbf
Size 52KB
SHA256 9b151503214ef428ece37af31d3d8345f1dc27fd26d17b59c52b718e8fd08bc4
MD5 63a1e9cde10490008ba7ef47a12179d1
SHA1 5299af182b7cf08f95fcb3815149d7c54e73187d
SHA512 dc4074fd0614212d54dad0370bb99d53dbf9078cd3d4981d96f5ecebe36c82df0406cb2c232d07a1928a1ddddef74d832db3e7f479d5d3c1292481143c382efe
SSDEEP 1536:oy8H8QhPyUv8whq+927kgF1fGguNnJKIZ6:fZT1fGfnJrU
TLSH
T10F33C81897EA4722D3F70B7198F245C24EB5F803BA77E79F0A4853491C52B848D92B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888db.rbf

Path C:\Config.Msi\e5888db.rbf
Size 36KB
SHA256 19e5e00b55a8b1fc36c33d0d4bd0fba24a03a0959e91f3ab59acb353fed9677b
MD5 7a016cec8851a57b2f0376ae6d1fc837
SHA1 f161f9d8d7b073c1f17f55719c37124969bd7d2a
SHA512 f646fcd298b7a5d7b451219544ede8dc7e09aa3ea6f9a4256d336373d63b475281020ac70e5e08024e2dd8b8c886ff8607ae3139ada650eb8a6293aa0a141456
SSDEEP 384:Q5Qndl5IG9g67KGhJSxUCR1rgCPKabK8tBX5PKytZ+GwE/778UWj3CW:eG9FiJHF/cJ
TLSH
T187F2BC1C8AE70752F1B24B70DAF140C25EBDBD13BDA6A76FDB4507080C65A488D92FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888dc.rbf

Path C:\Config.Msi\e5888dc.rbf
Size 64KB
SHA256 0ee427eaedbcd82bd07674c9793435443c5b1c0780092909cf791198f0ad85e7
MD5 4d4774a30da56119888490cdf3157b09
SHA1 360221725daa9b7a14460fe6939d54b2173fb8d1
SHA512 eca13baee14a633c3a193df85c28eb797c18063977cea410d6ca41d0aca87379d04e6d2850a032ae5264e536863186e96eb9dc8baf1440517d69e33d4de73130
SSDEEP 1536:9pvk2mCtNGNMGfRfESSgOX55uKG/SmawWQie:XkEGfR8SSgOX55uKG/SmaTE
TLSH
T10353B508C3AD8322E3F607316DF186825E71F5437A39EFBE0946375508AB7C46562BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888dd.rbf

Path C:\Config.Msi\e5888dd.rbf
Size 62KB
SHA256 c323b9ebba3aabb01111f281f604ec0555c6030134ca18422ac7f6c73721d9c1
MD5 9002a577c07ab2b99979435cd8b67acd
SHA1 5b3c6231c113b726ddd55fd8a8e3ae84b1526820
SHA512 f4e066679e9c34cb44cb459ba178fd43ef2e600f94f86ded21af1583f182050178a57271f2a15967c2caa87fb6eea1f5409edcb87b95775245db45af6506bb47
SSDEEP 768:mdgc7HHzMKqYyb6FZZ3JEMTt924zM8X79qZI336rqnbsWraHngVinE2:fc7HHzMKpyGZ3Jr249XJqZqtbkAVQR
TLSH
T1E2530814D3F88723C2FB87B568F148839A76F743ADB9DB5C1486532A04577C48A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888de.rbf

Path C:\Config.Msi\e5888de.rbf
Size 61KB
SHA256 241e01940f6f128aecc75d21f148468eccc2d368883f0f5a869fb7f58f57e5ec
MD5 218e31b07c6e07633a84f0248730e220
SHA1 47ee36529b741f3d52c487e6dad151f516c2eb5a
SHA512 e0481b2a424da192bd9ae9728a89f7c1496e887f198150016ed262b924b1634b414613bb80b969effadb3e34a108992768102f48da7a41ea87b9f2a459a2ddd0
SSDEEP 1536:ran8MPqcyyaZM+TeVCB5+G9cTvdQc1bqMsNjNPBDWGVb:NMPG7wqhDW+b
TLSH
T151532918D3F84323D6FF87B8B9F195435A36F843AE62CBAD188A538905533D44913B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888df.rbf

Path C:\Config.Msi\e5888df.rbf
Size 81KB
SHA256 ea82d8bd8289e5892cad2443c1d586c0a311ddee52a8fda0f75072ef2317b650
MD5 93030b5af327ece3ddc3518410e1af59
SHA1 4be27729a906169d2afcf025e10f308fce35056c
SHA512 247e2d5e63e6bb12dd826e452ce7a1e086152a170e7f15c0d7794a1588838c2b6dd4038f07dac42844356795b72b5aa357e01039e419c6c5d90b05ebfd74da4d
SSDEEP 768:PVQ+jyq2UX/RPLYyODdyoSNjSvYomC+L8XW/By/g6I+wVtB4dmg1ZqnBEPzmhK7x:S4VV8XW/Og9NCJ7qBEPzmW2yZAW7KVg
TLSH
T1E6830955C7FC4726D6B74B70F9F78446A633F967AE23C78D1408824E2851BA484E273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888e0.rbf

Path C:\Config.Msi\e5888e0.rbf
Size 200KB
SHA256 ec383c0455491bdcab4a1e8692359543d96f82ad73602c171734ae8ce45449e8
MD5 c30dfa5fbf9f2e6d18ceb7108923fdfc
SHA1 523c4b9043cd6d722c01215f64173b9287623d76
SHA512 075b726d3e37d9ba15db1aaca781502aff97b90dc6a80c4e1be20368dd1c9df13160b9d8bce09bfe467b406f7d0b698c6ace6aee5b0bf4149e4508d9ed74cab2
SSDEEP 3072:20ZVVxFlfJ57iPki4i14IBkb2/Demjzk27wxqWSDsKnFp6/M/CP15rFJgStL+L:t5Pu4M4IulbK3C6
TLSH
T1D0144B1663FC4726F6BB0B35D8FB11026E7AF9172967DB1C2889068E0971B809973737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888e1.rbf

Path C:\Config.Msi\e5888e1.rbf
Size 197KB
SHA256 19e6ec40e9a239b3b208eb3f7874a76e12adbfc8b865f43452296df66a14e501
MD5 fca2f9f00de26d0b5af4881836d6337a
SHA1 b11dcad7c00c2c85354b131c796ae34bbbefdb38
SHA512 7fae923c2a9c604991b172ac91e7e9e4298c01391940f23a190eb4bd3920c97af2476f1a4730cac350ddbd8956806e98870b46137b1711b224a6174c441af738
SSDEEP 3072:/rFKDbAtgNrfAw1bsO8YzN2HsBpmxRGlu6rirW+Y/43zNFk1C:/rFAoOXcHfIfiA+/
TLSH
T100142A14A7FD1B25F2FB4F79EDF6A0018A36FA262D23D71D15A0015E1876B40CA62B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888e2.rbf

Path C:\Config.Msi\e5888e2.rbf
Size 27KB
SHA256 db7364a16090f58ce23aeb0426b005b1d1a965307d7d4de117a553c190ba5d57
MD5 aa8ef0154efa83de1c2786ab1cb76f37
SHA1 5e4fcdf55c34538dfdda172a985731019f74898f
SHA512 17d3c193a516bf56ee6a28ef708b01c618d5a159d7c389be6f54579638e3d9c0a9a3add7dc6e19c6f0b63b235c53bbc186d92e77c60ddc297e2df8c612332bbd
SSDEEP 384:eZPbNawkFSvPSN4J3DztyJbDr3Zcv+qLrVAtJCl9F1WijgW1Qim0GftpBjF9ZE:eHaVFSvPSNEtyJvrpcB9qi/bfVizTE
TLSH
T170D21A00C7FC536BE9A70A717DE59981493BFF52AD23E21F4068C05E14E9BF48A66723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888e3.rbf

Path C:\Config.Msi\e5888e3.rbf
Size 15KB
SHA256 1db349e42e9c57afdefc29f18886a98290099b74210cb396ac5485247bcee099
MD5 62faa6fe395c5810fe4fceffcba62966
SHA1 ed830d3d1156c3a5ea6502148f4347af0c4a8051
SHA512 4e876c4afdce30b29275eda6ecbb14aaf56bdaef4a1951e6ad09bbe2af5a37667d18f4358c895843010336f467e0bac3a7f8449a907011124d4e374c7b0c1e54
SSDEEP 384:21LtwmrH+mFqmwW/zwWUQim0GftpBj6XY:21lFpGfViWY
TLSH
T1D572F905D3EF8EA3DC825D319DF187827A3CE7834D62DB2B4159D16A2C633E8C961B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888e4.rbf

Path C:\Config.Msi\e5888e4.rbf
Size 90KB
SHA256 ed9b46fd9f3275639988cb71eccb7c3f31b48282ed78e4abc9ae303cab219bf9
MD5 facce237d5cc5e89d8e92a36289f588b
SHA1 5b91fe97781b107df2754a5d38807a597f1d99a2
SHA512 f0363e0c7414157dabf929fa9c4b49b74d86a0997481b48d29ec3f0708221d9fc4954f4ba93f4299e9ef0c31d38dd8a691b908cc6557864c1a4baf3f448286f0
SSDEEP 768:F+nOfOpzCJztUjm2ElyGv/NIvS1SHhodPxAoiStZp4uXhblMB/e8CKMduoUZKP4d:yy+zGztUjm2oNIv5oiIZZz8C2D4RRVZO
TLSH
T15993F626E23684BDDCC9003C75983531A73CF3B78256A78719097DAA4DD3B8BC987B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888e5.rbf

Path C:\Config.Msi\e5888e5.rbf
Size 168KB
SHA256 1246532e2e335750fcdeb3c801f98eaca1ac6579d1bdcae1c5ca89f8b24fd879
MD5 d2d2a9e08ad2df5d73ca0aa0797cd96a
SHA1 f6050bc38d27c805daa078383506b93c5dd854c7
SHA512 197385ac8d349674675fb411cbd246b53b0860f8cbd47b79f6f05ebefda4563e75285cac2bef45ceb12cdfcd4b4d42c47050767608f96eaebc7111dbdbead1de
SSDEEP 3072:fWwMr8CSQ0dd5Xqp6J7OB6530Xgb3m61EC6r2vam7xBAZiruL2b:fnMr8CSQ09ap6Jy65Rm2vp
TLSH
T1CCF309C1AB0BE061DC89563C38AA7F056F3CFBD295D2AB0BC50DEDE42493784C64569A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888e6.rbf

Path C:\Config.Msi\e5888e6.rbf
Size 55KB
SHA256 89885cd48e706c533aeff66d45cfee67561db4708bef31367a546f685f30eb55
MD5 158f96bd130a9f3a1f7e91dc611e8b7d
SHA1 207264f61e8d8cd77c7dd82e7c8c38927bcdef85
SHA512 6ae9e17dddd7ae166fd195d202d73904bf6482d727f0a9d5cc01454d4a58f9da027acc9591dcfacafa039379bf151cb385ca4208ea70baf069516ff98fd31d4a
SSDEEP 768:+RXrTM8QOkqNHEJLgp9DItLnKDiQ0fWS24hbxocNAwkEGjhl2BOBaBnD/sxFsNTl:ZSk2HQq9D2bPeVqv
TLSH
T19043A342D21A96D6CC55A5342A70FB52E63EF3FB1BE1B65F8813CCF408A3250E945F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888e7.rbf

Path C:\Config.Msi\e5888e7.rbf
Size 139KB
SHA256 38f422c1c5751cf6796c44fec1c478a2a5379ddb6f3512004f1fcedad3b35cd5
MD5 32f2ac5f45b93b733cab1865affd588d
SHA1 5062e6d2a8c1e06e19c9f0b29164915286ece618
SHA512 8384c6aef7c32ac0f10aad8490d82b1553c3d194dd3f7821bbe2c75eb50a6e5ece195be6c09615f273d3d4935163c15d1c83e7bc4ef45fd1113a9f0641ae0bf1
SSDEEP 3072:DrwVY+eaNZzPM8s08xsNj4SwAXK7Vs2gM2HO++rCo9D5:DrwBZWkge7Dur/n
TLSH
T1FDD33A91EA35C259CE84C47D3E21BB00DB3CF3D644C2AB9F4526FCE84A8B791C552E96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888e8.rbf

Path C:\Config.Msi\e5888e8.rbf
Size 351KB
SHA256 55758341c4094ac4cbf26712f45f1ed17fc1f570197538ac2267bd896a9f854e
MD5 18a9dd94b5112ea94f3fc9fc22ff8409
SHA1 97a0b82343ef1599e517946a2c3c259b61e53ca7
SHA512 7bac448be18324efd337c7cffbae2c6db763d9d7450e70dd33b214981266008b7e4d0a895c7fd214d908b3eecb9a7a0ac0aba1d57c9e1fdcee3f9e72c39de3f6
SSDEEP 6144:ENeM8oM6s8alZ+afj5OADOQ4pUE9wstZY:49QZ3j5JOQ4pUE9wst6
TLSH
T10274A415A3FE5761E2F30B34ACB40489DAB6FD479E6A974F2445A15E1C32F80C962F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888e9.rbf

Path C:\Config.Msi\e5888e9.rbf
Size 456KB
SHA256 a5a600ca8a60a0af629047ef8b227feba5221c5697f820da69e274f40869a6cc
MD5 54c12705dc6a32282762bbc4252e2b9b
SHA1 2d1fd38b5f3db7c7f0d7baee446a00099a506d50
SHA512 c4d96a8d8064ef917ddb98532360a8bf318535b310f908a384c0ca140ed058f5f3f24f34c3992da4399386f546381cbb1eef5432b3ff2b7c19e0491dec8d4aaf
SSDEEP 6144:I6g4wRumoEBSvGpDMCDC1AW4e+TF/AVaqmRQGtIhyjmDs3lNic8iV:I6jwRSvQh42RNjN6YV
TLSH
T124A42B12C279D33EC2AE833754A226155BA5B2EFBAF1EF53A013C5E82C537C09D41A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888ea.rbf

Path C:\Config.Msi\e5888ea.rbf
Size 137KB
SHA256 7acd536b7e7fbbf4578ce24aa39740279e7ffb7477bb77f6a2c7afbc12f16c83
MD5 9f735917c0bba0f42b40e719047eefd5
SHA1 d8c1ef036b9d841db86ffc76d9150064ee836cce
SHA512 65522b77519efd6d43f17848ecf65d4bfed8f07d9f4212dce7f6c905650b4107396e7067c62802c7c953b02f78e924560c8ff151e195c0cab37606be69270a3e
SSDEEP 1536:I2jLPfRUqxc0O/t4DErSu9e7EMaggaqRgDPRpTCWFVmI:I2fPJUqxy14DEF9e7D3gaqRKPDrfmI
TLSH
T120D30A00A3AA0B92D06155351FF2B942E63DFBA76AD5E75F5421CED80CB3B90CC22B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888eb.rbf

Path C:\Config.Msi\e5888eb.rbf
Size 334KB
SHA256 7150db5b3af392a250b79f1078c87848a08b6c13448943d5a0478c2d37645b85
MD5 4b15c6de8b0cbeb6d4d7d6e14b9ca7fa
SHA1 af3b589712be828302778a6e248ebd659fcdabfe
SHA512 1f68f55cb4c32d0abf929b3382d9b773369f376853912829299c6386648c39807c6242eba037bb3988ebecd0e8b7197c91583243154c569bef1f70d0d958c491
SSDEEP 3072:700ASicZpLom0Wy0iwsC+KHIVKbHWuFvUOLKZXXZF6jJfIMRFxtZYg7eyXgMly3C:jlRAWy0iDCyVMvUYKZ+JICHNyPOB9Y81
TLSH
T193741B154268C32BD5E8C235BDB136124BBDF293BEF39B2B612695A81CC37D0CC25997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888ec.rbf

Path C:\Config.Msi\e5888ec.rbf
Size 75KB
SHA256 b8361411d7b7b0094669b0f74ce8afb488cfad61e2c26f76473db9ddae702929
MD5 683fc126a13b915b3ff36735ea5ca5fc
SHA1 d1ccfdf78919f51b09fbde02c2cf0f332601bd74
SHA512 4d88cbe5c42815940595b1c7d466ec84a9e753977fa234591c0b14d2d826423c5bef13aaf93e4f3637a669c56e040da53529dbc31339f18b0587b0c1270c14d9
SSDEEP 1536:3skby0ayhkM+TeVCB5+G9cTvdQc1bqMsDvbmOpajgNiNYV64:3DbyihcwqHpa8N4864
TLSH
T1E073F718D7FA4FB3C2AA4378ACF1424256B5F402AB52CB6B18855F841D73B94CD13B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888ed.rbf

Path C:\Config.Msi\e5888ed.rbf
Size 389KB
SHA256 878566ee8a41806ee9b9c4cf590e1953881dde2127616a647fa31940a5096cc5
MD5 1a063e60707636e76e61ad9784bb1eea
SHA1 baf498bac402a29b1330fcd20cfbacbc5d245cf7
SHA512 39e2bcd04f4ee4e6280b7723a628acfbceef254fbea62833a34d7f4cba566c9556bfcfe2424ada027112a8b722da8349331ca416d00d0e3d6afbec96e3d91a65
SSDEEP 3072:2dxlMI0R4F60aGf0TX1zvAPuiFvVTLqtdte2Seh6mNfkGVq1XRQq7q9kAaKrVm29:nFva9GVq1XpAa+TcGR
TLSH
T1EC84F72073F94218E9B70B31ECB651C51B76BE67BE14CA2F2449315D6A72B52CB22373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5888ee.rbf

Path C:\Config.Msi\e5888ee.rbf
Size 131KB
SHA256 a1254966826e2849b1ba2d630e93ca7b75105c8d3acd9be795d625edf835ac0a
MD5 d8a76dfe6188e600bd7a8480dcedcbdb
SHA1 40080e226be118c2a0a8f9dd70879467ec09f198
SHA512 9a01c3290be7d309e23a6048731c541cd0c602669ace34779e1e69c29da154b378edf0cacfe92354996e293bad205c1bfaf6a003840cf53216100cd39bf6dd76
SSDEEP 1536:6fg4S0dRp1s8PW/OvAza4KFvQFa8xVsbtglOJzgP2wNmqgEEFBt9Aak/pKohxm3X:0N1zvAuFvVyV2sUz8mqc9AakhNhxm3Ss
TLSH
T1D0D3C41B93FC0269F2B70B71EDBE45CA5877BD566C21D25F044A368E10B2B809A72737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58890d.rbs

Path C:\Config.Msi\e58890d.rbs
Size 730KB
SHA256 83d314eb3880c18714b158b1dfe7b0a8d8ea27745be328e6b042ac4f867935cc
MD5 fa69e25e20b066695b319e92e21ec3c3
SHA1 e366adf22f0fa13ea15dcb8cf08f7394a1cd2737
SHA512 6661e35cdbcf58f5946c0ee6e35ab16342379641c05aa6e4ef5ce9da70e38e9be996b88f62542d880c6d29d5fc1fa22f7134b0cb73ffdecee4574c70140e3559
SSDEEP 6144:lo6drDjORLIKuRy6QK9/NMR389050RGEkGqv3DQkgRMP7SCIS27RI88/HnZrGpaH:OAyluAN89BycS5IEZysh7F
TLSH
T179F47342B14092D2D0DA1BB0C5A73F197F2BF6AA4AC2971F401CC1784C97BDDAD5EE86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

vc_red.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi
Size 232KB
SHA256 72a46f29c780949c1151efadd899806ee192b6fb4a87a9646d638df95f3a0bbf
MD5 824f1f188704d3de77660d90fea6b136
SHA1 9bcad1428defece9f2ceaf647d9571ca41b3f40e
SHA512 0e67e74d11d9423e5b8c95f35e66f173d051e5863466837c3f9a4cc2064d4e4e3e1213437c29374abe6a888f48280ac45da9befb8e90ee3bf111f695916cc972
SSDEEP 3072:55Sa1UNmUq59Zh3pe8lwAx9JHHpXhvq5J38J:55Sa2qr/HHpxva
TLSH
T1E7344C11B552C133D8853332406FDFA12AAC6EE79B52C58721E932DC6EB17D4D3792CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installer.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd
Size 28KB
SHA256 2524a822d83eb2c6fd94cb986586a8f96486f3ce18041ac559475deefef406b6
MD5 952d1684d29f0c3351adaea8eb0192ff
SHA1 ada48c2992be5e70ce3ef81bc1f9b5fc95708a4f
SHA512 1f3a07703d29da1cc9cf2933659d881f064008fa556d92d90b40169fd68a954ea15e0352ac5e6e6cc7e2cb7908e183ddb15ce0719b0a27d67361e05a34afe6bf
SSDEEP 768:ZaSz7KzGs+PFJE7ynC0u5Qn3RAL9iLbO0inwJz3/o9L/Y7xoXyEMdBE2SEAgEEc4:yL9iO0inwJz3/o9L/Y7xoXyEMdBE2SEv
TLSH
T1ADD292187D8C523579F0C3B6E33592C2FB6ED5A25B30E68C7CA6C8A0746B116907E3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filever.vbs

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\filever.vbs
Size 115B
SHA256 d4964554ef1fe0093b7c66e1285b1598bd9573df0b99f9a7e222d1fee448f860
MD5 c1aaed4e1791179d9cbcaccd4b544793
SHA1 71e365d700bcd1afbfb7a030692d891cce18eedb
SHA512 7c56da34bd514181ead79020547229a3fd01b3629807ff7acccaa2ab5ee747c58645c9ea1113ca7fa58b9d78de9f595010364c8abd2201eea48563fac303e11b
TLSH
T131B092006803C4A60B43069104AACA4BC7E992A53036E2001AD2C9C952077B819290B2
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 9165248996814b72f6a334750e65994b39f971267ffc95f759e529356fa3125c
MD5 ed14b64c94f543974b7fdc592fa0594b
SHA1 dc66ca3de44c021d89ebd5160c447aaedc565514
SHA512 5d20bedcfb8d2f603b3f27d874a9e0e3a7ca7df4809aab52b02af630c0037b37923536cc93c78c9deb014df28e378d16d67e99688f8b656e3e7bfd1e2e914dcc
SSDEEP 192:EFW+NhW76T71ojDBQABJdZqnajxcRGlP6ZqDPD:EFW+NhW77DBRJdZll7P6gzD
TLSH
T1AA42098357EC5903E5976E30A3F9EAC3BE3917C629202465455AF5A93CC73DAEF0062C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 4aea1cedd976ef15a47a3433f3a2e176b1c5e495a54497dba27247b35a1b8449
MD5 1908861649e67cdc20c563c234a89914
SHA1 471ae3b9a3b40e63c880362892865ecf8bd80f67
SHA512 dec24d5c3f31c90cbec3810290506309a1db5677022c600d3bdd2e92b73078dc6353023f2aeefa408aceac7c9f7ed5a2ff07a399b446e177ff93e5fa1b3f9353
SSDEEP 192:alUcyiW+NhWZT71ojDBQABJctYDqnajsl/cKfX:oDyiW+NhWCDBRJcyDlPKf
TLSH
T12062D64366E43F26E99F177221FED7D72A38574214A003B4C207E58C3882796BDA7D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 6a3fd4b050f19ec5c53c15544b1f1b1540ac84f6061c0ec353983eb891330fda
MD5 af851dfd0d9fecb76ff2b403f3c30f5b
SHA1 30f79fb4d4c91af847963c46882d095d1f42efbe
SHA512 04509b02115ec9b5bc4ee2f90e49e799ccf85884fe1f11f762f0614a96764b8f2b08f96895c467c5b11f20273183096b2bcceb0b769df9d65b56c378cb32b0f5
SSDEEP 192:+SW+NhWHT71ojDBQABJ/YkXqnajL1dHx3tKPDGbO:1W+NhWUDBRJ/YElXBtgEO
TLSH
T170422AC24BB85143E99B6D7052B8EB877E3CA7D66810012619AAF5993CC73C5EF11B2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 2def5140c289b89c9a27a2112a2cc01ad1a902944c597d6204bed4efbc09ff7a
MD5 0f143310fade4de116070a3917a79c18
SHA1 b9a092e885c73cb6d33c9e17d429ede950cf3a26
SHA512 f87104272aa2326641e46450a0333626567ab3fa85a89b81f7a7c0b1f90a47a70ea189ce3f6bf5db6bb5cccda6d190fb2276edeb44334245b210e7faca05fc60
SSDEEP 192:1M81nWlC0i5C84W+NhWCT71ojDBQABJibqnajMHxxBNT067L:1M81nWm5CfW+NhWzDBRJalI667L
TLSH
T16352198747E42D12EAA71F7221FCEBD73F3E6B8108524666801BE19839C63C17F1595E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 c4e195d297d163a49514847ef166da614499404d28bc9419e3e6a28a8e03e9b6
MD5 f97e7878a2b372291b1269d80327bbf6
SHA1 cee6f776fe0aa5a6d4854058f20f675253f48998
SHA512 475898e60ffc291362fda45ab710b9ddaf1cf5e82f66dfcc04998ded583c54692ecfcac6cc4fe21b32bdd0e4dce8ac32fd9aecca2b0b60f129415180350d7825
SSDEEP 192:lCY17aFBRgBW+NhWlT71ojDBQABJh+qnajMHxxBNT0677B:VPBW+NhW+DBRJh+lI667F
TLSH
T1524219C68ABC5943D9A36F7072E8EA8B3E3E67D128208557415BF19A3D433C1AF1062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 fe51064e0728d553d0f3e96967671f7e6ae4ebd35d821679292014dd4c3bb8e3
MD5 761ddd8669a661d57d9cf9c335949c06
SHA1 251bbcad15771d80492f1deb001491a7abb6c563
SHA512 5ad590a5f81532f8bf21fb4f62bc248e71bbf657dfb1720b2d9f1628033afe39426a1c27a89d9a06e50849bd0ed2242afa93e4cf2bc83f03a922b8204f0f4f2a
SSDEEP 192:1T9qW+NhWQxT71ojDBQABJbcFqnajLQvTP+8jgiG2W:1T9qW+NhWQqDBRJbQlvQyUgiG2W
TLSH
T1FD421A864AE81443E5926EB046F8FB877D3E77C2182548660557F9A93C833DDAF40B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-math-l1-1-0.dll
Size 20KB
SHA256 2e1664e05c238d529393162f23640a51def436279184d2e2c16cfbf92ab736c1
MD5 56556659c691dd043dbe24b0a195d64c
SHA1 117b9a201d1e8bb9e5fadeae808141d3fa41fb60
SHA512 a8d4c4a24e126c62b387120bae0edd5cbce6d33b026590ff7470d72eb171ffe62b8b2b01e745079c9a06cf1eb78a166707514715e17bbd512981792a1d2127e0
SSDEEP 384:WZVacWM4Oe59Ckb1hgmLEW+NhWvDBRJTell7P6g2:WZVJWMq59Bb1j0NS1Pae
TLSH
T1AC92D5474AD8FF67C18F17B711F08BCE6A381AA644E1B6B5C91BA0C934623C47E43A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-multibyte-l1-1-0.dll
Size 19KB
SHA256 c136e09decf068b5f33041753c6fe9d4af7429e00bdbd8d2cb8d2a4d503e755a
MD5 e9f6d776545843a9817d8acf38d06d09
SHA1 5277698e6c9c4fd3e16757d86e1669a5fc64a6f4
SHA512 d12ee6b7afe2823632602b48d257d702552e9b644d62c0d0ccbad9f298ad9e044266baa1cbffb656075d6b5317883bd1fa3b5c29fe25e132ed61c230d3007a4a
SSDEEP 384:1vF7vLPmIHJI6/CpG3t2G3t4odXLNW+NhWnDBRJJlI667K:1d/PmIHJI6zNW1Ps66O
TLSH
T107922E6F4EA82E11D58FD7F3B5F6C7C62A351F8004C073B5A66B95883805EE9BD42E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-private-l1-1-0.dll
Size 62KB
SHA256 892e89afe2c43dd5b274abe461cb650932e8cf8ded640bc7e8e2456d08800a59
MD5 653cb5df3cec6a4a0e402b33d8aa5c08
SHA1 feb8baf43eaabbaeea4291c5620cd7626aa76fe0
SHA512 e3e673ff7b20ff7389be3299722af73a79ef8ced4a59d6b8948c6b11374703fcae16818af64338e413db3fd53d25d1d153f2d987bef6135a365481aed0c3c228
SSDEEP 1536:DW2wDe5c4bFR2JyhcvxXWpD7d3334BkZn+P+NoPKu:DW2wDe5c4bFR2JyhcvxXWpD7d3334Bka
TLSH
T1B553E5DB49E63F21E18FF7B76BFB17C91B253A0408806274EAC7556B34853A9BC43A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 52cc325a4c2158b687c95f9702f4be2e3ec41c80207e50f252f5620ba1784649
MD5 6631c212f79350458589a5281374b38b
SHA1 88be6865aac123ffbdafec32a6fba34a26428875
SHA512 e53d7bfa2639efccdb66d37957972fd1f8eb2beea3a81145588ed622501ee50261e05a06611ee7126564b11a5301b109f295d062f1a2dc1e44a2847000fd7298
SSDEEP 192:1/aitIqjd7cW+NhWfT71ojDBQABJoeONqnajsl/cKfX:1SitIBW+NhWcDBRJSlPKP
TLSH
T1A342F8C78BB81957E6675E3041F8D7877F3B93C658108135886BF19E3D82396AF2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 8150a238851d7da74bc8f6f13262a8d6568373dc509f67544ab6a62398f20c4f
MD5 bbae7b5436d6d1b0fc967ff67e35415f
SHA1 f67bc165cefb119ad767b6bec27a1102c0fd2bac
SHA512 4201a8edfe303057545d04de683bbdf0acb68cf4d2e894192f899a70398df18299432c0f6caee72d917a986882bbc0585035a9b934d4579f67a1c98cc894dee2
SSDEEP 192:erMUnaPrpJhhf4AN5/KiaW+NhWRT71ojDBQABJ6qnaj9RlaHIxX:N42r7oW+NhWKDBRJ6lBR4HIx
TLSH
T10C72F98756FC3F63E9872F3322F9D7C71A366382152045798897E0C93882385FE5721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 de44561e4587c588bc140502fd6cd52e5955abeec63d415be38a6d03f35f808f
MD5 53e9526af1fdce39f799bfe9217397a8
SHA1 f4a7fbd2d9384873f708f1eeaeb041a3fbe2c144
SHA512 8167ee463506fe0e9d145cc4e0dc8a86f1837ae87bc9efe61632fb39ef996303e2f2a889b6b02ff4a201faf73f3e76e52b1b9af0263c6fcfdac9e6ea32b0859f
SSDEEP 192:1/rjrvIDmMSNuWYFxEpahysW+NhW8T71ojDBQABJ+qnaj9RlaHD:1j3vAmiFVhpW+NhWRDBRJ+lBR4HD
TLSH
T18882D68785EC3F02E28B8B732AFAFBDB1735438224107579C507E4943ACA3997E07559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 038b93e611704cc5b9f70a91ebf06e9db62ef40180ec536d9e5ab68eb4bb1333
MD5 eccf5973b80d771a79643732017cea9a
SHA1 e7a28aa17e81965ca2d43f906ed5ab51ac34ee7c
SHA512 b95f5efc083716cb9daba160b8fa7b94f80d93ab5de65a9fb0356c7fb32c0d45fe8d5d551e625a4d6d8e96b314bae2d38df58b457b6ced17a95d11f6f2f5370e
SSDEEP 384:jsx0C5yguNvZ5VQgx3SbwA7yMVIkFGlrW+NhWqDBRJD1HlI6674:m5yguNvZ5VQgx3SbwA71IkFKN71Pc66s
TLSH
T13382B34346F83F51CA8F5BB359FADBC72A384F5225401375C467A5CC38427A2BE6BA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 957177c4fe21ae182dfe3a2a13a1ff020f143048fc14499ae9856e523605083e
MD5 090dd0bb2bddee3eaae5b6ff15fae209
SHA1 ddc5ac01227970a4925a08f29ba65eb10344edb1
SHA512 2e0b8567231e320b2e52af3b86047cfab16824e2db1d1bb17bafe7a1c6c5f0bf62d76656206a3d7ef1d3849b479bf5e09db1f0f4e4cd0aa2df09838d35c877f3
SSDEEP 192:VuO/z7kzFDqpW+NhWTLT71ojDBQABJNqnajxcRGlP6Zq14:VPEzgW+NhWTYDBRJNll7P6gC
TLSH
T1C75218838AD4BA07E9EB1B7112FDD7DB7B3813C11A9020768257D4983683385FF16A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 e7ef5d714fc21dd1aa9db0c4eefe634463eefbd5aa4454a568bfc52e04fddf18
MD5 cc337898e64d9078cb697ac19f995c7f
SHA1 2ebcfa0cdf865fe40cbaf4ffce6d3903aea47e3c
SHA512 6960fa9617514ca223b9abda9a3a6c69cf05474b3c5fec2be6c6d5f65580c7a18e129b6d207f21eb136b0737481107e09c20b0398826284ce5f9a65a3cf8a1ca
SSDEEP 192:aBfHQduPW+NhWMT71ojDBQABJX+4qnaj9RlaH:aBfFW+NhWhDBRJX3lBR4H
TLSH
T126422AC60AA86943E69B2F7063E8E7837E3DA7C214308625056BF1993C477D2FF1162D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_9caaa3a5ed56b92c\ucrtbase.dll
Size 971KB
SHA256 24968e69daf49f58e812ada3e4cb24a66d6fb9ef14fc211538dd992b08ed1c3b
MD5 1eb17f650462eea820f4cd727d2d3ab1
SHA1 688f59160589ffa293502bffcd5c0e62e1993903
SHA512 4b2fd6f202d2c697d10e0a2751ec05128071c7a3f1296c9f41fdbf07b334d8eb48dad674d91150966e0ea925c8e2aeceff904bb3d055989de2e1f94dd7d4bf18
SSDEEP 24576:JdX8vuNxBoVnCBuwJBNMsSLvZCRX3fp8di8DmxvSZX0ypnB/:/+quw5pKZC9B8BB/
TLSH
T1AB259E79FB5C09AAC57BE07CC95B160AE5B63402437086CB03E64BB97E2BBD91637311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 5b679b8119bb5d53107c40c63df667baef62de75418c3e6b540fdbafcceddca6
MD5 8e534f49c77d787db69babff931a497a
SHA1 709380f53f4bee25ad110869ac4e755391346405
SHA512 49e293828c96f159e2311b231e13d7292b9397aa62586bd0289c713e541d9014d347cde07c8529df3402c40e8fe8a96ab72efcce9f731ba95eb416506efcdcea
SSDEEP 192:Ej8DW+NhW1T71ojDBQABJbyqnajLQvTP+8jginyR:Ej8W+NhWODBRJbylvQyUginy
TLSH
T18242098356EC5943D5535F30A3F8EBC3BE39278628605466445AF5A938C27EAEF00B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 9ce840d9a67c4700d271f27a8e5163eda506ce46c85b501687955b55fcb3d136
MD5 33e8ccbe05123c8146cd16293b688417
SHA1 d73246eb64af4f7ded63fb458c6e09c7d500f542
SHA512 5468adb8e76aced26f1f33fd0cdc72d194f92b1cbdf3f8169bc12e0eec1593f568c18d0e937898ccc3463003f939181131e41c6d5928bf393ded09c95f63e705
SSDEEP 192:cpdkKBcytW+NhW3T71ojDBQABJbkKXqnajL1dHx3tKPDGq:wuytW+NhWEDBRJbflXBtgr
TLSH
T14462E98366E43F66E99F27B121FED7D72A391781159003B1C207E59C3882782BDA7D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 69e2e6459ea24237d5fcfc429acbc80bbb5852044a1b79f0aa6b544c4f770d95
MD5 85ceba9a21ce5d51b35ef2de9ebfbac4
SHA1 2d695a3e2257916f252d746c5cc0b48ac2ba1380
SHA512 5d2d7e9079f53efa667f29529ce9c9c10af8d7ef541b62e2934c6b68a0a16cbfec57e49297091a99c9db3bd0674f3173036e018f6559be5d6bac554d1da8f29a
SSDEEP 192:FW+NhWhT71ojDBQABJeWqnajLQvTP+8jgiM9:FW+NhWaDBRJeWlvQyUgiM9
TLSH
T1774219C64BB85483F9936E7042B8FA877D3D67861820452A056BF59D3C873D6EF01B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 8b018f12e560d1179f1ad72811dbf7c60743061bedfa332a6562cf3db5cb413f
MD5 73ced8b30963e54d262dae2559116e46
SHA1 090e42c4b7f736e69c248ad6b790bb68b5bee9ee
SHA512 b7c0514c14ff82efbdc69ad42a3fef0a9aa1ba5112e98f7911cc6abec238980ac1104d467278608fea65f5674b6097cdccf17698c076ee14cc5d963819877ec3
SSDEEP 192:+7q6nWlC0i5C1W+NhWDT71ojDBQABJA0drXqnajL1dHx3tKPDGY:4q6nWm5C1W+NhWADBRJA0hlXBtg9
TLSH
T11252098357E83E53DAAB2B7152FDEBDB3B3D17C1055242228017E1A839C63817F12A69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 bac9384ba44857279ac04865686941243ea4fac9c08c3d29feb1b53d92e76edf
MD5 4669249fb01ea369c7fd40a530966fa1
SHA1 106454588625bcf1a86db25333bb519e7f09ee61
SHA512 2036043c318d164d6701c022c7bb7569051a8fe8e87518a62fc4259fcabee3da481197a375c607ee1505ff66467dc019e1fb4a9db0087c3b0e064c1d4ef864c2
SSDEEP 192:zY17aFBRQW+NhWWT71ojDBQABJBlC+XZqnajxcRGlP6Zqgz:qNW+NhWXDBRJPPJll7P6gm
TLSH
T147420A838BAC6443E5A37F7066E8EA8B3E3E53C56D204857455BF5E928423C5AF10B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 3927a4b0b4591989f8c7b25e747286b359618b4de6f7680b2230c1cfb0d12782
MD5 b23936cf83dac4b64660a88711b5234a
SHA1 61431cfb47f8d36e67d2a046db318015af4d3107
SHA512 f9c4cdda309b64a51cc4ddf0d033d2c20ec11a92b8cf46c190d1f341434f28bf683960e5ad7d06ba20776bb95f5d9725155864efe20fcb2775cf4ed2d1568b41
SSDEEP 192:VW+NhWhT71ojDBQABJKrqRgqnajxcRGlP6ZqhV:VW+NhWaDBRJq+gll7P6gD
TLSH
T18E422A868BA85043E5D77DB059F8E7877D3E23C60811481A119BF9E93C833DDAB04B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-math-l1-1-0.dll
Size 21KB
SHA256 a2dbfc1a5baa66e257a4acc63289fa73adba893f837e2b304097ab829bab257a
MD5 c1096da4634ad3356a10c00b24f53393
SHA1 6ea87bf1a88e57954f1c34047423bc342cd407ca
SHA512 d0ed94cb0b7746c324067d9485620d8693140c04c110482d685560e21c730e840056c87dadf58239f6a9f3e28cd650b0b8ecac011e03b6d6b57adc76213f0427
SSDEEP 384:kt47isbM4Oe5grykfIgTmLSW+NhWXDBRJE6ll7P6gY:kC1Mq5grxfInCNu1PEKg
TLSH
T1BAA2838789E8BF67D5CF0BB701F4CBCE66341BA154E1B5B4D887A1C834927847E4B948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-multibyte-l1-1-0.dll
Size 19KB
SHA256 bf1292e2b4808884ef85fb40e75644c813063e34511c01706ebde9f4b5368c3e
MD5 cbf3cfc9ee1fd29707d95c63a5e7a78b
SHA1 aa91416f203466f24c0685c71a287950851d3d6b
SHA512 aafa2e8d89b3d507de47df3e908439f4d2130eb56fbd78fdf9bf9e046cb46bf7b8b93c1d6e0b5c83ea06615b78ca36b919628ed20919fc6ce373ff8c11a53b3c
SSDEEP 384:Wy+Kr6aLPmIHJI6/CpG3t2G3t4odXLxW+NhWpDBRJVell7P6gO:WZKrZPmIHJI67N81PV2G
TLSH
T18F922E6B8EA82E11D18FD7F3B5F2D7C63A350F8104C07375A66B95883845EE9BD42E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-private-l1-1-0.dll
Size 64KB
SHA256 1caa06ba419a05129a54e085aa80aa8bbe533c7276574036f75627c421cc436d
MD5 94feb4417cf3e39c8c58a1b73620687e
SHA1 ea03ac74ff1f49f93445781c90d5518f5e5d9cab
SHA512 ef1fe9201b915fb5d551c09b59846408c3ed27e5a6e832f732a521808970526a16e926b9585051d7705f363aa021ac4f087ac508c7cdf5130eb8ead77dd867d5
SSDEEP 1536:Ft2b2De5c4bFX2Jy2cvxXWpD9d3334BkZnkP8NvPIz:Fw2De5c4bFX2Jy2cvxXWpD9d3334BkZ8
TLSH
T1D75319DB49E63F22E18FF7B76BFB17C90B253A0418806170E9C7566B34853A9BC53A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 58dcf9ec3d0747a4ec23c7a1ccdb8eb0a6ad3aaebb0d8c0dd480922d012c8ecd
MD5 00a0a24bb2e9aade11494b627eb164c4
SHA1 98c1121324f8e8aaa64c673d79315cc27fa0d25c
SHA512 c8574f04172aed489b8ee91e0189314ca6b66d0d8b99275968ec888ee5c13f5f7b6d211064620b62fa1bfb6b54d7fd832823cf582e7949a07d5ecc45275b4f79
SSDEEP 192:lRQqjd7tW+NhWdT71ojDBQABJ1P4qnajLQvTP+8jgiX0/U:lK8W+NhWmDBRJ1P4lvQyUgiX0/U
TLSH
T1EA4209C787F81997D6635F3041B8DB87BF3B57C2581095658917F18E38423D6AF2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 096139cdeaa408c3e3bd393a7188cbd6c296c3fe4e4cc15da113286a3f713dbd
MD5 408019e57d3d2da62a9f28389eed0ac1
SHA1 e48d1166a8fb95da90787d820ae7cae859bc626a
SHA512 fc18b2b1aedd2611ce78e92c4b283f519b5b25ebb0be5fe618a4fdbdf60c68f1edb486b74e59990e04f6b2606a9681edd433a32e6f9dc10ffe043d8dcc64eb03
SSDEEP 192:A0CjfhrpIhhf4AN5/jijW+NhWIT71ojDBQABJ9XeoIpXqnajL1dHx3tKPDGRK/:Ab7hrK4W+NhW9DBRJj+lXBtg4a
TLSH
T18E72F7838BF83F67D58B2F7312F9D7CB1A3A5382255051769853E0D938C2386BD1721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 51c54ebaec17c1216e0fcd926a2dc8a377cf278127e4fbf6cd26e0fda51c23e1
MD5 9d66fcc681389ec619d4e801f1ddbb2f
SHA1 605385439a2b9295efff604f27849778696befaf
SHA512 0776dbc733491502c84c4eb3d532b52acea0f08258647d488ffb68df2997ef4cd750b2667f94069991ac7c4001be681cd525e56af51bf1f43dda4f095f6daa00
SSDEEP 192:GFbNpuWYFxEpahjW+NhWqT71ojDBQABJa2syRqnajLQvTP+8jgia0:mUFVhjW+NhWrDBRJi6lvQyUgia0
TLSH
T1CA82D48785E83F42D2878B732AF9FBDB6B35538228147579C007E89835C9399BE0365D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 083b8b0e45864b12c60417dd3c5fe88b68ffc45a245d50df84f2a55b1dfcab38
MD5 6c7f782fdbf9aeffe7663fa1579a610e
SHA1 d1504bf86117cd552bc1b97a49745780d35007bc
SHA512 d293ed48b09a0ad5e6b3bd0ba45feac092fc4c06dcb06eb661b6df7a061e402148a31b45b2074be97b4bd6ee7daf92f60cc17e1bd4d655f4b1cbc0bf7b3c8974
SSDEEP 384:2iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGl/W+NhWlDBRJ2Dll7P6gMJT:26S5yguNvZ5VQgx3SbwA71IkFGN41PeM
TLSH
T1FD82C24346F83F52CACF57B359FAC7C32A384F4615402375D567A08C38827A6BE6BA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 7a69214583d61cca3b8d765b488d6da070fccdcc02b76ee4c66aeb809f88c1da
MD5 39f9d0f1b698d53d78c79576c7c60526
SHA1 a2015e56318b650de7436231db6a09ab95f001db
SHA512 262fd3231c73f35deaebcb5953ebe3a639d8e4461a58d546ee962f5f1e254cb40eaad235ed4c2da780b737158ba82bf7c029e35007183a7891bea307edd922b7
SSDEEP 192:famDSW+NhWpT71ojDBQABJFiRqnajLQvTP+8jgifbKg0:iTW+NhWSDBRJmlvQyUgifm
TLSH
T1BF52088346E46A07EAD71B7102FDEBDB7B3417C119D0617A8117E8983687385FE1392D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 44d5822d611fe29cb8530fe4bb86eaa8f9f2e135504e2304f8ab4ad6e37b8d36
MD5 9f9fe5f52e9b2ad655c896b849883b1a
SHA1 fd1119dbd0c38e7fc075be6a9d0efe4789f78387
SHA512 7970b3ef135423602234737da54ba6b248b670a818616f501db6e64455c7a89fdc023ddd711c6a45a7cfc25a715fa8a9c608013bca2a724f5d605b95f32830d7
SSDEEP 192:zfHQduvW+NhWnUT71ojDBQABJlzXqnajL1dHx3tKPDG8o:zfJW+NhW5DBRJlblXBtgI
TLSH
T149420A834BB85943E6AB2FB093E8E7837D3D27C5152042620496F5E93887791FF2172D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_408c082234f947f6\ucrtbase.dll
Size 900KB
SHA256 a134a1d4e9143bce04a4bbefe4f7ee5ad677da1913c1186e021623df01ba28bf
MD5 3df1d7da8c1493a5a00c0474323fef20
SHA1 f771c2f2cc1b0fc8534c7670f1633e8316f62092
SHA512 fde8e6a06b13ebc64e42e09583e1466d32812b907274fdae8a5e04ee27f108aa311646e62b65aec30db5a9c150fdfe478b1586a7c413101377de50899af36582
SSDEEP 24576:mAqW/e5NMe7KtlQzn4pz+xJlEIngFmcvIZPoy4zkkq:r/efF54prq
TLSH
T168156A617885C171C8FA71F81AAEB232057EB5944F70A8C337D40FFEE5651E02A3B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcrun.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vcrun.msi
Size 36KB
SHA256 15684d42d6107225e93cba6c6a3311a7a86d4b515027da263fcd949d818532f2
MD5 02a7a8f705fb831559baac094a0b4269
SHA1 d47da0b6572514af57c3246059a4039df059f72c
SHA512 a68108d6a35a91750489a6c4a599187c3af5eab390744f3b56036a092117a6befb5cae9df56284ad49bf97aa99ae3bc6c1bc31a52a00e89e26706ab25ba7c400
SSDEEP 384:oFSHcrEiy9UJ893M5BCnoXLSy5vd6ey3M5BC0pb0dooB:4bymJKMDCZeWMDCa
TLSH
T1BDF2D70E76005336C64103735A6F97E81F39AC854F26062679AAF35C3FB28E493BADD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.v9.0.dll
Size 101KB
SHA256 130dc7a800def28ef85739ad62ce8168fa1db01a6d6138575b51148d7d56a28a
MD5 ce18bc86e63f3192719ce0d7f286a130
SHA1 86a935fbd2fd9f5b39307ef986146cb2ff2adc33
SHA512 236bf295e0551ba64d743833ffc5c1d1b5b4915c9df5ccf3300013c765befb37808651087c388962e2f7bda0a143a406f923f408a24373cee9e6cda49aae5b73
SSDEEP 1536:7Jr/e6TLw8PW/lTqUJBS0zxRiY+Xmh8GTEEFBtGQglqKA016kyBekazo:7Ji6vPUL7zxwXmh8Gf99XZ7Bwk
TLSH
T125A3F81483FC4F61E6F71B742DF6A0814A72FA625EA2DB1F102D410D1C63B949A62B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
Size 27KB
SHA256 bd7eca9f684ac4bfa0c4d63dae690c861fdf9903686c693dd743e0a8728a76c1
MD5 d0958d7bb727740c9d9952b1805163fd
SHA1 a3b18971219311fd6a7e5f2be14979c3777d4d68
SHA512 138bd86e0b1f0b32ba453475e1fa81e11e9d4300db197b58301a5d478b3213079dc30c700f52220ff957fef10c4c85d1230308d83cf7560547b475fb346e1460
SSDEEP 384:Sp0wdaXOa1FnKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+81dWIY83gWQsLBiHR1:O0Ka+q+6rqnDPOyBeRmoQ9zpI
TLSH
T139D25628D3F85312E2B38BB099F5C447AD76B953AE34C7AC2596534D0C227849963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
Size 31KB
SHA256 b7b00307eb0c500808f33f97a6691080a62ad6c35702d9e803037a1897d1530c
MD5 55c9882d7612e7e8b69fa5920410be3d
SHA1 9517d22cc6d9c7f9b64d2c8152849a9075027c91
SHA512 a6fc94a8a0d6a690493819efd463b5263871346a94e7a1caa379871dd1fdc6527311b02eec70c5b49406aec53bf4e2d04d14c592754bdd3f6a251e64f9e2b024
SSDEEP 384:F52RrrOcCdqEGSGEg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+cZhP8W4XYWcsLBiM:3urKjgEnGEFiJrvPAOyBeF29zKk
TLSH
T1A8E2962893F81312F2F35B70ADF5C483A937BA03AE35D76D2586174D08667849963B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll
Size 137KB
SHA256 1706d0a3ad2696392958ca78d63822b0fd1947c9b10021beb7fe14db5bf288fe
MD5 b5c91699e57a807b2143cced62e70e77
SHA1 067f80a3c6b16ff9c4acff06099393084b6368ff
SHA512 d843235998b04d8f857239b31b5866c5328de3455b330f57be5f61acccdaadfa174231cbc57eb07f8cc5f7f3d8ba598fa0399fd8d13759d3c428d31a07265003
SSDEEP 3072:nEmV8EKUaX1IrJeE+6pwluGCulHxTqo+UeYBs+:nEm5azUaxWIN
TLSH
T120D33B11B7FC371AF2FB0B79A9F96001C97ABC556A26D78D1851424E04B6FC08A32B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
Size 79KB
SHA256 6979c9cfa4fb9590304d632ef1e03495ac83dc3f4af8e5f8b89de1b474ec1df8
MD5 2c100809815e27163493ea5e81010d1c
SHA1 01ee717e6f9d6c3d574ffe82c1cff3cf2467419a
SHA512 c22de3606e5cd1a9ac2e1cbca3c156831d5cbb99a50e4ae9f34df7d93b4d9093447d62b3fdc031be84a6c7adf16e23f7b5b44ba4eddf21bca13a26704d8a6b63
SSDEEP 1536:QdbojRaLEJ2tF0Hdlyw7GL1w1IcT7TXLqdqCOHp2gXmyBejjzQka:yYR63P8dlNGu1IcT7TXLqngXNBCjkka
TLSH
T1F983391193B88327C6FE43B464F0A8125FB9F253BEA6E71D09C5A39A48537C18D5272B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
Size 85KB
SHA256 0bc784fb37530ce516be9f28fb84419e17056c522c94e167352921f4f9a93889
MD5 33247411fefa060b5f86eecd66b95078
SHA1 74784f9e3da6f1579a22f5723d46c5de50add359
SHA512 c1ad16c956cde61fee693b1483905ab6711841750bab35848a1e7261165f37273d8380daf8e6f4d2d35d520ec52fa943938f3ae7ea056a112bc9200d7e49c136
SSDEEP 1536:kkrEteCiTny7jWHfpSEZRwsexZG0YUBXfqiGi79sShdX+yBeS2TzR:kk3gCbzexZG0YUBXfqidDhdX1B+Tl
TLSH
T18D835B27A3E85713D7F74630A8F09A03AA71FAC37565D39F2046672908AB3D44E32B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.Common.v9.0.dll
Size 361KB
SHA256 67d21938143f9368acf1c8c9e4cf3cc7d766cf430ae2314e633862e547e102e5
MD5 27d93e8af5f4cee915fc121075de8161
SHA1 84c40fbf2ccf8a614f45255b0fa6a1f0c9269105
SHA512 8f127be26bc002d05b5f5f3a1d509de9d83a52776d60c26df7e0c5e409a06b855845c0c36cf55c8ccb83323adc3b1e601fe701b88ce55b79e112f298aa5fb110
SSDEEP 3072:NAUe9MSVBYRApDFen6PZhls5unXIYAH+OguqlRUGl0bbuMe37LfZ+QT/xK6ur6Es:NAikDFsY3IYU+uojT/xK6ur6EaPef5Y
TLSH
T10D74C624A6F95B65E2E70730ECF904D6D676BE03BF2AD34F1512610A1871BC19A63F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Excel.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.Excel.v9.0.dll
Size 437KB
SHA256 b2171260fb1e9cc28dc640f730f5a21b8538af27d0246716a19c1f1af79e23ad
MD5 a6fb2c5f09c4ee2b5256c3a58fb2b4d4
SHA1 839136ccb8a70903eb103825fb8a21b02cf397ea
SHA512 20697cdbc007dfa8e672d35d7689c068a82a6ccb3dd19b360f23c05f3a30c2e7273721d85045b1ff596d03553f7bef7de7733fbf7dfdc48b8ec4d23a4e1c1ff1
SSDEEP 6144:DNu/UTUZ5+Io0NuaoBR1KGc89rBEXkKNymKfgkLkzArpMaK0I33I+p89GP5AWMJm:Ru/UT4HQ+hpxK1/ewG
TLSH
T19D94F71023A88A2ACECB0271E55BC6158674DB0A76ADEF5F5DF5F2AC2CC27924D43173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.Outlook.v9.0.dll
Size 85KB
SHA256 d43340f4c89b7ecf80004bfdeffcedbb94b6e218f2f9804643bbfa08bd8131b6
MD5 af009a95b5876c2ad8e1059151889bcb
SHA1 181370b3ef2fc8240eb01c441fb022d76ffbc650
SHA512 d4147b7711375441e6a393e9ba18191dd3caf5a1de6472ecd891ace8a11ced123cf615338533cfa6bd27a9fa9e92de3fdeb46c6e7155f2ecab9e33602eb260ad
SSDEEP 1536:HI/320UJsbta0qhRwfLyCzj8yAGjyBermVzpv:HI/3VTqhRqLR8yAtBPdv
TLSH
T103831700BBBC4796D5FA0B79A9B990119875FF967802CA2E0E94B14E14F3F90CA71377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Word.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.Word.v9.0.dll
Size 301KB
SHA256 978413ad8b26182656086e7271cfc30cd201abc2141c76cf2fc1eb3c472e7f4a
MD5 6b4df7cc46e556f0605529ef5f2388b4
SHA1 78d27476b9632cfe4758cdf72657ee9c308590cc
SHA512 94ae8fd6750e00d56a36373e4f5434ee03dd9840315a8bf92047316a220d5a0f234af3ebd39747c0e335dba862a05dd77e91be21f86f6dfee548465b9d1b9363
SSDEEP 6144:f/3++m0QBrwOMPL8R60SxaS7Qa9CngvwCzD5OnOB3Uxo9GdwFCRcfgc9/w7GvAfd:f/3++m0QBrwOMPL8R60SxaS7Qa9Cngv0
TLSH
T18C640806277C4A2FDA6B0674F5B2067116B9EB077392EB6F9961C2AC1EC37408D03677
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll
Size 117KB
SHA256 cf7b8a47428bd4f204bf77509dcd2f3e5891f65d4f0a367ae45f80fc0e4d6594
MD5 e1b99ccd7cd33bdf1b3377ea678b2b46
SHA1 f9286981d561a0705f8371d9b5989fac71190c58
SHA512 3a69d0550d3115c6b5ebbd567efe4183f16439e93e54af3d229f6b27e9a136db14ecceb40ec9cc476285895df79a7238d296746448f5fbc22c579132a1f747fe
SSDEEP 1536:g4OjG3HW1g/e6TLw8PW/quND/OOw6XSq/KGTEEFBtU+IN7cqKQnsPyBeA2zO:grjoi6vdu0Ow6tKGfU+IN93sqBA6
TLSH
T163C33B1093FC4711E6F70BB47DF6E0419A72FA635EA2D31D1999460E1822F94CE62B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework64\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
Size 44KB
SHA256 75e3aba38517f6396aeb31653a92ef8942eba6e701007f6cf3af95f0f9c47785
MD5 c2e0ecbe64eb072ed008257142315526
SHA1 3d732f858fe67bae8f369ef19ef282e11a83f656
SHA512 5e0d2a7484e63254e455d6e9da44f79533638607e41d7c4eaf77529f6dee50904a675d8695a8e5c0ac835e813f2a7e11e7b1e0cfdb82553edf653451fe816203
SSDEEP 768:Tc1JB9Xaefxf2ZquXoQGaVP6rqnig3MbvyBeHO7Ex9zQB:A1JHXtp+ZquHVVigczyBeHljzQB
TLSH
T17013D72493F80313E6F757B099F1E443AA777953AE29DB9D1099574D0812BC1CA22F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll
Size 289KB
SHA256 cf4a264e243cfd6d9ebbdc100bc9b0bdc1bb178bc5c9bbc141407a11bfabd8cc
MD5 b7b9a43fbb8f9657cd79449e5eee1839
SHA1 feffed24c3e4d0f4c452400576a93954fbe42be9
SHA512 118d7426296644c2e7f3cdb3b3e99bd8e7b95a9c0d28b529292ed968b87d6e61e1fc66455e9ac935283d71c3aa1892f61da1fc24b85c4dfffcede9901eb6348b
SSDEEP 6144:g/0op4WYV7/m3o5777376V7777U77aPsNKIXaXce7mNTp8HWwR/JBMm0CthHvdRA:P777376V7777U77aPMKIXaXce7mNTp8Q
TLSH
T10854F8A6A2E84F22D3FE037820F1554B19F1EC57C64EFB4B684092F52C177A0DA63967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll
Size 149KB
SHA256 364f386f97281ff3a80fbf5aa93207d35cdcf21d4a32fcf1a29c3861c8794671
MD5 5407ed386851928a55bdeb7343547e77
SHA1 7754cb78c8c6fd85c0c303a602fe93c6a3be2170
SHA512 fa3cc5c5723a4c4f7e355041162b3d55576c45f0f81076c2a14f9f92d996870a5a10cdf869773b76585d40bf5d0d52f15f4d6b8da718b4b22b4ea7132417880a
SSDEEP 3072:6AyIIXB6eUAnH0gUYwlIVkGw5Ll0k+5bcjCBPx:6rIMFRufYp
TLSH
T11CE34A0963E81B1BF2F71734E8FB40825BBAB9077963D31F694D41CE05A1B848662B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260426221911.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221911.log
Size 6KB
SHA256 4f1d56f29414df5915c8e592d4b5436c03af3945fa4e58c27b8f85a9aa92ca11
MD5 fc56fadb90cdda9985b28b54cd75f7a6
SHA1 8e58ffb7cef104c14a5196b188bd76fe3669abcb
SHA512 35e84dcf8723be871dbf58c97f8d4440a443ab2d49aa8e0ab37dd2e98f765d17f0e4bdd5b08ca9b1cf434fc0ce640cfcac9c7a3c09f5b6f6eafc31f26d1943fb
SSDEEP 192:JhxtjlPyu52h6sh2CGhEhixgXhxhqhqtfJvjqhJamhAtr:PxtjlPy/6u2CUme+3QqtfJvUJa0Atr
TLSH
T1EEE10F22CBFB7BD82AE5E1AAD2F09ED48F1170C57A4424F26B7B828D4005850D7CE726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260426221911_0_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221911_0_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 fe6dcc2c302420de59df32a30d56d7e3b7ed37ee62dc1b3fc8c24201d2161aa7
MD5 c5f74487f0c3500a5fb22dbd7418897f
SHA1 84f3f4e5ec8a87439db953533972ac100e599f89
SHA512 5c0bc0d87ad10bc04a9d7e5bd07b01e343a4159143b12f1d0ef240fe35587ab8e5f34e507a615d0d8764ed1340835bdd9609a074fdea57e5dbd7d0eafa51edef
TLSH
T15641DA591FE90805B1B3968B9DF3C4620F33FCEA6834AB0C23844319066BD096D597AE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260426221911_1_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221911_1_vcRuntimeMinimum_x64.log
Size 1KB
SHA256 396da897f806dca81b02f1447d0e4dd3dcccbc39537c77cee317e14b2867f762
MD5 b24206bda22dd3a73464f7362fd4a80a
SHA1 5e88d8d856cca9a2324c5fd3e161f911f80d41b1
SHA512 f92c6f762625d5cd0944fd2421fc58373e3dae8fc3ab750768ccc4a7b584bd2890a0d2653a54778458c61a8c43d0eaeba8404828d0e2e75e1aadc13b784d193f
TLSH
T13441E05C2EE90855B1B7DB4B6EF3C4614A33FCD56834AB0C22C9961A036BC0979593AE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260426221915.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221915.log
Size 7KB
SHA256 7e691784e7e8cf65fd36b677bea4c9613810059a7e0216bfc0a835f8254056a3
MD5 6640d6aada64630278d3ad29a3aa2b93
SHA1 dfa62358056c176b61fb8e0faeef5a66b2badbbc
SHA512 d88c536ba05a55479142d0ee21e2d096148f956f48609a908d8a3f8cb433c0b165d5b409180b51f0d4b143d17c3566ed4f3abedcc7169c33e4bc27e8a2c26a6b
SSDEEP 96:k9r+bxAzDbzb5bMbRrwr9evXJPcYNU/AdmbObYbjDEzhIbTbh9cb4:022vFkFQIG/RmYUhoPM4
TLSH
T14EE1F012CBEAF9EC6BB8F6BAD2F40FD98F023084355065F16F7AC6490219564DB8D361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260426221915_000_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221915_000_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 c76bb07e43bf02013a4a9905065b3d55570e0085f7ce04c93ec294f7d0279b54
MD5 17ed9b827013f65af8ce114b37f4f095
SHA1 6e6266707666faa87f7be4bfacdee94a6b678587
SHA512 e854a6a68aa6f41f39e57600f991bd2ec465574fb5b756bf41ef5155b1f94e857c0a7e18ef1aeac43cc48d0a1b0ff2e41455c878d6dff42b0a6be49f00a7222e
TLSH
T18F41DA592FE90C05B2B396479EF3C4916E33FDD66834EB0C2285821A076BD0D6C597BE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260426221915_001_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221915_001_vcRuntimeMinimum_x64.log
Size 1KB
SHA256 cd5e859470ec4b7de3671492f93da2c2cab993e86a044d80116f05e33d8e70ef
MD5 b63b49675e9fc5677f291d3874829960
SHA1 4fd7ab4a162ccdead71e2c337c1fe56a4c5e5d47
SHA512 3e3ce84eff042cd448ba95fe75fff297420f5b70a8dd6eb29c24e424427ce3da06de6b72b95c29ced7cf3b11c57c468402718ee51637298b16515b4bae2e0bc6
TLSH
T1DD41075C1BF50944B1B7960B99F3C4A35E33BCC26835AB0C22888319076FC09796D7BE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260426221918.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221918.log
Size 14KB
SHA256 a5d6d49db76dea6873d7c46aa2edf8c3eb941e63320f2a59059399b429ba9c4b
MD5 e8978f4328a83556f6eef45d4768056d
SHA1 80ed9433a7966d5236fc4e9c9705a8ee990fbfa0
SHA512 b9604ee9fc3ef6b9f580374c8596bd3eb26d1f2c4057e2d3ba9d0de4d39f887c531279468eebf9c0dccd746f6358f675114dc99d9410330068019c7d404a8031
SSDEEP 192:bqcni161Q1/131c1i1J1dp5ITC/6coAWffEQCj2AlI3Uoq:b3Sp5I/TX7Kx6dq
TLSH
T1DB62DF73A7E9BEE519A4C798A2E20F528F9970883F0010765F9EC34C31349E9D7C97A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260426221918_000_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221918_000_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 61039c8bd243bb98ddcff95b900fc850305592338ab4e21b17f5b0126f4ef649
MD5 abe8b0ef5a634ae2998a7ecc649956f0
SHA1 2ecfdaa8e6a3a789acb9f195457ed5f00b6de5f2
SHA512 a15ce3d79e032cdb53e3bc149aa87c602806b0b8ef4c30d3687fcb50929b8c21961dbeeb0687e70ca39f2d6cefafbca3a1202c60ea9808ac3070c8901a0018d6
TLSH
T15D4125581EE80914B1B3A687DAF3C4525B33FCE57830AB0C2385821906ABD096D5C7BF
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260426221918_001_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260426221918_001_vcRuntimeMinimum_x64.log
Size 1KB
SHA256 9afc008308f245a7e80743ee9627450222b62d556b9e2b94edd2936e3bd234c8
MD5 effeabd42441ce5de91a389b7ffb8375
SHA1 3e1f349d6a957029d0b6d4f3a1927ec5e6675dce
SHA512 486fb1d73f36c92b713bf6cd009c3fee663029202e7404236c6c80d4a6eb4a467dd2d953e2c0610950d5b4375189866677be59c11ad5bd864701dd577824ad68
TLSH
T17A4106581EF40855B1B3A6479AF3C8525F33FCD5B534AB0C2285831A46ABC086C6E7AF
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260426221913.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260426221913.log
Size 7KB
SHA256 dac1ba1268d634cc483e7b44fd22e85c1e665613f2bff27f8a2be5ad913585dc
MD5 3c7767ed3dfc540e55bbb0b2ef218236
SHA1 abadf04420c8053dab7f3dbe6d39fc0adea13ae8
SHA512 e001e847ba7dc235a0eaf550dda8a20fd46388eb7dbc332bab713305858823b9c569433acb8193c38b9df7ecd5b68bdcea4bba6315f4c1a18d8dbe64d37317a2
SSDEEP 192:gWa2xvKn5PAA6gBVK1xpPOPSb7iCnYB+uw2UmEjU4qac9NuFr15kh2/:gWaSvKn5PAA6gBVK1xJ4Sb7iCnYB+uwT
TLSH
T141E1836366E87DC82EF4E1AACAF08FC6EF04B0C872405B716F73C65840259A4ABCD751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260426221913_000_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260426221913_000_vcRuntimeAdditional_x86.log
Size 1KB
SHA256 85c4e0426d379c7e77fdadb9265e170d3509eae037e6d3504edf8e6085cd3083
MD5 1a854386ab38ed57a8547e4114e1a231
SHA1 582f8f0d6f5d9cea8c37908c4f9d5186cb79a626
SHA512 c7755e0f93657f5028f638ac70dfd6372bf01ecc6520c92a4795df1c241e70a7d1dd5a03ba088287d76218bf68085a32e1c8df5f33e19c265dc28060cc88dbdd
TLSH
T19E41FA591FE80905B1B39647DEB3C4515E33BCCA6934AF0C2284872A066FD4E78597AE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260426221913_001_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260426221913_001_vcRuntimeMinimum_x86.log
Size 1KB
SHA256 5dc1cddba3c800865c01691135f0374c8d2b0f69ccd9e0293d163d5a11f7c75d
MD5 888178f8dc0f16504bda48253d5811d5
SHA1 f5b100c68b95de9258ff1dd6941b988365c0cb91
SHA512 934ae49cbfafe83811ac21ef719579f14ca0997f5d9c7f63f06c67aae923f693e0a5ae12bbd3753a7516fa4448faaf5cd22c38cb2a3c3b3212d743cdd2f36e25
TLSH
T14C4116481EE40906F1B39647EEB3C4524F73FCD66934EF0C2284862906ABD0D7D597AE
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 222B
SHA256 ddc0a091d65798ecbb317d6abb858688401ff19968dfa4e69c5587071ce97213
MD5 b985df7b76829d90d86defc99e1724b9
SHA1 3be9c28fcefe5ce7180e2c689211d6a7310f5bd8
SHA512 95a87a12d5ea09aea8b0af3f909c30e7e8474bcf922507f9d417f9960711ad077521314390da39d572e97c755f7bfda26168237a82d01cee5474325948f764a4
TLSH
T1D3D0A70555304015F6716141061F45083BB89B2A2193870586CDD880323B9CB805D68F
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 984B
SHA256 62248ef42618154e8527372789879f3448709017b63993ee75d1776c7a9c8216
MD5 5a83a0d789ed6f02421d44bdccd87cd3
SHA1 152fbeffaeac96dea12cdffc8b55e76502f4358a
SHA512 c5cb0eebecfdfe4bde5144155e3f4fde77b468e674d3f3eb22a9c1a1e8a4dc208701e4a88515dfcff0d794e68e7f0ae083bc49ed2fdf652d390d1d16cca28886
TLSH
T17211D69255244152B9B321000B2749612FB59F2A31D7CA1A45C9D9A3772BFCFC4AD38F
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 492B
SHA256 850f34d3cb54a7131a564bcedb84bcbcdde89c2ae214dcedf1eb794465ebd3f4
MD5 826ab855bf3d4cfbe442e5c29341c742
SHA1 0f76eaef902a256221ca8d309b46e480113669b9
SHA512 d053526e1ec45b6667699689e80ff30237a860dfa35bfdbef2885d8c525e47b3886fa17e3ae2b35e69601305ef450ccea60dc85e6023cf0ea3e20777a26ddb02
TLSH
T1D0F0E28696214016FAF322100B1B49553BB5DA2731E6CB0940C8D9A37627ACF84AD29F
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 738B
SHA256 08b2f5d869674d08782ea53811975a6cc1d67da024fbe30f66f3c5b8ef5a831e
MD5 89d42ed52b434f87f3408bf635d31183
SHA1 152a56d81427313371addead21536d631fc8c7fb
SHA512 392c0c0b574b88b790a35dc4c295723f14e5a02b0fb8e8705ae767131312fc9aee7fa41411f808a35c6408b8932b8d920020092f9ac518542da0fa5d30d356c0
TLSH
T13A01F58656214017FAB322100A2B49642FB99B2731D7CB0A11CCE9937617ACFC4AC29F
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
Size 126KB
SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
MD5 d7bf29763354eda154aad637017b5483
SHA1 dfa7d296bfeecde738ef4708aaabfebec6bc1e48
SHA512 1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c
SSDEEP 3072:NiPaAuXlx9XuCoy57617IM6a9y3+7ZWMvd:iFEf9+t57IMld
TLSH
T1B6C37C5136F8C136F2E62576551AC3715D3AB9344DE188CF6F825A6A1E312E2EF3A303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba2\license.rtf
Size 47KB
SHA256 5b7bd9ad76c8df8e2c496b3dcefc9fe3750dccc48fb416126605ed3fb208f55a
MD5 e9f84e5ef16d918faa9a5425b4b041cf
SHA1 a427f89e8dc5f1784208f6755486f8b1805f67f5
SHA512 5a2bbdf2226c5e2198e33985d71c572ed0cd22197fd39cd809a0618f6aea0e80904df3c29dd051c5e5f436f95a5b37289c9dd106ebec14e00819c6f8aa0a63e7
SSDEEP 384:MG1qH+on6IXAN79ozVzEFHAUfPKQnlLsw9AjNqEllPie5u2LMli6rGsNAYAXJqsg:MG1qHKAUfPzlLswKNqAlPHU2LQhAZq2o
TLSH
T1052364A8404253D9D34353EAEF05F048BB2BF61964E594E875BFC2BE617FE6CE122412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba2\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba2\thm.xml
Size 5KB
SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
MD5 0056f10a42638ea8b4befc614741ddd6
SHA1 61d488cfbea063e028a947cb1610ee372d873c9f
SHA512 5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e
SSDEEP 96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
TLSH
T193C179B546DDB801C133EB1166F231D27F126972C0C86E99F94C3AFA4FE1150A87B2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\license.rtf
Size 6KB
SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
MD5 1e47ee7b71b22488068343df4ce30534
SHA1 deaee13f21ab70b57f44f0aa3128ec7ad9e3816a
SHA512 c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed
SSDEEP 192:qMIJdg+CSWA2NLtMqAEwRceNlC8xiYOlTGyDtsFSpM52:IIATECl1i95Zw2
TLSH
T194E1C6FD2243DAE0069F1399194194C6FB0F0F79DDBF7E50B5B69110126291C727EAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI92C2.tmp

Path C:\Windows\Installer\MSI92C2.tmp
Size 83KB
SHA256 ff95ea08d4eb2a9879c839179b0a0bf223268afe84430f23582208c814ee19a1
MD5 08895ffbb06b9e35893a77b8d613bc53
SHA1 8826feda89dc5905d6c327aed3aa839a510b96be
SHA512 fe213b0050b9346b6c7a8583be988870e7442c64407fbbd98d952653e206037c108780dea9f0ea9c51346d021935231a774b040ecccaa6123869e6318517b1b9
SSDEEP 1536:aChZ5oVlwKpAQOxQ+/hvFTTMJ0vR2JeLEUTXFTk2y3OI:vhZ5oVlSxLvFTb0JHUTXFT3y3
TLSH
T150838E2275A4C17AD0AB5976A539C1711F7EB0301BB0C88B7B560BAE9E31281B7B7317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA972.tmp

Path C:\Windows\Installer\MSIA972.tmp
Size 87KB
SHA256 76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e
MD5 46790e2748ddb98e3d6115a5f0360ed7
SHA1 d041d6aa45a7fd2433b46560377559e04b92f7b6
SHA512 c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f
SSDEEP 1536:DoihL9JEfu0VmWFyzIR41Moen9s2O35S5tTg6F51:Doi9JQgvJVJS5pNF51
TLSH
T1C2935B2179A0C03AECD222BD26ADA650567DB8B14778C8C7779D03EDDD207D0E73A35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAE33.tmp

Path C:\Windows\Installer\MSIAE33.tmp
Size 80KB
SHA256 bab5c035abecdb9e89b93dc5cc688b5c3e5c6aec4000e466595ee3ebb3342ca4
MD5 393da89078925f78e19445882c37fc59
SHA1 1313f4e6c62670f1b10aaec77c105be275f50121
SHA512 aea5690cc1e6decedfb963c728b880ddcccc3d15b190943a890c38d41057d3511afff2e6298c6042ad2d862abb13e95992406511356bc58bad82754954f321c0
SSDEEP 1536:d+/OTT4YIb6rkCGoNGXbGKauVj4eKtHa/cJg95k:4OTMYRradauqCcJg95k
TLSH
T1AC832A2179E1C231E8E2777406FCA6622D7D78B14778D4CB778842ED8AA17C09B39367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB34C.tmp

Path C:\Windows\Installer\MSIB34C.tmp
Size 165KB
SHA256 8aa9ee293b304e3368dfde27d35538f9676f3440ec5536e58ba9fe3ff7841d68
MD5 1202b90ba913a9b5b227749967d63b57
SHA1 1817119db41ec35139aed53440f3417969799d64
SHA512 851d9163caa5efcd1490d55f8238c7c338ffc3ced17021847406a1890f467a60efab4e19549aaaa82ee809ea46f882d1eaed8913d759b7e675e2e99bb3a7496b
SSDEEP 3072:igN6wMs19DGwTUxlwZRlKCCDjshYsnY0T5aPX/lfgQyVqkHKBFdI:ihwMMDjTUsxKCCDjzsn98/Bly7MHI
TLSH
T151F3F78173E80079F5B3E678DAF54656AB7378429B39E3DF0250426E0E72BD0AD35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC0E5.tmp

Path C:\Windows\Installer\MSIC0E5.tmp
Size 97KB
SHA256 8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5
MD5 d36a56e88a78b4d3c7ee1f4f804e17d6
SHA1 a520426523be085ec67291241f4219ab13f4d4b8
SHA512 def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca
SSDEEP 1536:PpK0p0Chu240kmktdDMKVDo9PkzcGzFukFqbbffCfBX5a3/L6F5De:PQChu2VksKCM4GzFubfqfBX5avuF5K
TLSH
T1C0A36C5463E8107AE467827ECDE65A4AFB31B4050779A3CF032586991F33BD5AF3A312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC577.tmp

Path C:\Windows\Installer\MSIC577.tmp
Size 93KB
SHA256 fb13d67c05d0e3c693701d782a55bc002ab62e972e4f018bd6b1717493bf1ae2
MD5 186694813c3d5e33202a1a72c5079cc3
SHA1 90a9c2bf6419be6f46999e137c2149feca62cd13
SHA512 57bf8ef4bdc08bcd7a83f82d14556710a2ef0cc7ef63366c48b144002a5f70cd58a130011cce648dcb3e9f62eafd6b188aa908b3b8f324448fb38567e499383b
SSDEEP 1536:NOTekneIYoT5jmIN0gaD4Prbde67Z9AlIZzxIgU9rHUD:NOTekSoT5jr0BDKEawIZzx3U9oD
TLSH
T16F934B4523E840B6E5B7927CC9F69A06E772B4411739A3CF1174829E1F63BC49E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Size 156KB
SHA256 6e10cb96d197ce09055f2bc2a5484da85d7f043a09b771daef442f86930f1f43
MD5 b29db9d104ea2a6e4a0a7488f484a6fa
SHA1 3a4ef216a5c565836518588b1d4784f611326c50
SHA512 c23f8dc96bf67c8bc516d993c2c1f8dfd61af1ec5aa5eeff413da21ea9fdc847144e305ccadc260655c375047860bdababcb496dd9ac91cac82a75118a711a24
SSDEEP 1536:SgEjIOPe+9CeuBDpGa6KwZEYSSyOSd5ze2mmmUm+YSpJVHSGyf02KSkqnmEi0Oaa:0l8pfe8
TLSH
T1DAF3DF19241E51F61D5227821E8D3BC7A7CF47857BE80999B274BA3CEB8784F43319E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log
Size 147KB
SHA256 f4cd061e499a789079bc1105f5449242170d31531fb65d8e9bedf7f39bddb8ff
MD5 13a230973aeb39e79842849e8036f1be
SHA1 bc6a54909e743207b16275c19c1ad8ba081e7801
SHA512 5394efaeab15c6a78de41460a07c8ab7a9d867e8455122d6e4560bb923c73c2f45e35a1169c00c4097dac5be48b36b06293831e0ad1e22cc86ff73a8235e9174
SSDEEP 1536:Rqyz2xs+S9SKSyBSVcuGrGH1GCGH2+6QaeqYCdMeCAARakoJeyQylYaxUrea2f+e:mtEuc8WU
TLSH
T135E3F419201E51F61D626782168C378BF3DF4F852BE8096DF6647A2CEB8744F83359E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{47532419-7D45-4D89-A851-F24C9A8AC736}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{47532419-7D45-4D89-A851-F24C9A8AC736}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{6C4E1C25-A7EB-4A88-9AF8-FC14B5D1977E}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll

Path C:\Windows\assembly\tmp\0JJ32PCP\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll
Size 192KB
SHA256 e51a6c5e34b5e1ac743fca62a8c8d82f3e5099914745664a23843f6276e89039
MD5 91cc9825305d8554054d097b5418d7fd
SHA1 750eda13cddadf3f38de3df25062cc4774e019cd
SHA512 c1c82bd4859e0db7763f6e11425eb02270cec54ce79c0f848e1be5cab2c1715b7e9a96f12d9d2f11d5418881596837b3fbf84254be9e77e84b01a2b11c646802
SSDEEP 3072:0cs+QnXsia21rUBJeImxRGluQriZY+/ZCX/kMrICBX0a:0csrRIHiBtkb
TLSH
T1F3142A2467FC1B15F2FB0B7AEDB5A0019A76FE662913D31D15A0419E1872F80CA72B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Excel.Implementation.dll

Path C:\Windows\assembly\tmp\0JJVQ2LQ\Microsoft.Office.Tools.Excel.Implementation.dll
Size 459KB
SHA256 1e9f1d847daaf224c7b1ca265ecb7bc293b0df70b3a299b5da3bdb2978bc7df5
MD5 2c93d41b14f129c61d2993baaf2e002f
SHA1 96e54e9b760391683eb617baf03aa444d124472a
SHA512 21808de680825d1a1a2cd003bd5b479c2ae725e54071ebe4e8aff5b0fb000ffea3eba1ece98631ab3065a8cf6c2786c1d9059712931e2fba0410c7a2b53e31d5
SSDEEP 6144:y6g4wRumoEBSvGpDMCDC1AW4e+TF/AVaqmRQGtIhyjmDs3lNiuNfVdKy9:y6jwRSvQh42RNjN6AVdKy9
TLSH
T12CA43C12C269D33EC2AE833750A226155BA5B2EFBAF1EF57A013C5E82C537C09D41E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.v4.0.Framework.dll

Path C:\Windows\assembly\tmp\1M40ILE2\Microsoft.Office.Tools.v4.0.Framework.dll
Size 30KB
SHA256 8b1af886189a4f9610d1e38aca9d71cfd137e0ecb326d7c46cae9264c3faf097
MD5 7fdb0de95e06f278b3a08581f25a435e
SHA1 f7b03fcd3c6d8c4dd1e65a689a73acbfe5c2a3ee
SHA512 8a289b9c4c82c3d8c22bfdaf57aa0416de14f6bcb22e9a3e10630fc158c65c48fa012a8946423950a65722fcdd0f3c643fee116ad848bd802aed4347a973c19e
SSDEEP 768:aHaVFSvPSNEtyJvrpc49qFkByBehN99zeXDF:Y29rQFkByBehxz8DF
TLSH
T19FE2185087FC136BE9AB0A707EE5D8815D3AFF526D62E21F4058C05E14F5BE4CA62327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll

Path C:\Windows\assembly\tmp\CO2N2TUB\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll
Size 27KB
SHA256 eb5162b64d9b6220aacaea4eaa597bdd02880b841db717e4bdca5d64e453b4b5
MD5 e7f28e9b4375963610ea0c6b7cfa09b8
SHA1 0f2157b7bd33fa24a7ba4274c9e5aa05c88a36fa
SHA512 c683d2faefffc02e73d500b40eb91a6055b0582ed16230c47c8030a4b5f8533f075354fb427faca1fcaec6b158ecd015ddbd481033159c2b43a40339a53f163f
SSDEEP 384:rd3K6a/IZa1fKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+CdWbspWLsLBiHRN72f:rd33qo6rqnL56yBeucts89z+1
TLSH
T175C25328D7F84312E2B35BB09DF5C487AC76BA53AE35C79C1586530D08227858963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.dll

Path C:\Windows\assembly\tmp\D36JCKTF\Microsoft.Office.Tools.dll
Size 18KB
SHA256 02d0d460ec66aca17204ef8f7244e2e34e117c7f20aa07e98cb83a1386a1146f
MD5 c7af388d0d92544cbc307cc692f6dc1c
SHA1 660b07bf79682e91b23824fa327950bfa8c73f01
SHA512 5a8d81ed8fce9eac5175c676f7db4cc147f4f2999cc9e010de4bf87c79bd106c45d0c8848f1cb0eb61a7ad7cf33d2d4881f9cce588cce4d841bcaa66ec8f187e
SSDEEP 384:H1LtwmrH+WAnmkW/MwWVsLBiHRN72lkPtHNsAR9zkwm/:H19AZvyBe6kFts89zni
TLSH
T192922A55D7DF8EA3CC622C709DF4D7423E3CA7835D12DA2B0689E5192CB3394C521729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.ContainerControl.dll

Path C:\Windows\assembly\tmp\EQL0TLIE\Microsoft.VisualStudio.Tools.Office.ContainerControl.dll
Size 78KB
SHA256 6ca890e728f1bffe2cdc670938d9c17729903f9eaade142775954ee5129b78b2
MD5 8ca4448d8a87d4edc29064678840a65b
SHA1 389ee39f6060e9b31a379e65d3c998a3dbe83b40
SHA512 b86efff7aff40a0d2750d6c4db6ed7095eb942720b972350f8cc87dcf3c666b09865befe885a57058eaa1e7aa3c5c56119324a445eabe246f52d236fff834483
SSDEEP 1536:yskby0ayhkM+TeVCB5+G9cTvdQc1bqMsDNb//pasgNiiHyBeljzQz:yDbyihcwqHba3NbSB8jkz
TLSH
T19673081497BA4FA7C2BA4378ACF1424256B5F403AB52CB6F18855F481C73B94CD13BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Word.Implementation.dll

Path C:\Windows\assembly\tmp\GT4ZNEKK\Microsoft.Office.Tools.Word.Implementation.dll
Size 337KB
SHA256 2585cc5fcf73680a5124d8e0a08a27d311ba903cd7bbffee7adbbf8d188c5f28
MD5 87d634d0fd6f8e13b0141730916d78a9
SHA1 8591e58967be097ab8f711395ec0b55f72d902d6
SHA512 cf0445d2d697f256d3421ee480eca5ad83d3c897c8477fd30828def534b2a45b72f5dd0e177dedad61283d28211707d7eec3661306b3c504203ac36beca377d6
SSDEEP 6144:FtlRAWy0iDCyVMvUYKZ+JICHNyPOc9Yh9g:FdXyyuMvQZ+/rc969g
TLSH
T14B741B154268C32BD5E8C235BCB136124BBDF293BEE39B2B613695A81CD37D0CC25997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\HP8M765W\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll
Size 38KB
SHA256 b2673e6faf166a80f9f3832234508d25f3d219eafb6ba1d8d16583aff3517793
MD5 792d885a3d06f829956b3f0461789f4f
SHA1 f5d023f2dfcfb369bfeed2815da8c1ca54a948f4
SHA512 55e82a9ac9a9bf8a3f3dfbe4e529629a11a1df48774874509b71e062d7f754178b3a87f49d8d46580cf3aa9af52ba03747c980c8422456538d6c52102f1ce24d
SSDEEP 384:Tght+fMtSM9jmxa1CFbdKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+3HW88NWXsY:TgX+EtkqP6rqnGKKyBez69zo
TLSH
T18603B629D7F84312E2F747B09CF584837976FA53AE38DB6C15C5934948237848A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\IAW4UZNC\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll
Size 44KB
SHA256 436215d03a6cd3b30d6b2e7006aa4a83f7c3291f3fc0b4ad86ff55e70dac8650
MD5 1190dedce8f1b97816123163216dd096
SHA1 468d499041ab141f4233b23d53ffb9a203cfda35
SHA512 fe35ddd5a4a600cf840414f8859691f5894ee779517f3b069f97667e68f6cae54836d393091f828dc9541c6fd9dbac4a77fd53eb3840a8d3dfda8d21373fa710
SSDEEP 384:MBk39BmxOVst4SCtrpuXYa1pbr/0K7yEKJ9Yu6dnPU3SERztmCJMadMardz/Jiks:MGfZs5CZqlj26rqnuMztgyBepmoQ9zpG
TLSH
T14713D769D3F84712D6F74BB06DF1E4435936BA539EA8DB5C145A530A08233D88E22F2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.Implementation.dll

Path C:\Windows\assembly\tmp\K29TQRM4\Microsoft.Office.Tools.Common.Implementation.dll
Size 354KB
SHA256 1bc4ff4e9cc85d9457e80276354f643028c01c25414d0e81450bb52ed802e93c
MD5 00ee8a57705bf407a2fa0606b144a13c
SHA1 3c9a6ed3cdb6d167da2ac38518c3820985e4b6b0
SHA512 9197e0ce0e8979b7d8c8e5b95ef5b9bf22fe8cc803b26c97b3c44d1d9e095f85a2a205eaa57152a9843b8fdb7751bdbc1e64cb3f3f04d3952537428cb427fc93
SSDEEP 6144:iNeM8oM6s8alZ+afj5OAKOQ4pUE9wttHqr:O9QZ3j5IOQ4pUE9wttKr
TLSH
T18874A415A3FE5761E2F70B34ACB40489DAB6FD479E6A974F2445A14E1C32F80C962F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.dll

Path C:\Windows\assembly\tmp\MCSZJJXN\Microsoft.Office.Tools.Outlook.dll
Size 58KB
SHA256 89d6f51dbcddb10ea2c4e92e6360e9fc2c917cd8d9f1aa162d6a47f7e940d899
MD5 6c7bc83cf1080985bb2505ed9c090c86
SHA1 64fcb206e3280b935c786d72ba34ad854bf74c7e
SHA512 8b2a1d334f01e7997bb6b5c7752d9a275714b811ebb293e95bd9b1be7d2bb44484998ab1fc1845fb7e6f4df4613082fa4ed552a4994961fe611a92b93e0ca9e3
SSDEEP 768:jRXrTM8QOkqNHEJLgp9DItLnKDiQ0fWS24nbxocNAwkEGjhl2BOBaBnD/sxFsN/4:SSk2HQq9D4bg3yBeOkmVzpqZ
TLSH
T1BF43A382920A96D6CC55A5742A70FB52E63EF3FB1BD0B65F8813DCF408A3250E905F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll

Path C:\Windows\assembly\tmp\N3EY3YYG\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll
Size 360KB
SHA256 25e23e4bc78db831a05fad7dc758354a932278b42b1b7277b62a75c717e89edf
MD5 5cb69e557b5b117597246c9e67cfdc8c
SHA1 f36af240ff34cc7c11c6ae1f0d67a0abf1496576
SHA512 9af38e10fa70186abf4088e86a9b45b79b4e6a41d20348f56da07fd8415ebf5d3695b8ef41962bb39310f5dd3436c2cbe70ba3982c720d7beb7b80b5ac6b1616
SSDEEP 3072:RyWCQQzXgPice1NvAbugFh/jLqthte2Seh66LikrKwQp91sq9kAatVrmCK2phJRS:UWCdDiyvgmiL54AaXDBP8v
TLSH
T1B174D62073F95208E9B70B30AC7692C51A76BE677E15C62F2449314D6AB2B53CB23773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll

Path C:\Windows\assembly\tmp\OVG24KZE\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll
Size 134KB
SHA256 df0deac24f6371b26da9f34c1ce21e7d3fb7e4a4d75c42745c265b4639cb3e82
MD5 d8d3a7296bfe05f2355f96f526f1dce7
SHA1 f1ec56517cce54f75fc3b8cb3f82f901cb3d96af
SHA512 67f3816e595f472f3d67983e7207cbd643a2ccc3f6187bd94f2ca32dc2cfac3fb7daee7b5b05aa8ce46d829b99687cdfa4f34e802835b90955b126cfabadff48
SSDEEP 3072:ON1zvAuFvVyV2sUz8mqc9AaZiNhxm0bBzC:OTv5tAaKWQe
TLSH
T186D3D41B93FC0269F2B70B70EDBE94CA5877BD566C21D25F044A764E10B2B809A72737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.dll

Path C:\Windows\assembly\tmp\Q1LGVDZS\Microsoft.VisualStudio.Tools.Office.Runtime.dll
Size 393KB
SHA256 2bcd529d5c2edf88d3b658816d72d1207df773ffbe805e7b5070802782c23c67
MD5 8640c74199160c6e932a5f55cac9d9c8
SHA1 661d08a2ca504c0e056bf3ddf500d9cf610ecb42
SHA512 7c06470c6ac2c7bb8bdc4fdaa81c765c810208200f059fef2cf0ddb9d815fca705964fd062d187e4e189127096690ad5ae9f4a74c5ab12b486057141e3f46332
SSDEEP 12288:P1lzmzzzzfzxVzzdqzzzzHUzJz8gXUAaBn:NlzmzzzzfzxVzzdqzzzzHUzJz8gEAa5
TLSH
T17184E62073F94218E9B70B31ECBA41C51B76BE67BE15CA1F2445315D6A72B52CB22373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Excel.dll

Path C:\Windows\assembly\tmp\RBVI9K90\Microsoft.Office.Tools.Excel.dll
Size 171KB
SHA256 a4397784c26adfec3393dc421d27f826099a19f1d55b64a2e6199d977a37515a
MD5 acf3804fead07de2fc137e95a57494ec
SHA1 d8b82e20db36ebf1dd2b27d8f301e59c0fc62565
SHA512 e21e42e012a0599f99c812ce4cb520d9219ddda15fe5c05241b6aeb17d0df4103877c81877a75b55271b389fc12c2ad822c2e4ec8e72a750d17b8e22829c3736
SSDEEP 3072:VWwMr8CSQ0dd5Xqp6J7OB6530Xgb3m61EC6r2vamSxBAZirZANBtJ:VnMr8CSQ09ap6Jy65Rm2v22v
TLSH
T1730419C1AB0BE061DCC9563C38AA7B056F3CFBD295D2EB0BC50DEDE42493784C64569A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Word.dll

Path C:\Windows\assembly\tmp\RCE7BARK\Microsoft.Office.Tools.Word.dll
Size 142KB
SHA256 bf5406b6657cc7aca2db714ec375efc3ffdf4cc32a80f938b3dfa502ebdd26f9
MD5 b24ae31036dc11fe6239397a22e8c659
SHA1 40d2739f8d2c19db095db4ef4f1a9cb6bae7880e
SHA512 c713095f297a37458edba5f9bbd6e04e9407089b3f8e98f9c3c52e9711a8be01a3e7268ece3837d1e0438588c50406eacf7afa5bab08d2ceba68dde76ea27915
SSDEEP 3072:jrwVY+eaNZzPM8s08xsNj4SwAXK7Vs2gM2HO8+rCo7VBpdfh:jrwBZWkge7DuV/7Tfh
TLSH
T1C3E34A91EA35C259CE84C47D3E21BB00DB3CF3D644C2A79F4526FCE80A9B791C552E9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Runtime.dll

Path C:\Windows\assembly\tmp\SOOAD69H\Microsoft.VisualStudio.Tools.Applications.Runtime.dll
Size 84KB
SHA256 cd56f6c0e64ea02f2a76c880a55721929dd7a2d9eced52b82122618dc2b34c18
MD5 1150e66eaca3d36ef28a7551337b6ac6
SHA1 ad37ef180a8d1c81cbdf1595bdc802ba070cb03a
SHA512 a2862ac8fd62d4261427c2217d9c02d8df5dd7f4d3a0db0bd826421050d6ef8e39e8f630f079622905dc343e16f42c1d80724e1d4132d4c9d068f089d50084c6
SSDEEP 1536:nb4VV8XW/Og9NCJ7qBEPzm42yEAWQ0yBexjzQEsC:n2dWqQmyz1LBUjk8
TLSH
T1E383195587FC4716E6B74B70F9F78447AA33F967AA23C78D1408824E2851BA4C4E273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.dll

Path C:\Windows\assembly\tmp\T8P22WNP\Microsoft.Office.Tools.Common.dll
Size 93KB
SHA256 1f9e5b3df61e6ae400905e38ef3e3c8208698a488305554dbe9293887ffa6478
MD5 d75541051253a7528d7c14d60fdb3e27
SHA1 e03b4457b01aaee52fb01967a781d10001c6329e
SHA512 5399fdd80de5492ba106c8b29d87d4a6ab0ac329ab1f882c13662a1807b86dee5c2fb667ffd39b87d664b0baeaaa30738aae7b516e048a0f606abc01a9647cce
SSDEEP 1536:ey+zGztUjm2oNIv5oiIZZB8CFD4W8yBeNzfzx9:tzhNw5yjVDB0bl9
TLSH
T1CB930626A23684BDDDC9103C74983531A73CF3B78246A7871909BDAA4DD3BCBC987749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll

Path C:\Windows\assembly\tmp\TIER46AJ\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll
Size 155KB
SHA256 ac12705a2b9470ef07732f500bcd8b2844282be1f609f5aa74b0dd3f0268362b
MD5 7a17537e156d75e293aa693423fd0fd6
SHA1 2bafdfe9348c0a39dbfdca35d7a04d925bdc82a0
SHA512 ab38de8c226a7361d0b1d2adb3929585ebc214ea0b967e7f851891f4c2c451030fa38cd8c3978f881ccb90339e40272c0522aaffae8073e9a4c3467eb3118fa6
SSDEEP 3072:i0anyn/CiBk6HOIz42IJqFF/0/QAWwTrjeK4BED:2n+VEn08
TLSH
T108F32A5A63EC0716F6FB0731A8FA54416EBAF8132962CB5C2C4E45DE05B1B908673B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.Implementation.dll

Path C:\Windows\assembly\tmp\VOOAOJ6X\Microsoft.Office.Tools.Outlook.Implementation.dll
Size 140KB
SHA256 326bdb32503351a9b99fe69eb884a5a02d4bff0ff2c7b8b3ce9674fab9fcfc31
MD5 0f7bc383c04833cfd5e6d6f6d5b9f9c7
SHA1 29f672f4c8dfb820e42b54a9924e93ede94481aa
SHA512 d3a7b278a7244c13a887d2a50b8aee39af38fa8dc02f7566a3c9b6e02f25415e2e009cc118d923d22c55c223961657d832a445f897adb4a5649d70e9e9cd2d8f
SSDEEP 1536:oBjLPfRUqxc0O/t4DErSu9e7EMaggaqRuDPR6TCZByBe9zi:oBfPJUqxy14DEF9e7D3gaqR4PGIEBi2
TLSH
T147E31B00A3AA0B92D07555341BF2B542EA3DFBA72AD5E75F5411CED80CB3B90DC22B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Path C:\Windows\assembly\tmp\W9V3O5OD\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll
Size 38KB
SHA256 d182d18bbf9526dd0eb821eabddc885b80ba8f6dde2c9e0bb809fb55c14c7c47
MD5 32c152242c691677b866356014498d2d
SHA1 fc75591a894f0e8b5aecbd0bd13e3184df0c4f38
SHA512 bdf69a1b755f176e958f6d4c4e2e7c3ae74000a43266873ba602436c089983d0ebcf6e26344a15d8b2001ae74a798b5dacdbdd7cbc206426783704b036e05831
SSDEEP 384:bKQOJrYa7mdessomj5R/yeizfa19crXKJ9Yu6dnPU3SERztmCJMadMardz/JikPF:OQOVYoxVUq+w6rqnzxAzpL5yBeL19ze
TLSH
T15A03D628C3FC8326EAB347B0E9F5D4876937B553AE75D7AC1589630D18227848523B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.dll

Path C:\Windows\assembly\tmp\XIRVMDXL\Microsoft.VisualStudio.Tools.Applications.Hosting.dll
Size 204KB
SHA256 ed512630534121de6e87259230aa7d67547b810bbe54757b561c9cd86428a316
MD5 6cf6471f917d139fa7f6b57a09156a8b
SHA1 896f482ed5892beed0cf3d74cfd599c2980d485b
SHA512 2192f731aaba560bb91e85ca5282943dc7c4bfde708690808487cb966c1051ead73f63a71f75cf52d7fcfd9141fb82c3f2d1edebaf21ee87601aa5deeca82cc1
SSDEEP 3072:00uKb2fEejyG2iPklibcruOVTzk21wxqWX58Kn8p6/A/C9hSrBbQ3t4N3BMjkf:b8cXqcfDKQCGP
TLSH
T1F6144B5663FC0726F6BB0B35D4FB11026E76F8172A53DB0C688A469E1971B808A73737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\YMDESTNK\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll
Size 65KB
SHA256 12b2e3ab66fa23e2814d937bc24aae3591516e61c667ced481f66a3d55b66a4c
MD5 dd97df24a39663be2d217fbb4bddffd0
SHA1 9ac8d23ec7c8655ae5bb5a62eda61871030b2a4e
SHA512 f0de89568b550f23b60fb4b343682e7b4ffeab9c571127376815d22cbb3b93a2c6081831a24c7fde7977008a72ae4395313202af39e95095d2c3d8360bfdbbb9
SSDEEP 1536:4c7HHzMKpyGZ3Jr249XJqZqSbGJyBeMczZ1:4c7HHzMDG5JdJqZqGGcBC11
TLSH
T1A6632924D3FC4723D2FB87B468F188839A75F7836DA9DB5C1485532A08577C48A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll

Path C:\Windows\assembly\tmp\ZDVFRJYH\Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll
Size 200KB
SHA256 0f5b5e40b8a1708051250bbc9e36ba35357312503beb0004ae6a2cc5a20466e8
MD5 9828dbd687c6ac093d40dfd61de68a0e
SHA1 9c96f865e83d7deae884321e76c87553c6088748
SHA512 001852557d9bbc33cb9b274277d2e24b63b1d46b253674f13eda857f36bf0718779242621c14809f902df041283c8302164d584a4e42be3ed11a0cef591f7853
SSDEEP 3072:SrFKDbAtgNrfAw1bsO8YzN2HsBpmxRGlu6rirP+R/x3zKFvlBz1:SrFAoOXcHfIfiKkvx
TLSH
T11C142910A7FD1B25F6FB4B79EDB6A0018A36FA263D13D31D15A0419E1876B40CA72B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll

Path C:\Windows\assembly\tmp\ZQPL5KCZ\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll
Size 64KB
SHA256 e36435590e80c1d27493fbb9cc2f7a402fb3207e7210d134233099d1c01cbe8c
MD5 64939e920a0619adb8e395877237b560
SHA1 c05ecc9674f7a9436a227da429b474910a163d9d
SHA512 05281db2372f72aa9ab44ac3dab79a3e506390ac6b317180273a32d6a4f82f36128b75ad7e706333dfe318766e21ec8f42a72e55b875faf86e152d4d592b624e
SSDEEP 1536:ZZan8MPqcyyaZM+TeVCB5+G9cTvdQc1bqMsmjhGBDypyBeQjzQC:lMPG7wqLDy8BtjkC
TLSH
T1F6532A2893F84723D6FF83B8B9F191435A76F543AE61CB6E18CA938908533D4491376B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-2106-0x000001F588AB0000-0x000001F588B9A000-memory.dmp

Download

memory/424-2121-0x000001C4D7780000-0x000001C4D786A000-memory.dmp

Download

memory/656-2003-0x0000000000330000-0x000000000038E000-memory.dmp

Download

memory/656-2004-0x0000000001220000-0x00000000012DB000-memory.dmp

Download

memory/728-2026-0x0000000000CA0000-0x0000000000D5B000-memory.dmp

Download

memory/844-2101-0x0000000000BB0000-0x0000000000C15000-memory.dmp

Download

memory/844-2102-0x0000000000930000-0x0000000000994000-memory.dmp

Download

memory/884-2129-0x0000027325CC0000-0x0000027325CCC000-memory.dmp

Download

memory/896-1902-0x00000000027B0000-0x0000000002814000-memory.dmp

Download

memory/1144-1576-0x0000019F6F3D0000-0x0000019F6F3DC000-memory.dmp

Download

memory/1292-1949-0x00000000005D0000-0x0000000000647000-memory.dmp

Download

memory/1292-1950-0x0000000000F20000-0x0000000000F84000-memory.dmp

Download

memory/1424-2107-0x00000000009F0000-0x0000000000AAB000-memory.dmp

Download

memory/1480-1577-0x000001CA7B910000-0x000001CA7B91C000-memory.dmp

Download

memory/1692-1947-0x00000000005D0000-0x0000000000647000-memory.dmp

Download

memory/1692-1948-0x0000000001630000-0x0000000001694000-memory.dmp

Download

memory/1792-1575-0x0000026481C90000-0x0000026481C9C000-memory.dmp

Download

memory/1892-2005-0x0000000000330000-0x000000000038E000-memory.dmp

Download

memory/1892-2006-0x0000000000E10000-0x0000000000ECB000-memory.dmp

Download

memory/1972-1629-0x00000000011A0000-0x000000000125B000-memory.dmp

Download

memory/1972-1634-0x00000000011A0000-0x000000000125B000-memory.dmp

Download

memory/2024-1839-0x0000000001620000-0x0000000001684000-memory.dmp

Download

memory/2144-2128-0x000002C2643E0000-0x000002C2644CA000-memory.dmp

Download

memory/2484-2120-0x00000000007E0000-0x000000000089B000-memory.dmp

Download

memory/2708-1740-0x0000000002D60000-0x0000000002DC4000-memory.dmp

Download

memory/2708-1739-0x0000000000BB0000-0x0000000000C15000-memory.dmp

Download

memory/2908-1944-0x00000000005D0000-0x0000000000647000-memory.dmp

Download

memory/2908-1945-0x0000000002D40000-0x0000000002DA4000-memory.dmp

Download

memory/3100-1667-0x00000000016C0000-0x000000000177B000-memory.dmp

Download

memory/3104-2113-0x0000000000E20000-0x0000000000EDB000-memory.dmp

Download

memory/3160-2084-0x00000000013E0000-0x000000000149B000-memory.dmp

Download

memory/3272-3284-0x000002964B7B0000-0x000002964B7D6000-memory.dmp

Download

memory/3272-3200-0x000002964B650000-0x000002964B65C000-memory.dmp

Download

memory/3272-3277-0x000002964C0F0000-0x000002964C156000-memory.dmp

Download

memory/3272-3071-0x000002964C3B0000-0x000002964C3C4000-memory.dmp

Download

memory/3272-3270-0x000002964B7B0000-0x000002964B7C6000-memory.dmp

Download

memory/3272-3048-0x000002964C520000-0x000002964C578000-memory.dmp

Download

memory/3272-3042-0x000002964B810000-0x000002964B81C000-memory.dmp

Download

memory/3272-3063-0x000002964B830000-0x000002964B83E000-memory.dmp

Download

memory/3272-3036-0x000002964C4B0000-0x000002964C516000-memory.dmp

Download

memory/3272-3033-0x000002964C3E0000-0x000002964C43E000-memory.dmp

Download

memory/3272-3067-0x000002964C170000-0x000002964C17E000-memory.dmp

Download

memory/3272-3024-0x000002964B7D0000-0x000002964B7DE000-memory.dmp

Download

memory/3272-3021-0x000002964C280000-0x000002964C2AE000-memory.dmp

Download

memory/3272-3092-0x000002964B7B0000-0x000002964B7BE000-memory.dmp

Download

memory/3272-3099-0x000002964B7B0000-0x000002964B7BE000-memory.dmp

Download

memory/3272-3106-0x000002964B7B0000-0x000002964B7BE000-memory.dmp

Download

memory/3272-3113-0x000002964B650000-0x000002964B65A000-memory.dmp

Download

memory/3272-3120-0x000002964C580000-0x000002964C5AA000-memory.dmp

Download

memory/3272-3127-0x000002964C580000-0x000002964C5B4000-memory.dmp

Download

memory/3272-3134-0x000002964C580000-0x000002964C5DC000-memory.dmp

Download

memory/3272-3140-0x000002964B7E0000-0x000002964B7FA000-memory.dmp

Download

memory/3272-3146-0x000002964B650000-0x000002964B65E000-memory.dmp

Download

memory/3272-3153-0x000002964B7D0000-0x000002964B7E8000-memory.dmp

Download

memory/3272-3160-0x000002964B650000-0x000002964B65A000-memory.dmp

Download

memory/3272-3075-0x000002964C470000-0x000002964C484000-memory.dmp

Download

memory/3272-3051-0x000002964C440000-0x000002964C468000-memory.dmp

Download

memory/3272-3039-0x000002964C380000-0x000002964C3A6000-memory.dmp

Download

memory/3272-3030-0x000002964C1B0000-0x000002964C1C2000-memory.dmp

Download

memory/3272-3027-0x000002964C350000-0x000002964C376000-memory.dmp

Download

memory/3272-3018-0x000002964C2D0000-0x000002964C346000-memory.dmp

Download

memory/3272-3015-0x000002964C190000-0x000002964C1A8000-memory.dmp

Download

memory/3272-3012-0x000002964B7C0000-0x000002964B7C8000-memory.dmp

Download

memory/3272-3009-0x000002964BB70000-0x000002964BB86000-memory.dmp

Download

memory/3272-3006-0x000002964BB50000-0x000002964BB6C000-memory.dmp

Download

memory/3272-3003-0x000002964C1D0000-0x000002964C22C000-memory.dmp

Download

memory/3272-3000-0x000002964C130000-0x000002964C164000-memory.dmp

Download

memory/3272-3263-0x000002964B9E0000-0x000002964BA38000-memory.dmp

Download

memory/3272-2997-0x000002964BA20000-0x000002964BA38000-memory.dmp

Download

memory/3272-2994-0x000002964C0F0000-0x000002964C126000-memory.dmp

Download

memory/3272-3256-0x000002964B7B0000-0x000002964B7D6000-memory.dmp

Download

memory/3272-2990-0x000002964B7B0000-0x000002964B7BE000-memory.dmp

Download

memory/3272-2987-0x000002964B7E0000-0x000002964B80A000-memory.dmp

Download

memory/3272-2983-0x000002964B660000-0x000002964B66A000-memory.dmp

Download

memory/3272-2980-0x000002964B9E0000-0x000002964BA14000-memory.dmp

Download

memory/3272-2976-0x000002964B650000-0x000002964B65A000-memory.dmp

Download

memory/3272-3167-0x000002964B7D0000-0x000002964B7E4000-memory.dmp

Download

memory/3272-3249-0x000002964C170000-0x000002964C1E6000-memory.dmp

Download

memory/3272-3242-0x000002964B9E0000-0x000002964BA3C000-memory.dmp

Download

memory/3272-3186-0x000002964B9E0000-0x000002964BA16000-memory.dmp

Download

memory/3272-3235-0x000002964B7B0000-0x000002964B7D8000-memory.dmp

Download

memory/3272-3228-0x000002964B7B0000-0x000002964B7C2000-memory.dmp

Download

memory/3272-3180-0x000002964B7D0000-0x000002964B7E8000-memory.dmp

Download

memory/3272-3221-0x000002964B7B0000-0x000002964B7DE000-memory.dmp

Download

memory/3272-3214-0x000002964B7B0000-0x000002964B7CC000-memory.dmp

Download

memory/3272-2027-0x000002964AA50000-0x000002964AB3A000-memory.dmp

Download

memory/3272-3207-0x000002964B650000-0x000002964B658000-memory.dmp

Download

memory/3272-3045-0x000002964C250000-0x000002964C26A000-memory.dmp

Download

memory/3272-3193-0x000002964B9E0000-0x000002964BA14000-memory.dmp

Download

memory/3272-2028-0x000002964B350000-0x000002964B5BE000-memory.dmp

Download

memory/3272-3174-0x000002964B7D0000-0x000002964B7E4000-memory.dmp

Download

memory/3304-2127-0x0000000001580000-0x000000000163B000-memory.dmp

Download

memory/3368-2114-0x0000029AA95C0000-0x0000029AA96AA000-memory.dmp

Download

memory/3496-1574-0x0000019C6F290000-0x0000019C6F29C000-memory.dmp

Download

memory/3508-1721-0x0000000001910000-0x0000000001974000-memory.dmp

Download

memory/3752-1630-0x0000000000BF0000-0x0000000000CAB000-memory.dmp

Download

memory/3752-1633-0x0000000000BF0000-0x0000000000CAB000-memory.dmp

Download

memory/3800-2140-0x00000232A0980000-0x00000232A098C000-memory.dmp

Download

memory/4124-1688-0x0000000000E10000-0x0000000000ECB000-memory.dmp

Download

memory/4124-1687-0x0000000000330000-0x000000000038E000-memory.dmp

Download

memory/4172-1842-0x00000000032C0000-0x0000000003324000-memory.dmp

Download

memory/4452-3590-0x000000001BBF0000-0x000000001BC0A000-memory.dmp

Download

memory/4452-3592-0x000000001C970000-0x000000001CC82000-memory.dmp

Download

memory/4452-3591-0x000000001C4A0000-0x000000001C96E000-memory.dmp

Download

memory/4452-3578-0x00000000014B0000-0x00000000014DC000-memory.dmp

Download

memory/4452-3589-0x000000001BB90000-0x000000001BBA8000-memory.dmp

Download

memory/4452-3588-0x000000001BB90000-0x000000001BB9E000-memory.dmp

Download

memory/4452-3587-0x000000001BBF0000-0x000000001BBFE000-memory.dmp

Download

memory/4452-3593-0x0000000001490000-0x000000000149C000-memory.dmp

Download

memory/4452-3582-0x000000001BB90000-0x000000001BB9A000-memory.dmp

Download

memory/4452-3586-0x000000001BC10000-0x000000001BC26000-memory.dmp

Download

memory/4452-3579-0x0000000001470000-0x000000000147E000-memory.dmp

Download

memory/4452-3583-0x000000001BB90000-0x000000001BB9E000-memory.dmp

Download

memory/4452-3580-0x000000001BB90000-0x000000001BB9A000-memory.dmp

Download

memory/4452-3581-0x000000001BB90000-0x000000001BB9C000-memory.dmp

Download

memory/4452-3595-0x000000001BFE0000-0x000000001C088000-memory.dmp

Download

memory/4452-3585-0x000000001BF80000-0x000000001BFC8000-memory.dmp

Download

memory/4452-3594-0x0000000001490000-0x000000000149C000-memory.dmp

Download

memory/4452-3584-0x000000001BB90000-0x000000001BB9E000-memory.dmp

Download

memory/4480-2100-0x00000000010F0000-0x0000000001154000-memory.dmp

Download

memory/4480-2099-0x0000000000BB0000-0x0000000000C15000-memory.dmp

Download

memory/4532-1841-0x0000000000C40000-0x0000000000CA4000-memory.dmp

Download

memory/4548-1773-0x0000000002500000-0x0000000002564000-memory.dmp

Download

memory/4588-2025-0x000001D840FE0000-0x000001D8410CA000-memory.dmp

Download

memory/4616-1795-0x0000000000F50000-0x0000000000FB4000-memory.dmp

Download

memory/4616-1794-0x0000000000E80000-0x0000000000EE5000-memory.dmp

Download

memory/4652-1793-0x00000000030B0000-0x0000000003114000-memory.dmp

Download

memory/4652-1792-0x0000000000E80000-0x0000000000EE5000-memory.dmp

Download

memory/4796-1685-0x0000000000330000-0x000000000038E000-memory.dmp

Download

memory/4796-1686-0x00000000013C0000-0x000000000147B000-memory.dmp

Download

memory/4832-2077-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4832-1627-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4832-1626-0x0000000000B30000-0x0000000000BEB000-memory.dmp

Download

memory/4832-1666-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4832-1665-0x0000000000B30000-0x0000000000BEB000-memory.dmp

Download

memory/4832-632-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4832-635-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4832-631-0x0000000000B30000-0x0000000000BEB000-memory.dmp

Download

memory/4832-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4832-4147-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4856-1742-0x00000000029F0000-0x0000000002A54000-memory.dmp

Download

memory/4856-1741-0x0000000000BB0000-0x0000000000C15000-memory.dmp

Download

memory/5012-2085-0x000001A6E47E0000-0x000001A6E48CA000-memory.dmp

Download